felhom-gates-runner-2(version:v0.6.1) received task 2430 of job watch, be triggered by event: workflow_dispatch
workflow prepared
evaluating expression 'success()'
expression 'success()' evaluated to 'true'
evaluating expression ''
expression '' evaluated to 'true'
⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n  git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n  git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n  echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
base=http://gitea.gitea-system.svc.cluster.local:3000/admin
git init -q . && git remote add origin $base/felhom.eu.git
git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
for r in felhom-controller app-catalog-felhom.eu; do
  git init -q ../$r && git -C ../$r remote add origin $base/$r.git
  git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
  echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
done
shell: bash --noprofile --norc -e -o pipefail {0}
::endgroup::
felhom.eu main at 6ee23a3b8f90
felhom-controller at e01eb64b2591
app-catalog-felhom.eu at f61800aae945
::group::Run set -u
set -u
mkdir -p documentation/security-watch
mode="${MODE:-run}"
[ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
echo "mode: $mode"
case "$mode" in
  test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
  dry)  extra="--no-mail" ; state=/tmp/state-dry.json
        cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
  seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
  run)  extra="" ; state=documentation/security-watch/state.json ;;
  *) echo "unknown mode $mode"; exit 2 ;;
esac
python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
  --controller=../felhom-controller --json=/tmp/watch-results.json $extra
shell: bash --noprofile --norc -e -o pipefail {0}
env:
  RESEND_API_KEY: ***
  GH_ADVISORY_TOKEN: 
  MODE: seed
::endgroup::
mode: seed
/root/.cache/act/33378d3d739c1729/hostexecutor/scripts/security_watch.py:715: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
security watch 2026-10-26: 108 pins (11 box/build, 97 app); GitHub key ABSENT — apps' advisories in a 2-night rotation
ADVISORY    box  cloudflare/cloudflared                         2026.10.3              feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.4:VULN-176088 (fixed 2026.10.4)
ADVISORY    box  gtstef/filebrowser                             1.5.6-stable           GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
ADVISORY    box  traefik                                        v3.7.13                GHSA-hrpp-p4fc-wwf8 (fixed v3.7.16); GHSA-p8wx-ph99-xgcr (fixed v3.7.15); GHSA-fh26-gfpp-7xxx (fixed v3.7.14); GHSA-qvj7-gq9c-hp7q (fixed v3.7.14); … 11 more
ADVISORY    app  codewithcj/sparkyfitness                       v0.17.3                GHSA-v883-jx9h-qf29 (fixed no fixed version named yet); GHSA-cmmf-53wf-r5gv (fixed no fixed version named yet); GHSA-p8cf-g8rv-gvrq (fixed no fixed version named yet)
ADVISORY    app  codewithcj/sparkyfitness_server                v0.17.3                GHSA-v883-jx9h-qf29 (fixed no fixed version named yet); GHSA-cmmf-53wf-r5gv (fixed no fixed version named yet); GHSA-p8cf-g8rv-gvrq (fixed no fixed version named yet)
ADVISORY    app  docmost/docmost                                0.96.0                 release:docmost/docmost@v0.97.0 (fixed v0.97.0)
ADVISORY    app  f0rc3/gokapi                                   v1.9.6                 GHSA-45vh-rpc8-hxpp (fixed 2.2.4); GHSA-qwc6-vc2v-2ggj (fixed 2.2.4); GHSA-j6jp-78w8-34x6 (fixed 2.2.4); GHSA-m2hx-wjxc-9fp4 (fixed 2.2.3); … 6 more
ADVISORY    app  fallenbagel/jellyseerr                         2.7.3                  GHSA-8j73-j6rc-q8xh (fixed 3.5.0); GHSA-xc6j-6p6h-p799 (fixed 3.5.0); GHSA-mc6w-69r3-62h8 (fixed 3.4.0); GHSA-gx3h-3jg5-q65f (fixed 3.1.0); … 2 more
ADVISORY    app  flomp/wanderer-db                              v0.20.0                GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 7 more
ADVISORY    app  flomp/wanderer-web                             v0.20.0                GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 7 more
ADVISORY    app  freikin/dawarich                               1.15.3                 release:Freika/dawarich@1.17.0 (fixed 1.17.0)
ADVISORY    app  ghcr.io/advplyr/audiobookshelf                 2.37.1                 release:advplyr/audiobookshelf@v2.37.2 (fixed v2.37.2)
ADVISORY    app  ghcr.io/alam00000/bentopdf                     v2.8.6                 GHSA-wh78-rcw2-hhg9 (fixed v2.8.7); GHSA-5xjf-rr5x-pcfj (fixed no fixed version named yet); GHSA-cx8x-7rrr-r9x8 (fixed no fixed version named yet); release:alam00000/bentopdf@v2.8.10 (fixed v2.8.10); … 1 more
ADVISORY    app  ghcr.io/cmintey/wishlist                       v0.67.1                release:cmintey/wishlist@v0.69.0 (fixed v0.69.0); release:cmintey/wishlist@v0.68.0 (fixed v0.68.0)
