chore: Update backend services to 0.13.5 (#282)

* chore: Update backend services to 0.13.5

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>

* chore: Update for-web to 0.6.0

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>

---------

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>

README.md

@@ -434,3 +434,5 @@ Due to an incomplete implementation, Stoat will kick any user that attempts to s
 - (`2024-12-17`) [GHSA-7f9x-pm3g-j7p4 revoltchat/january: January service can call itself recursively, causing heavy load.](https://github.com/revoltchat/january/security/advisories/GHSA-7f9x-pm3g-j7p4)
 - (`2025-02-10`) [GHSA-8684-rvfj-v3jq stoatchat/stoatchat: Webhook tokens are freely accessible for users with read permissions.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8684-rvfj-v3jq)
 - (`2025-02-10`) [GHSA-h7h6-7pxm-mc66 stoatchat/stoatchat: Nearby message fetch requests can be crafted to fetch entire message history.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h7h6-7pxm-mc66)
+- (`2026-05-17`) [GHSA-xhww-5g9p-vvq5 stoatchat/stoatchat: Unauthenticated SSRF in January Proxy and Embed Endpoints.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5)
+- (`2026-05-17`) [GHSA-q6j8-cm78-2rrg stoatchat/for-web: Stored XSS via "Trust Poisoning" of Opaque Origins (javascript:) in Link Safety Logic.](https://github.com/stoatchat/for-web/security/advisories/GHSA-q6j8-cm78-2rrg)

compose.yml

@@ -77,7 +77,7 @@ services:
 
   # API server
   api:
-    image: ghcr.io/stoatchat/api:v0.12.0
+    image: ghcr.io/stoatchat/api:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -94,7 +94,7 @@ services:
 
   # Events service
   events:
-    image: ghcr.io/stoatchat/events:v0.12.0
+    image: ghcr.io/stoatchat/events:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -109,7 +109,7 @@ services:
 
   # File server
   autumn:
-    image: ghcr.io/stoatchat/file-server:v0.12.0
+    image: ghcr.io/stoatchat/file-server:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -124,7 +124,7 @@ services:
 
   # Metadata and image proxy
   january:
-    image: ghcr.io/stoatchat/proxy:v0.12.0
+    image: ghcr.io/stoatchat/proxy:v0.13.5
     env_file: secrets.env
     volumes:
       - type: bind
@@ -134,7 +134,7 @@ services:
 
   # Tenor proxy
   gifbox:
-    image: ghcr.io/stoatchat/gifbox:v0.12.0
+    image: ghcr.io/stoatchat/gifbox:v0.13.5
     env_file: secrets.env
     volumes:
       - type: bind
@@ -144,7 +144,7 @@ services:
 
   # Regular task daemon
   crond:
-    image: ghcr.io/stoatchat/crond:v0.12.0
+    image: ghcr.io/stoatchat/crond:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -159,7 +159,7 @@ services:
 
   # Push notification daemon
   pushd:
-    image: ghcr.io/stoatchat/pushd:v0.12.0
+    image: ghcr.io/stoatchat/pushd:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -176,7 +176,7 @@ services:
 
    # Voice ingress daemon
   voice-ingress:
-    image: ghcr.io/stoatchat/voice-ingress:v0.12.0
+    image: ghcr.io/stoatchat/voice-ingress:v0.13.5
     env_file: secrets.env
     restart: always
     depends_on:
@@ -221,7 +221,7 @@ services:
 
   # Web App
   web:
-    # for-web v0.5.0
-    image: ghcr.io/stoatchat/for-web:3a83b8c
+    # for-web v0.6.0
+    image: ghcr.io/stoatchat/for-web:4414eac
     restart: always
     env_file: .env.web