diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index c621f301..e6d61ed4 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -10,6 +10,8 @@ on:
         required: true
 permissions:
   contents: read
+  packages: write
+
 jobs:
   docker:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 49272674..c4b377b1 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build-and-e2e:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3ad390a5..19a34957 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,6 +46,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      actions: write
     uses: ./.github/workflows/docker.yml
     secrets:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 3524b9d9..cabb543c 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build-and-unit:
     runs-on: ubuntu-latest
diff --git a/config/docker/static/favicon.png b/config/docker/static/favicon.png
index 6f4c7acf..612723fa 100644
Binary files a/config/docker/static/favicon.png and b/config/docker/static/favicon.png differ
diff --git a/package.json b/package.json
index 828074e2..0b45fcaa 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,7 @@
     "list:licenses": "node ./scripts/list-licenses.js",
     "license:check": "npx license-checker --production --onlyAllow 'MIT;ISC;Apache-2.0;BSD;BSD-2-Clause;BSD-3-Clause;CC-BY-4.0;CC0-1.0;Python-2.0 ' --summary",
     "changeset": "npx @changesets/cli --",
-    "release": "npm run build && npm run changeset publish",
+    "release": "npm run build && npm run changeset publish --tag next",
     "publish-cdn": "scripts/publish-cdn.sh"
   },
   "peerDependencies": {
diff --git a/src/utils/helpers.ts b/src/utils/helpers.ts
index fe392ecf..a22bb6c8 100644
--- a/src/utils/helpers.ts
+++ b/src/utils/helpers.ts
@@ -153,8 +153,8 @@ export function escapeHTMLAttrChars(str: string): string {
 export function unescapeHTMLChars(str: string): string {
   return str
     .replace(/&#(\d+);/g, (_m, code) => String.fromCharCode(parseInt(code, 10)))
-    .replace(/&/g, '&')
-    .replace(/"/g, '"');
+    .replace(/"/g, '"')
+    .replace(/&/g, '&');
 }
 
 export function sanitizeItemId(id: string): string {
diff --git a/src/utils/string.ts b/src/utils/string.ts
index 1eff944a..1de19fff 100644
--- a/src/utils/string.ts
+++ b/src/utils/string.ts
@@ -43,7 +43,7 @@ export function tryDecodeURIComponent(str: string): string {
   try {
     return decodeURIComponent(str);
   } catch (e) {
-    console.error(`Decoding failed: ${str}`, e);
+    console.error('Decoding failed: %s', str, e);
     return str;
   }
 }
diff --git a/src/utils/url.ts b/src/utils/url.ts
index 3721cde5..37f85023 100644
--- a/src/utils/url.ts
+++ b/src/utils/url.ts
@@ -9,7 +9,7 @@ export function urlParse(url: string, slashesDenoteHost = false): URL | null {
   try {
     return URL?.parse ? URL?.parse(processedUrl) : new URL(processedUrl);
   } catch (error) {
-    console.error(`Invalid URL: ${processedUrl}`, error);
+    console.error('Invalid URL: %s', processedUrl, error);
     return null;
   }
 }