diff --git a/README.md b/README.md index 6724c51..dc43265 100644 --- a/README.md +++ b/README.md @@ -384,9 +384,7 @@ Due to an incomplete implementation, Stoat will kick any user that attempts to s ## Security Advisories -- (`2024-06-21`) [GHSA-f26h-rqjq-qqjq stoatchat/stoatchat: Unrestricted account creation.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-f26h-rqjq-qqjq) -- (`2024-12-17`) [GHSA-7f9x-pm3g-j7p4 revoltchat/january: January service can call itself recursively, causing heavy load.](https://github.com/revoltchat/january/security/advisories/GHSA-7f9x-pm3g-j7p4) -- (`2025-02-10`) [GHSA-8684-rvfj-v3jq stoatchat/stoatchat: Webhook tokens are freely accessible for users with read permissions.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8684-rvfj-v3jq) -- (`2025-02-10`) [GHSA-h7h6-7pxm-mc66 stoatchat/stoatchat: Nearby message fetch requests can be crafted to fetch entire message history.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h7h6-7pxm-mc66) -- (`2026-05-17`) [GHSA-xhww-5g9p-vvq5 stoatchat/stoatchat: Unauthenticated SSRF in January Proxy and Embed Endpoints.](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5) -- (`2026-05-17`) [GHSA-q6j8-cm78-2rrg stoatchat/for-web: Stored XSS via "Trust Poisoning" of Opaque Origins (javascript:) in Link Safety Logic.](https://github.com/stoatchat/for-web/security/advisories/GHSA-q6j8-cm78-2rrg) \ No newline at end of file +You can find information about security advisories on Stoat repositories on Github. Listed below are the latest versions that contain remediations, and links to the security advisory pages. + +- backend - 0.15.0 - [stoatchat/stoatchat](https://github.com/stoatchat/stoatchat/security/advisories) +- for-web - 0.14.1 - [stoatchat/for-web](https://github.com/stoatchat/for-web/security/advisories) \ No newline at end of file diff --git a/compose.yml b/compose.yml index cca0eb7..741f950 100644 --- a/compose.yml +++ b/compose.yml @@ -16,7 +16,7 @@ services: # Redis: Event message broker & KV store redis: - image: docker.io/eqalpha/keydb + image: valkey/valkey:9-alpine restart: always # RabbitMQ: Internal message broker @@ -78,7 +78,7 @@ services: # API server api: - image: ghcr.io/stoatchat/api:v0.13.8 + image: ghcr.io/stoatchat/api:v0.15.1 env_file: secrets.env depends_on: database: @@ -95,7 +95,7 @@ services: # Events service events: - image: ghcr.io/stoatchat/events:v0.13.8 + image: ghcr.io/stoatchat/events:v0.15.1 env_file: secrets.env depends_on: database: @@ -110,7 +110,7 @@ services: # File server autumn: - image: ghcr.io/stoatchat/file-server:v0.13.8 + image: ghcr.io/stoatchat/file-server:v0.15.1 env_file: secrets.env depends_on: database: @@ -125,7 +125,7 @@ services: # Metadata and image proxy january: - image: ghcr.io/stoatchat/proxy:v0.13.8 + image: ghcr.io/stoatchat/proxy:v0.15.1 env_file: secrets.env volumes: - type: bind @@ -135,7 +135,7 @@ services: # Tenor proxy gifbox: - image: ghcr.io/stoatchat/gifbox:v0.13.8 + image: ghcr.io/stoatchat/gifbox:v0.15.1 env_file: secrets.env volumes: - type: bind @@ -145,7 +145,7 @@ services: # Regular task daemon crond: - image: ghcr.io/stoatchat/crond:v0.13.8 + image: ghcr.io/stoatchat/crond:v0.15.1 env_file: secrets.env depends_on: database: @@ -160,7 +160,7 @@ services: # Push notification daemon pushd: - image: ghcr.io/stoatchat/pushd:v0.13.8 + image: ghcr.io/stoatchat/pushd:v0.15.1 env_file: secrets.env depends_on: database: @@ -177,7 +177,7 @@ services: # Voice ingress daemon voice-ingress: - image: ghcr.io/stoatchat/voice-ingress:v0.13.8 + image: ghcr.io/stoatchat/voice-ingress:v0.15.1 env_file: secrets.env restart: always depends_on: @@ -222,7 +222,7 @@ services: # Web App web: - # for-web v0.10.0 - image: ghcr.io/stoatchat/for-web:746bee5 + # for-web v0.14.1 + image: ghcr.io/stoatchat/for-web:0c31cf0 restart: always env_file: .env.web \ No newline at end of file