feat(unkee): publish desktop 1.10.0 updater feed

.trivyignore

@@ -6,3 +6,19 @@
 # Not exploitable in our deployment: the blog serves static files only;
 # the JOSE code path is not reached at runtime.
 CVE-2026-34986
+
+# Go stdlib (net/http, crypto/tls) vulnerabilities baked into the caddy:alpine
+# runtime image, which still ships Go 1.26.8 as of 2026-10-09. Fixed upstream
+# in Go 1.26.9/1.27.2, but Caddy's official image hasn't been rebuilt against
+# it yet. Both are DoS-only (no RCE/data exposure); this blog is a static
+# site with no sensitive data or availability SLA. Drop once caddy:alpine
+# picks up the patched Go toolchain.
+CVE-2026-78667
+CVE-2026-97031
+
+# golang.org/x/net / stdlib's vendored net/http/internal/http2: DoS via
+# excessive HTTP/2 SETTINGS frames. Fixed in x/net 0.60.0 / Go 1.26.9+,
+# not yet present in caddy:alpine (still on x/net v0.59.0, Go 1.26.8 as
+# of 2026-10-09). DoS-only; static site, no availability SLA. Drop once
+# caddy:alpine picks up the patched toolchain/dependency.
+CVE-2026-78669

static/unkee/updates/latest.json

@@ -0,0 +1,10 @@
+{
+  "version": "1.10.0",
+  "pub_date": "2026-10-09T14:32:04.869Z",
+  "platforms": {
+    "darwin-aarch64": {
+      "signature": "dW50cnVzdGVkIGNvbW1lbnQ6IHNpZ25hdHVyZSBmcm9tIHRhdXJpIHNlY3JldCBrZXkKUlVSK2gzdW9jS3ZEMXVCSWFkaW5yWEpiTmpnNW9CaUJ6ZkU0MEo0OWtLUUNWZnFjQlRyQkM5MG9VOFY3Wm5jcm5GTzYzd1o0Z09EQkZPWXI2Y1hDQ0xsMTJ4azJqaWg0V2dzPQp0cnVzdGVkIGNvbW1lbnQ6IHRpbWVzdGFtcDoxNzkxNTU2MzI0CWZpbGU6VW5LZWVfMS4xMC4wX2Rhcndpbi1hYXJjaDY0LmFwcC50YXIuZ3oKMGlidkhnTnRaVzQwOXJXM3Vxb1J2a0g4OG9DOVMrQUZtaStIdmxRVFJSbjdBK1dTMitMTFpJbG8xZnpPdWxXa0pPRnR2NW9MdWVUY3dLOWtWVU4yQ0E9PQo=",
+      "url": "https://techquests.dev/unkee/updates/UnKee_1.10.0_darwin-aarch64.app.tar.gz"
+    }
+  }
+}