From 6ba3b7c8be51ecb1fd1d80883d9768a758e84a4c Mon Sep 17 00:00:00 2001
From: Dmitry Lyzo <ashephard0@gmail.com>
Date: Mon, 27 Apr 2026 21:14:18 +0300
Subject: [PATCH 1/3] Fix opening links with noreferrer

rel="noreferrer" has the same effect as rel="noopener", but also
prevents the Referer header from being sent to the new page.
[https://mui.com/material-ui/react-link/#security]

If this feature is set, the browser will omit the Referer header,
as well as set noopener to true.
[https://developer.mozilla.org/en-US/docs/Web/API/Window/open#noreferrer]
---
 web/src/app/utils.js                 | 2 +-
 web/src/components/Notifications.jsx | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/web/src/app/utils.js b/web/src/app/utils.js
index d6467eb7..a43a9e03 100644
--- a/web/src/app/utils.js
+++ b/web/src/app/utils.js
@@ -178,7 +178,7 @@ export const formatPrice = (n) => {
 };
 
 export const openUrl = (url) => {
-  window.open(url, "_blank", "noopener,noreferrer");
+  window.open(url, "_blank", "noreferrer");
 };
 
 export const sounds = {
diff --git a/web/src/components/Notifications.jsx b/web/src/components/Notifications.jsx
index ca07847d..3b134abc 100644
--- a/web/src/components/Notifications.jsx
+++ b/web/src/components/Notifications.jsx
@@ -164,7 +164,7 @@ const autolink = (s) => {
   const parts = s.split(/(\bhttps?:\/\/[-A-Z0-9+\u0026\u2019@#/%?=()~_|!:,.;]*[-A-Z0-9+\u0026@#/%=~()_|]\b)/gi);
   for (let i = 1; i < parts.length; i += 2) {
     parts[i] = (
-      <Link key={i} href={parts[i]} underline="hover" target="_blank" rel="noreferrer,noopener">
+      <Link key={i} href={parts[i]} underline="hover" target="_blank" rel="noreferrer">
         {shortUrl(parts[i])}
       </Link>
     );

From 9ccad9da2e6674f43239d332bfb3453095b4869c Mon Sep 17 00:00:00 2001
From: Simon Ramsay <nexus-uw@users.noreply.github.com>
Date: Fri, 15 May 2026 23:09:56 -0700
Subject: [PATCH 2/3] Add directories for attachment, mail, and s3 to
 Dockerfile-build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added new directories for attachment, mail, and s3 to the build process.

build was failing with

>16.61     │ server/server.go:39:2: no required module provides package heckel.io/ntfy/v2/mail; to add it:
---
 Dockerfile-build | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Dockerfile-build b/Dockerfile-build
index 23503fd7..0a7f0623 100644
--- a/Dockerfile-build
+++ b/Dockerfile-build
@@ -45,6 +45,9 @@ ADD ./db ./db
 ADD ./message ./message
 ADD ./model ./model
 ADD ./webpush ./webpush
+ADD ./attachment ./attachment
+ADD ./mail ./mail
+ADD ./s3 ./s3
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build make VERSION=$VERSION COMMIT=$COMMIT cli-linux-server
 
 FROM alpine

From 22154792945fd02d858619709899fc6585ddcc5a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 30 May 2026 17:11:55 +0000
Subject: [PATCH 3/3] Bump actions/setup-go from 4 to 6

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 6.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/build.yaml   | 2 +-
 .github/workflows/release.yaml | 2 +-
 .github/workflows/test.yaml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 4ef26c7b..7cb93f7e 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -10,7 +10,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v6
         with:
           go-version: '1.26.x'
       - name: Install node
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e864ca44..a4e551f6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -27,7 +27,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v6
         with:
           go-version: '1.26.x'
       - name: Install node
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 01af33a8..97422a57 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -27,7 +27,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v6
         with:
           go-version: '1.26.x'
       - name: Install node