# rallly — triage (pin lukevella/rallly:4.15.3; postgres:18-alpine untouched)
Template: setup_gate: true (closed to strangers only until first admin; public after). No SSO / conferencing env in compose.

## Notices
- GHSA-gmq4-f8j5-8w8q — REAL. critical (CVSS 9.8-class, Next.js next/og RCE). Range >=4.8.0 <4.15.4 covers 4.15.3.
  Login: none (`/api/og-image-poll` unauthenticated). Reachable on a box: YES once setup is done (public subdomain).
  Fixed 4.15.4.
- release:v4.15.4 — REAL, same as the GHSA above.
- release:v4.15.5 — REAL: Next.js GHSA-p3m5-59mp-jv5r Server Actions DoS (high, no login). Fixed 4.15.5.
- release:v4.16.2 — REAL runtime fix: image rebuilt on Node.js 24.22.1 (Oct-2026 Node security release, Brotli RCE CVE-2026-111497 + TLS/DNS).
- release:v4.16.0 — NOT-A-FINDING: hit on "Control Panel tells you ... whether it fixes a security issue" (feature text).

## Fix
Smallest fix for the GHSA: 4.15.4. Smallest fixing every real item: 4.16.2. TARGET: `lukevella/rallly:4.16.3` (Docker Hub tag exists; no `v` prefix, as our pin).
Same main (4): yes.
Breaking/migrations read in 6 releases (4.15.4..4.16.3):
- 4.16.0: 13 DB migrations run on start (additive — fine); Microsoft multi-tenant SSO sign-in now needs verified email claims (we ship no MS SSO);
  `SMTP_DEBUG` no longer does anything (not in our compose); new in-memory rate limit 200 responses/poll/hour, needs X-Real-IP from the proxy
  (our compose strips XFF, traefik sets X-Real-Ip — verify live that the tunnel does not make every visitor one IP); new hourly update check to api.rallly.co.
- 4.16.1: optional GOOGLE_/MICROSOFT_LOGIN_ENABLED. 4.16.3: DST fix only.
None of these is a file migration, a removed config we use, or a new required service.
Lane: SECURITY_FIX to 4.16.3. (Conservative alternative: 4.15.5 = Next.js fixes only, but it misses the Node runtime fix of 4.16.2.)
Workaround until shipped: block `/api/og-image-poll` at traefik.
Classifier note: release:v4.16.0 is a word-match on "security issue" in a feature description — not a fix.