# wanderer — triage (pins flomp/wanderer-web:v0.20.0, flomp/wanderer-db:v0.20.0; meilisearch v1.36.0 untouched)
Upstream repo now open-wanderer/wanderer (images still flomp/*).
Template: NO gate (R-714: web calls its DB via the public name); signup_block + after_setup SIGNUP_CLOSED. PocketBase (wanderer-db) is
published on its own public subdomain (SUBDOMAIN_DB).
ActivityPub federation: ON — wanderer has no switch to turn it off (docs run/environment-configuration.md at v0.21.2 lists none;
federation is core). Inbound inbox is reachable by any remote actor through the public web subdomain.

## Notices (all 9 REAL — every range covers v0.20.0)
| GHSA | sev | login | fixed |
|---|---|---|---|
| fprh-3pp9-68m9 AP Create/Update no ownership check + unsanitized HTML (incomplete fix of xcwc) | critical | none (remote actor) | v0.21.2 |
| xcwc-jhv2-w4h6 AP Delete without ownership check — remote actor deletes any local trail/list | high | none | v0.21.0 |
| mr29-2qg5-m4fw inbox trusts client X-Forwarded-Path → forge local inbox route | high | none | v0.21.0 |
| 8j93-xvwx-jjg3 SSRF guard bypass via IPv6 transition addresses | high | none/any user (follow) | v0.21.0 |
| j9m4-8qwf-jvx6 SSRF via AP list image attachments | high | none | v0.21.2 |
| 3xp7-7492-j2q6 SSRF via AP attachment URLs (range <=v0.21.1) | medium | none | v0.21.2 |
| vprp-gr6m-j375 blind SSRF via inbox delivery | medium | none | v0.21.2 |
| 332v-mq7g-5hqf comments/summit_logs/trail_like author not bound | medium | any user | v0.21.0 |
| vj82-xj83-jp85 waypoints createRule omits trail ownership | medium | any user | v0.21.0 |
Reachable on a box: YES (no gate; federation always on; sign-up closed after setup limits the "any user" ones to household accounts).
release:v0.21.0 and release:v0.21.2 hits — REAL (they are these GHSA fixes). v0.21.1 also has unlisted security fixes (stored XSS, owner change).

## Fix
Smallest fixing all: v0.21.2. TARGET `flomp/wanderer-web:v0.21.2` + `flomp/wanderer-db:v0.21.2` (Docker Hub tags verified; NOT the `-app` variants
unless the mobile app is wanted). Same main (0): yes.
Breaking (3 releases read: v0.21.0, v0.21.1, v0.21.2):
- v0.21.0: NEW REQUIRED env `POCKETBASE_PROXY_SECRET`, same value on db and web (missing → inbound federation rejected); new deploy secret needed.
- v0.21.1: first-start migrations clean stored rich text and tag names; text over field length is SHORTENED and a downgrade does not restore it
  (lossy data conversion); web now forwards visitor IP; `ADDRESS_HEADER` semantics changed; Hammerhead plugin bundle manual update.
- v0.21.2: upstream says bind PocketBase to 127.0.0.1:8090 (our template publishes it on a public subdomain — the web UI "does not need
  port 8090" any more, so the db route could be dropped, but that is a template redesign); BODY_SIZE_LIMIT default 2G (we set Infinity, still
  allowed); AP deliveries need signed digest + date within 1 h.
Lane: BIG_STEP (same main version but a new required secret + lossy migration + template change).
Classifier note: none (ranges correct). Note fprh is an incomplete-fix of xcwc; 0.21.0 alone is not enough.