From f90b0e01bf6dc080f80137910d0c11b27fb02637 Mon Sep 17 00:00:00 2001
From: Jacob Schlecht <dadadah@echoha.us>
Date: Sun, 17 May 2026 12:26:42 -0600
Subject: [PATCH] chore: Update backend services to 0.13.5

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>
---
 README.md   |  2 ++
 compose.yml | 16 ++++++++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 6bef0d4..ae01a8f 100644
--- a/README.md
+++ b/README.md
@@ -434,3 +434,5 @@ Due to an incomplete implementation, Stoat will kick any user that attempts to s
 - (`2024-12-17`) [GHSA-7f9x-pm3g-j7p4 revoltchat/january: January service can call itself recursively, causing heavy load.](https://github.com/revoltchat/january/security/advisories/GHSA-7f9x-pm3g-j7p4)
 - (`2025-02-10`) [GHSA-8684-rvfj-v3jq stoatchat/stoatchat: Webhook tokens are freely accessible for users with read permissions.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8684-rvfj-v3jq)
 - (`2025-02-10`) [GHSA-h7h6-7pxm-mc66 stoatchat/stoatchat: Nearby message fetch requests can be crafted to fetch entire message history.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h7h6-7pxm-mc66)
+- (`2026-05-17`) [GHSA-xhww-5g9p-vvq5 stoatchat/stoatchat: Unauthenticated SSRF in January Proxy and Embed Endpoints.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5)
+- (`2026-05-17`) [GHSA-q6j8-cm78-2rrg stoatchat/for-web: Stored XSS via "Trust Poisoning" of Opaque Origins (javascript:) in Link Safety Logic.](https://github.com/stoatchat/for-web/security/advisories/GHSA-q6j8-cm78-2rrg)
\ No newline at end of file
diff --git a/compose.yml b/compose.yml
index 4486e84..24d1f6e 100644
--- a/compose.yml
+++ b/compose.yml
@@ -77,7 +77,7 @@ services:
 
   # API server
   api:
-    image: ghcr.io/stoatchat/api:v0.12.0
+    image: ghcr.io/stoatchat/api:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -94,7 +94,7 @@ services:
 
   # Events service
   events:
-    image: ghcr.io/stoatchat/events:v0.12.0
+    image: ghcr.io/stoatchat/events:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -109,7 +109,7 @@ services:
 
   # File server
   autumn:
-    image: ghcr.io/stoatchat/file-server:v0.12.0
+    image: ghcr.io/stoatchat/file-server:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -124,7 +124,7 @@ services:
 
   # Metadata and image proxy
   january:
-    image: ghcr.io/stoatchat/proxy:v0.12.0
+    image: ghcr.io/stoatchat/proxy:v0.13.5
     env_file: secrets.env
     volumes:
       - type: bind
@@ -134,7 +134,7 @@ services:
 
   # Tenor proxy
   gifbox:
-    image: ghcr.io/stoatchat/gifbox:v0.12.0
+    image: ghcr.io/stoatchat/gifbox:v0.13.5
     env_file: secrets.env
     volumes:
       - type: bind
@@ -144,7 +144,7 @@ services:
 
   # Regular task daemon
   crond:
-    image: ghcr.io/stoatchat/crond:v0.12.0
+    image: ghcr.io/stoatchat/crond:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -159,7 +159,7 @@ services:
 
   # Push notification daemon
   pushd:
-    image: ghcr.io/stoatchat/pushd:v0.12.0
+    image: ghcr.io/stoatchat/pushd:v0.13.5
     env_file: secrets.env
     depends_on:
       database:
@@ -176,7 +176,7 @@ services:
 
    # Voice ingress daemon
   voice-ingress:
-    image: ghcr.io/stoatchat/voice-ingress:v0.12.0
+    image: ghcr.io/stoatchat/voice-ingress:v0.13.5
     env_file: secrets.env
     restart: always
     depends_on: