diff --git a/CHANGELOG.md b/CHANGELOG.md
index d380215..0691f4a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,23 @@
+## [2.6.1] - 2026-09-16
+
+### Fixed
+- **`app.notify` grew without bound in any long-lived tab.** It subscribes to
+  every model event for the life of the page and appended each one to an array
+  nothing ever trimmed, then re-collapsed that whole array on every new event to
+  render 30 rows -- so one arriving event cost O(history), on a history that
+  only grew. Reproduced in theta-directory, where a browser killed the tab at
+  4GB; the proxy's UI loads the same shell and the same feed, so it carried the
+  same defect. Fixed upstream in `@simpleworkjs/frontend` v0.4.3.
+- **`nodejs/package.json` said `2.5.3` on a tree released as v2.6.0.** The
+  v2.6.0 release commit updated the changelog and was tagged, but never bumped
+  the version field, so the package reported a version three releases stale.
+  Corrected here rather than left to drift further.
+
+### Changed
+- `@simpleworkjs/frontend` `^0.4.0` -> `^0.4.3`. The lockfile had been pinned at
+  0.4.1, so this also picks up 0.4.2 (notification model icons, foreground
+  toasts, `app.notify.clear()`) and 0.4.1's `app.messages.confirm()` fix.
+
 ## [2.6.0] - 2026-09-13
 
 ### Added
diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json
index ba6c1fc..0a4c5f3 100644
--- a/nodejs/package-lock.json
+++ b/nodejs/package-lock.json
@@ -14,7 +14,7 @@
         "@simpleworkjs/app-stack": "^1.0.0",
         "@simpleworkjs/bao-conf": "^1.0.2",
         "@simpleworkjs/conf": "^1.2.0",
-        "@simpleworkjs/frontend": "^0.4.0",
+        "@simpleworkjs/frontend": "^0.4.3",
         "@simpleworkjs/ldap": "^1.0.0",
         "@simpleworkjs/oidc-client": "^1.1.1",
         "acme-client": "^5.4.0",
@@ -323,9 +323,9 @@
       }
     },
     "node_modules/@simpleworkjs/frontend": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@simpleworkjs/frontend/-/frontend-0.4.1.tgz",
-      "integrity": "sha512-xwsEvfuez35122ARQX6nuQyZykrxT3UAnVExLgioRUehQB1cedoA9zlPSEhw4Z0rO8Q0Tg4eQrMwwVRVDhi1LA==",
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/frontend/-/frontend-0.4.3.tgz",
+      "integrity": "sha512-v8mZqvaM41gjApGRdT707+45bHriZw3EK3s3nkCczk+Ipm5fiOw0BnVkzNxXL6KlvyCAPsQ04UQy1VbCDsKgRg==",
       "license": "MIT",
       "engines": {
         "node": ">=18.0.0"
diff --git a/nodejs/package.json b/nodejs/package.json
index f2a797c..1543658 100644
--- a/nodejs/package.json
+++ b/nodejs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "theta-proxy",
-  "version": "2.5.3",
+  "version": "2.6.1",
   "author": [
     {
       "name": "William Mantly",
@@ -24,7 +24,7 @@
     "@simpleworkjs/app-stack": "^1.0.0",
     "@simpleworkjs/bao-conf": "^1.0.2",
     "@simpleworkjs/conf": "^1.2.0",
-    "@simpleworkjs/frontend": "^0.4.0",
+    "@simpleworkjs/frontend": "^0.4.3",
     "@simpleworkjs/ldap": "^1.0.0",
     "@simpleworkjs/oidc-client": "^1.1.1",
     "acme-client": "^5.4.0",