ADVISORY    app  ghcr.io/home-assistant/home-assistant          2026.9.4               GHSA-jff5-5j3g-vhqc (fixed the range is unreadable — check by hand)
ADVISORY    app  ghcr.io/immich-app/immich-machine-learning     v3.2.4                 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand); release:immich-app/immich@v3.3.5 (fixed v3.3.5)
ADVISORY    app  ghcr.io/immich-app/immich-server               v3.2.4                 GHSA-8244-8vpr-vp9c (fixed the range is unreadable — check by hand); release:immich-app/immich@v3.3.5 (fixed v3.3.5)
ADVISORY    app  ghcr.io/karakeep-app/karakeep                  0.33.2                 GHSA-pp34-2c9r-mchw (fixed no fixed version named yet); release:karakeep-app/karakeep@v0.34.1 (fixed v0.34.1); release:karakeep-app/karakeep@v0.34.0 (fixed v0.34.0)
ADVISORY    app  ghcr.io/sysadminsmedia/homebox                 0.26.2                 release:sysadminsmedia/homebox@v0.27.1 (fixed v0.27.1); release:sysadminsmedia/homebox@v0.27.0 (fixed v0.27.0)
ADVISORY    app  ghcr.io/tandoorrecipes/recipes                 2.6.15                 release:TandoorRecipes/recipes@2.7.0 (fixed 2.7.0)
ADVISORY    app  grafana/grafana                                13.2.3                 release:grafana/grafana@v13.2.4 (fixed v13.2.4)
ADVISORY    app  jellyfin/jellyfin                              10.11.11               GHSA-cf3c-8m59-2vhx (fixed 12.0); GHSA-6828-c7cx-hvqm (fixed 12.0); GHSA-4vx8-xhc9-qg6x (fixed 12.0); GHSA-9x85-gx46-6522 (fixed 12.0); … 2 more
ADVISORY    app  louislam/uptime-kuma                           2.5.5                  GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); release:louislam/uptime-kuma@2.5.6 (fixed 2.5.6)
ADVISORY    app  lscr.io/linuxserver/bookstack                  26.09.1                release:BookStackApp/BookStack@v26.09.2 (fixed v26.09.2)
ADVISORY    app  lscr.io/linuxserver/code-server                4.129.0                release:coder/code-server@v4.141.1 (fixed v4.141.1)
ADVISORY    app  lukevella/rallly                               4.15.3                 GHSA-gmq4-f8j5-8w8q (fixed 4.15.4); release:lukevella/rallly@v4.16.2 (fixed v4.16.2); release:lukevella/rallly@v4.16.0 (fixed v4.16.0); release:lukevella/rallly@v4.15.5 (fixed v4.15.5); … 1 more
ADVISORY    app  outlinewiki/outline                            1.10.1                 release:outline/outline@v1.12.0 (fixed v1.12.0)
ADVISORY    app  privatebin/pdo                                 2.0.6                  release:PrivateBin/PrivateBin@2.1.0 (fixed 2.1.0)
ADVISORY    app  rommapp/romm                                   5.3.1                  release:rommapp/romm@5.4.1 (fixed 5.4.1); release:rommapp/romm@5.4.0 (fixed 5.4.0)
ADVISORY    app  vikunja/vikunja                                2.6.0                  release:go-vikunja/vikunja@v2.7.1 (fixed v2.7.1); release:go-vikunja/vikunja@v2.7.0 (fixed v2.7.0)
BEHIND      app  actualbudget/actual-server                     26.9.0                 newest 26.10.0
BEHIND      app  getmeili/meilisearch                           v1.41.0                newest v1.56.0
BEHIND      app  getmeili/meilisearch                           v1.36.0                newest v1.56.0
BEHIND      app  ghcr.io/alexta69/metube                        2026.09.29             newest 2026.10.25
BEHIND      app  ghcr.io/hargata/lubelogger                     v1.7.3                 newest v1.7.4
BEHIND      app  ghcr.io/kozea/radicale                         3.8.1                  newest 3.9.0
BEHIND      app  ghcr.io/lukegus/termix                         2.8.0                  newest 2.9.2
BEHIND      app  ghcr.io/mealie-recipes/mealie                  v3.28.0                newest v3.29.0
BEHIND      app  ghcr.io/papra-hq/papra                         26.6.2-rootless        newest 26.7.1-rootless
BEHIND      app  ghost                                          6.67.0-alpine          newest 6.72.0-alpine
BEHIND      app  glanceapp/glance                               v0.8.5                 newest v0.8.7
BEHIND      app  gotson/komga                                   1.28.0                 newest 1.29.1
BEHIND      app  kimai/kimai2                                   2.67.0                 newest 2.71.0
BEHIND      app  n8nio/n8n                                      2.42.1                 newest 2.45.4
BEHIND      app  nextcloud                                      34.0.4-apache          newest 34.0.5-apache
BEHIND      app  nginx                                          1.30.5-alpine          newest 1.31.8-alpine
BEHIND      app  qbittorrentofficial/qbittorrent-nox            5.2.4-1                newest 5.3.0-2
GAP         buil alpine                                         3.24.2                 newest 3.24.3
