# wishlist — triage (group D)
Pin: ghcr.io/cmintey/wishlist:v0.67.1. Gates: setup_gate + signup_block (/signup) + app sign-up switch closed by command.

## release:cmintey/wishlist@v0.69.0 — REAL, app security fixes + Node runtime
Read the PR diffs:
- PR #818 "remove reset token exposure": in v0.67.1 `src/routes/forgot-password/+page.server.ts` the form action creates
  a reset token for ANY existing e-mail and RETURNS it in the action result (`return { success: true, token }`). The
  action runs whether or not SMTP is enabled (only the page UI hides the form). A stranger who knows/guesses a user's
  e-mail POSTs to /forgot-password and receives the token -> /reset-password -> account takeover (admin included).
  Severity: CRITICAL (my rating; no GHSA published yet). Login: none. Reachable: YES — after the setup gate opens the
  app is public; signup_block covers only /signup. (Read from source, not tested live.)
- PR #817 "validate list ownership on modifying APIs": any logged-in user could PATCH other users' lists/items (IDOR).
  Medium; login: any user.
- PR #832 admin "clear sessions" action was not implemented. Low; admin.
- Node.js Oct 2026 CVEs (base node:24-slim re-pinned, PR #829). Runtime; SvelteKit node adapter does not inflate bodies.
## release:cmintey/wishlist@v0.68.0 "nodemailer v10 [SECURITY]" — NOT-A-FINDING
GHSA-6vj9-mwq6-2f5v: process-global DNS cache leaks TLS servername across multiple SMTPS transports (multi-tenant).
Wishlist uses one transport; our template sets no SMTP. Fixed anyway by the target.

## Fix / target
Smallest fix = TARGET: `ghcr.io/cmintey/wishlist:v0.69.0` (ghcr tag exists; `v` prefix matches pin). Same main: yes (0).
Breaking: none found (read v0.68.0, v0.69.0): entrypoint now `exec node build` (still runs migrate+seed+db:patch first);
pnpm 12 via corepack; prisma migrations auto; manager/owner permission semantics changed (#819). Our healthcheck/command
need only `node` + node:sqlite — still present (node:24-slim).
Lane: SECURITY_FIX — urgent.
Classifier note: the v0.69.0 summary is a URL fragment; it should quote the "## Security" paragraph. Hit itself is right.