# uptime-kuma — triage (pin louislam/uptime-kuma:2.5.5, the normal (root) image, not -rootless)
Template: setup_gate: true; single-user app (the one account is the admin).

## Notices
- GHSA-98hr-q8q8-5j23 rootless sudo privilege escalation — NOT-A-FINDING: affects only the `-rootless` image variants; we ship `2.5.5`.
- GHSA-qjxc-h5jf-c7rj SSRF to cloud metadata (range `*`, no patch, "will not fix") — NOT-A-FINDING, decided by hand: the advisory itself says
  it is a deployment-platform issue for cloud IMDS (169.254.169.254); a Felhom box is home hardware with no metadata service, and the only
  account is the admin, who is meant to monitor internal URLs.
- release:2.5.8 — REAL: GHSA-v2p3-6f5h-6hhf "[Admin Only] RCE" (details not public yet; severity unsure). Login: admin. Reachable: only with the
  household's admin login.
- release:2.5.7 — REAL runtime fix: Node.js 22.23.4, rejects the leaked eMudhra CA.
- release:2.5.6 — weak: "chore: Update dependencies" (no CVE named); it is also the release that fixes GHSA-98hr (rootless only). Treat as hygiene.

## Fix
Smallest fixing the real item: 2.5.8. TARGET `louislam/uptime-kuma:2.5.8` (Docker Hub tag exists, no `v`). Same main (2): yes.
Breaking (3 releases read 2.5.6..2.5.8): 2.5.8 DROPS TLS support for the TCP Port monitor — existing TLS TCP monitors silently become plain TCP
monitors (a removed option + data conversion). Nothing else.
Lane: SECURITY_FIX if the operator accepts the TCP-TLS removal as minor (Felhom ships no TCP-TLS monitors by default); strictly by the rule it is a
removed feature → BIG_STEP. I lean SECURITY_FIX: admin-only RCE + CA distrust, and the removed option "never worked as expected" upstream.
Classifier note: GHSA-98hr's package name is "Rootless Docker Image only" — the watch should skip it for non-rootless tags; GHSA-qjxc (range `*`,
no patch, platform issue) should be filtered as permanent won't-fix.