GAP         buil alpine                                         3.24.2                 newest 3.24.3
GAP         buil debian                                         13.7-slim              
GAP         buil debian                                         13.7-slim              
GAP         app  emby/embyserver                                4.11.0.4               newest 4.11.0.10
GAP         app  ghcr.io/immich-app/postgres                    16-vectorchord0.4.3-pg 
GAP         app  ghcr.io/karakeep-app/karakeep-chrome           151.0.7922.47-r1       
GAP         app  mariadb                                        12.3                   
GAP         app  mariadb                                        11.4                   newest 11.8
GAP         app  mariadb                                        11.8                   
GAP         app  mariadb                                        12.3                   
GAP         app  mariadb                                        11.8                   
GAP         app  msdeluise/plant-it                             0.10.0                 
GAP         app  plexinc/pms-docker                             1.43.5.11029-6bf8af3f0 
GAP         app  postgis/postgis                                16-3.5-alpine          
GAP         app  postgis/postgis                                17-3.5-alpine          
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       17-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       18-alpine              
GAP         app  postgres                                       17-alpine              
GAP         app  postgres                                       16-alpine              
GAP         app  registry.gitlab.com/crafty-controller/crafty-4 4.11.0                 
FLOATING    app  ghcr.io/claperco/claper                        2.5                    
FLOATING    app  ghcr.io/thomiceli/opengist                     1.15                   
FLOATING    app  lscr.io/linuxserver/prowlarr                   version-2.6.5.5623     
FLOATING    app  lscr.io/linuxserver/sabnzbd                    version-5.1.3          
FLOATING    app  lscr.io/linuxserver/transmission               version-4.1.3-r0       
FLOATING    app  nzbgetcom/nzbget                               v26.3                  
FLOATING    app  redis                                          7.4-alpine             
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  redis                                          7-alpine               
FLOATING    app  wger/server                                    2.7                    
SELF        box  gitea.dooplex.hu/admin/felhom-samba            1.2.0                  
SELF        app  gitea.dooplex.hu/admin/recipe-importer         v0.9.11                
CURRENT     buil golang                                         1.27.3-trixie          
CURRENT     buil golang                                         1.27.3-alpine3.24      
CURRENT     buil restic                                         0.19.1                 
CURRENT     app  calcom/cal.com                                 v6.2.0                 
CURRENT     app  crocodilestick/calibre-web-automated           v4.0.8                 
CURRENT     app  deluan/navidrome                               0.64.2                 
CURRENT     app  ghcr.io/diced/zipline                          4.8.0                  
CURRENT     app  ghcr.io/gethomepage/homepage                   v1.13.2                
CURRENT     app  ghcr.io/gramps-project/grampsweb               v25.6.0                
CURRENT     app  ghcr.io/grimmory-tools/grimmory                v3.5.0                 
CURRENT     app  ghcr.io/paperless-ngx/paperless-ngx            2.20.15                
CURRENT     app  ghcr.io/seanmorley15/adventurelog-backend      v0.13.0                
CURRENT     app  ghcr.io/seanmorley15/adventurelog-frontend     v0.13.0                
CURRENT     app  gitea/gitea                                    1.27.3                 
CURRENT     app  lscr.io/linuxserver/grocy                      4.7.1                  
CURRENT     app  lscr.io/linuxserver/radarr                     6.4.4                  
CURRENT     app  lscr.io/linuxserver/sonarr                     4.0.20                 
CURRENT     app  onlyoffice/documentserver                      9.4.0                  
CURRENT     app  vaultwarden/server                             1.37.4-alpine          
COUNTS ADVISORY=30 BEHIND=17 CURRENT=19 FLOATING=14 GAP=26 SELF=2
REQUESTS api.github.com=37 api.osv.dev=1 blog.cloudflare.com=1 ghcr.io=52 github.com=63 hub.docker.com=144 raw.githubusercontent.com=1
WOULD HAVE MAILED (seed): [Felhom security] cloudflared, filebrowser, traefik, sparkyfitness … — 142 new advisories
The nightly security watch (felhom.eu R-1303) found a notice that affects a version we ship.

