feat: Update to v0.14.x on backend and for-web, update keydb to valkey (#297)

* feat: Update to 0.14 services, update redis from keydb to valkey

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>

* fix: Update for-web to v0.14.1

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>

* chore: Update to backend 0.15.0, update advisories

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>

* feat: 0.15.1

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>

---------

Signed-off-by: Jacob Schlecht <dadadah@echoha.us>

README.md

@@ -384,9 +384,7 @@ Due to an incomplete implementation, Stoat will kick any user that attempts to s
 
 ## Security Advisories
 
-- (`2024-06-21`) [GHSA-f26h-rqjq-qqjq stoatchat/stoatchat: Unrestricted account creation.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-f26h-rqjq-qqjq)
-- (`2024-12-17`) [GHSA-7f9x-pm3g-j7p4 revoltchat/january: January service can call itself recursively, causing heavy load.](https://github.com/revoltchat/january/security/advisories/GHSA-7f9x-pm3g-j7p4)
-- (`2025-02-10`) [GHSA-8684-rvfj-v3jq stoatchat/stoatchat: Webhook tokens are freely accessible for users with read permissions.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8684-rvfj-v3jq)
-- (`2025-02-10`) [GHSA-h7h6-7pxm-mc66 stoatchat/stoatchat: Nearby message fetch requests can be crafted to fetch entire message history.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h7h6-7pxm-mc66)
-- (`2026-05-17`) [GHSA-xhww-5g9p-vvq5 stoatchat/stoatchat: Unauthenticated SSRF in January Proxy and Embed Endpoints.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5)
-- (`2026-05-17`) [GHSA-q6j8-cm78-2rrg stoatchat/for-web: Stored XSS via "Trust Poisoning" of Opaque Origins (javascript:) in Link Safety Logic.](https://github.com/stoatchat/for-web/security/advisories/GHSA-q6j8-cm78-2rrg)
+You can find information about security advisories on Stoat repositories on Github. Listed below are the latest versions that contain remediations, and links to the security advisory pages.
+
+- backend - 0.15.0 - [stoatchat/stoatchat](https://github.com/stoatchat/stoatchat/security/advisories)
+- for-web - 0.14.1 - [stoatchat/for-web](https://github.com/stoatchat/for-web/security/advisories)

compose.yml

@@ -16,7 +16,7 @@ services:
 
   # Redis: Event message broker & KV store
   redis:
-    image: docker.io/eqalpha/keydb
+    image: valkey/valkey:9-alpine
     restart: always
 
   # RabbitMQ: Internal message broker
@@ -78,7 +78,7 @@ services:
 
   # API server
   api:
-    image: ghcr.io/stoatchat/api:v0.13.8
+    image: ghcr.io/stoatchat/api:v0.15.1
     env_file: secrets.env
     depends_on:
       database:
@@ -95,7 +95,7 @@ services:
 
   # Events service
   events:
-    image: ghcr.io/stoatchat/events:v0.13.8
+    image: ghcr.io/stoatchat/events:v0.15.1
     env_file: secrets.env
     depends_on:
       database:
@@ -110,7 +110,7 @@ services:
 
   # File server
   autumn:
-    image: ghcr.io/stoatchat/file-server:v0.13.8
+    image: ghcr.io/stoatchat/file-server:v0.15.1
     env_file: secrets.env
     depends_on:
       database:
@@ -125,7 +125,7 @@ services:
 
   # Metadata and image proxy
   january:
-    image: ghcr.io/stoatchat/proxy:v0.13.8
+    image: ghcr.io/stoatchat/proxy:v0.15.1
     env_file: secrets.env
     volumes:
       - type: bind
@@ -135,7 +135,7 @@ services:
 
   # Tenor proxy
   gifbox:
-    image: ghcr.io/stoatchat/gifbox:v0.13.8
+    image: ghcr.io/stoatchat/gifbox:v0.15.1
     env_file: secrets.env
     volumes:
       - type: bind
@@ -145,7 +145,7 @@ services:
 
   # Regular task daemon
   crond:
-    image: ghcr.io/stoatchat/crond:v0.13.8
+    image: ghcr.io/stoatchat/crond:v0.15.1
     env_file: secrets.env
     depends_on:
       database:
@@ -160,7 +160,7 @@ services:
 
   # Push notification daemon
   pushd:
-    image: ghcr.io/stoatchat/pushd:v0.13.8
+    image: ghcr.io/stoatchat/pushd:v0.15.1
     env_file: secrets.env
     depends_on:
       database:
@@ -177,7 +177,7 @@ services:
 
    # Voice ingress daemon
   voice-ingress:
-    image: ghcr.io/stoatchat/voice-ingress:v0.13.8
+    image: ghcr.io/stoatchat/voice-ingress:v0.15.1
     env_file: secrets.env
     restart: always
     depends_on:
@@ -222,7 +222,7 @@ services:
 
   # Web App
   web:
-    # for-web v0.10.0
-    image: ghcr.io/stoatchat/for-web:746bee5
+    # for-web v0.14.1
+    image: ghcr.io/stoatchat/for-web:0c31cf0
     restart: always
     env_file: .env.web