Box programs first.

cloudflare/cloudflared — feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3
  What:        8 eMudhra certificates are compromised. Here's what you need to know
  Our version: 2026.10.3  (controller infra; controller/internal/infra/upstream.txt CloudflaredImage)
  Fixed in:    read the notice
  Severity:    not given
  Source:      vendor notice (cloudflare-blog)
  Link:        https://blog.cloudflare.com/emudhra-certificate-compromise/
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

cloudflare/cloudflared — vulnnotes:cloudflared@2026.10.4:VULN-176088
  What:        - 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server
  Our version: 2026.10.3  (controller infra; controller/internal/infra/upstream.txt CloudflaredImage)
  Fixed in:    2026.10.4
  Severity:    not given
  Source:      release notes (cloudflared)
  Link:        https://raw.githubusercontent.com/cloudflare/cloudflared/master/RELEASE_NOTES
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-26fh-r34c-qxh6
  What:        Moving or renaming a folder retargets public shares to the whole folder
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.2-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-26fh-r34c-qxh6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-3846-gh75-gp3m
  What:        Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    1.5.7-stable, 2.0.8-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3846-gh75-gp3m
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-3j46-5w28-f8p2
  What:        Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.1.0-stable, 2.1.3-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3j46-5w28-f8p2
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-4fhx-8pf6-5gmr
  What:        Duplicate finder can show another user’s restricted file names from a shared cache
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.2-stable, 2.1.3-beta
  Severity:    low
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4fhx-8pf6-5gmr
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-4v62-884x-2466
  What:        Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.1.0-stable, 2.1.3-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4v62-884x-2466
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-4vrc-935w-xxq2
  What:        Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonicalization
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.1.0-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4vrc-935w-xxq2
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-4wmj-rq3c-m65v
  What:        Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >= 2.0.1-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4wmj-rq3c-m65v
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-55mw-cwg7-m8f5
  What:        `GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.5-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-55mw-cwg7-m8f5
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-6gr6-5qpq-888p
  What:        Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.10-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-6gr6-5qpq-888p
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-8655-2ph3-q7q7
  What:        Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.2-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8655-2ph3-q7q7
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-8m35-wcjh-95q7
  What:        Logout Bypass via Alternate JWT Spelling
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >= 2.0.1-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8m35-wcjh-95q7
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-9fcr-gm58-p839
  What:        Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.1.0-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9fcr-gm58-p839
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-9wm6-jcjh-3m8c
  What:        Stored XSS via Unsanitized DOCX Hyperlink in DocViewer
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >=2.0.1-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9wm6-jcjh-3m8c
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-c7pj-xjp9-x4xp
  What:        Read-only users can overwrite files through PUT /api/resources
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.0-stable
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c7pj-xjp9-x4xp
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-c84q-q5g6-r47f
  What:        createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.1-stable, 2.1.2-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c84q-q5g6-r47f
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-c9cr-w724-gqj3
  What:        Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.1-stable
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c9cr-w724-gqj3
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-cw65-p35p-633w
  What:        FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >= 2.0.0-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-cw65-p35p-633w
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-g2q5-r6ch-v25f
  What:        FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.1.0-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-g2q5-r6ch-v25f
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-gfgm-886h-6r47
  What:        Custom API token with no global caps inherits owner admin access
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.2-stable, 2.1.4-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-gfgm-886h-6r47
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-mgqf-5mf5-prfj
  What:        Symlink following escapes user scope allowing arbitrary file read outside the served directory
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >= 2.0.1-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-p7x3-p5jj-9xfh
  What:        Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.0-stable, 2.0.10-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p7x3-p5jj-9xfh
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-p93p-v944-4p44
  What:        Unarchive writes into folders denied by access rules and overwrites files without modify permission
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.1.0-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p93p-v944-4p44
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-p9wm-f5jj-75pj
  What:        FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.2-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p9wm-f5jj-75pj
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-qqf3-2wvq-q4w9
  What:        Archive download follows symlinks out of source scope (arbitrary file read)
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.1.0-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqf3-2wvq-q4w9
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-qv53-4557-m65h
  What:        Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >= v2.0.0-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qv53-4557-m65h
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-qx86-4v5r-26g5
  What:        MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    1.5.7-stable, 2.0.10-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qx86-4v5r-26g5
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-r744-4vm3-2px3
  What:        Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and password changes
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.2-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r744-4vm3-2px3
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-rmjp-pfrq-cc3v
  What:        Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.2-stable, 2.1.3-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rmjp-pfrq-cc3v
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-rqqq-wv83-rp74
  What:        Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >= v2.0.1-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rqqq-wv83-rp74
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-vvm6-jwrf-hgmg
  What:         Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.3-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvm6-jwrf-hgmg
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-wfjp-qhvc-69wp
  What:        Share path re-point allows scope escape (arbitrary read/write across the source root)
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >= 2.0.0-beta
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wfjp-qhvc-69wp
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-wjp8-g49g-xrhx
  What:        Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.1.0-stable, 2.1.3-beta
  Severity:    low
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wjp8-g49g-xrhx
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-wxj5-g3qp-g732
  What:        Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/api/resources/view)
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    2.0.2-stable, 2.1.3-beta
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wxj5-g3qp-g732
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — GHSA-x79q-5hqm-x839
  What:        Share authorization gaps let read-only users delete files
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    >= 2.0.0-stable
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-x79q-5hqm-x839
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — release:gtsteffaniak/filebrowser@v1.5.7-stable
  What:        [High] TOTP re-enrollment via  POST /api/auth/otp/generate  and  POST /api/auth/otp/verify  no longer allows anonymous callers to replace an existing second factor using only the account password; res
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    v1.5.7-stable
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.7-stable
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

gtstef/filebrowser — release:gtsteffaniak/filebrowser@v1.5.8-stable
  What:        [High] TOTP re-enrollment via  POST /api/auth/otp/generate  and  POST /api/auth/otp/verify  no longer allows anonymous callers to replace an existing second factor using only the account password; res
  Our version: 1.5.6-stable  (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
  Fixed in:    v1.5.8-stable
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.8-stable
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-28hp-c82p-8vqj
  What:        Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.15
  Severity:    low
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-53qr-784g-cj35
  What:        FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-cw35-4q88-3rmp
  What:        Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-fh26-gfpp-7xxx
  What:        snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-hrpp-p4fc-wwf8
  What:        ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.16
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-mhjw-hmjv-p99x
  What:        Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-mwrr-6hp4-pxr6
  What:        Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-p8wx-ph99-xgcr
  What:        ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.15
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-qm9f-w54v-q2qh
  What:        Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-qvj7-gq9c-hp7q
  What:        Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-rv2h-qh7j-xrjw
  What:        Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — GHSA-ww7c-q3mv-xx22
  What:        Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.15
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — release:traefik/traefik@v3.7.14
  What:        Advisory  GHSA-53qr-784g-cj35
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.14
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/traefik/traefik/releases/tag/v3.7.14
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — release:traefik/traefik@v3.7.15
  What:        Advisory  GHSA-p8wx-ph99-xgcr
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.15
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/traefik/traefik/releases/tag/v3.7.15
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

traefik — release:traefik/traefik@v3.7.16
  What:        Advisory  GHSA-hrpp-p4fc-wwf8
  Our version: v3.7.13  (controller infra; controller/internal/infra/upstream.txt TraefikImage)
  Fixed in:    v3.7.16
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/traefik/traefik/releases/tag/v3.7.16
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

codewithcj/sparkyfitness — GHSA-cmmf-53wf-r5gv
  What:        Unauthenticated direct access to owner-only pregnancy photos through public static mounts
  Our version: v0.17.3  (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness)
  Fixed in:    no fixed version named yet
  Severity:    low
  Source:      GitHub advisory
  Link:        https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-cmmf-53wf-r5gv
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

codewithcj/sparkyfitness — GHSA-p8cf-g8rv-gvrq
  What:        Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state
  Our version: v0.17.3  (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness)
  Fixed in:    no fixed version named yet
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-p8cf-g8rv-gvrq
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

codewithcj/sparkyfitness — GHSA-v883-jx9h-qf29
  What:        Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a known, public session-signing/2FA-encryption key
  Our version: v0.17.3  (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness)
  Fixed in:    no fixed version named yet
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-v883-jx9h-qf29
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

codewithcj/sparkyfitness_server — GHSA-cmmf-53wf-r5gv
  What:        Unauthenticated direct access to owner-only pregnancy photos through public static mounts
  Our version: v0.17.3  (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness_server)
  Fixed in:    no fixed version named yet
  Severity:    low
  Source:      GitHub advisory
  Link:        https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-cmmf-53wf-r5gv
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

codewithcj/sparkyfitness_server — GHSA-p8cf-g8rv-gvrq
  What:        Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state
  Our version: v0.17.3  (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness_server)
  Fixed in:    no fixed version named yet
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-p8cf-g8rv-gvrq
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

codewithcj/sparkyfitness_server — GHSA-v883-jx9h-qf29
  What:        Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a known, public session-signing/2FA-encryption key
  Our version: v0.17.3  (sparkyfitness; templates/sparkyfitness/.felhom.yml upstream: codewithcj/sparkyfitness_server)
  Fixed in:    no fixed version named yet
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-v883-jx9h-qf29
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

docmost/docmost — release:docmost/docmost@v0.97.0
  What:        This release includes security fixes for the latest Node
  Our version: 0.96.0  (docmost; templates/docmost/.felhom.yml upstream: docmost/docmost)
  Fixed in:    v0.97.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/docmost/docmost/releases/tag/v0.97.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-3c22-5j5m-4jq7
  What:        Stored XSS in SVG Hotlinks
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    2.2.3
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-3c22-5j5m-4jq7
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-45vh-rpc8-hxpp
  What:        File Request MaxSize Limit Bypassed in File Request
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    2.2.4
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-45vh-rpc8-hxpp
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-4xg4-54hm-9j77
  What:        Stored XSS vulnerability in friendly name for API keys
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    v2.0.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-4xg4-54hm-9j77
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-95rc-wc32-gm53
  What:        Stored XSS by uploading file with malicious file name
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    v2.0.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-95rc-wc32-gm53
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-c36c-7pc2-f2ph
  What:        Data Leak in Upload Status Stream
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    2.2.3
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-c36c-7pc2-f2ph
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-hcff-qv74-7hr4
  What:        CSRF in Login Endpoint
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    2.2.3
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-hcff-qv74-7hr4
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-j6jp-78w8-34x6
  What:        Privilege Escalation in File Replace
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    2.2.4
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-j6jp-78w8-34x6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-m2hx-wjxc-9fp4
  What:        Privilege escalation with auth token
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    2.2.3
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-m2hx-wjxc-9fp4
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-q658-hfpg-35qc
  What:        Privilege escalation via incomplete API-key permission revocation on user rank demotion
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    2.2.3
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-q658-hfpg-35qc
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

f0rc3/gokapi — GHSA-qwc6-vc2v-2ggj
  What:        DoS in API endpoint
  Our version: v1.9.6  (gokapi; templates/gokapi/.felhom.yml upstream: f0rc3/gokapi)
  Fixed in:    2.2.4
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/Forceu/Gokapi/security/advisories/GHSA-qwc6-vc2v-2ggj
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

fallenbagel/jellyseerr — GHSA-8j73-j6rc-q8xh
  What:        Third-party notification credentials of other users exposed via request detail endpoints
  Our version: 2.7.3  (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
  Fixed in:    3.5.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/seerr-team/seerr/security/advisories/GHSA-8j73-j6rc-q8xh
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

fallenbagel/jellyseerr — GHSA-f7xw-jcqr-57hp
  What:        Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials
  Our version: 2.7.3  (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
  Fixed in:    3.1.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/seerr-team/seerr/security/advisories/GHSA-f7xw-jcqr-57hp
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

fallenbagel/jellyseerr — GHSA-gx3h-3jg5-q65f
  What:        Missing authentication on pushSubscription endpoints
  Our version: 2.7.3  (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
  Fixed in:    3.1.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/seerr-team/seerr/security/advisories/GHSA-gx3h-3jg5-q65f
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

fallenbagel/jellyseerr — GHSA-mc6w-69r3-62h8
  What:        Path traversal to RCE via /avatarproxy image cache filename from upstream ETag
  Our version: 2.7.3  (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
  Fixed in:    3.4.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/seerr-team/seerr/security/advisories/GHSA-mc6w-69r3-62h8
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

fallenbagel/jellyseerr — GHSA-rc4w-7m3r-c2f7
  What:        Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint
  Our version: 2.7.3  (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
  Fixed in:    3.1.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/seerr-team/seerr/security/advisories/GHSA-rc4w-7m3r-c2f7
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

fallenbagel/jellyseerr — GHSA-xc6j-6p6h-p799
  What:        Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo
  Our version: 2.7.3  (seerr; templates/seerr/.felhom.yml upstream: fallenbagel/jellyseerr)
  Fixed in:    3.5.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/seerr-team/seerr/security/advisories/GHSA-xc6j-6p6h-p799
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-332v-mq7g-5hqf
  What:        Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed to another user
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-332v-mq7g-5hqf
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-3xp7-7492-j2q6
  What:        ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.2
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-3xp7-7492-j2q6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-8j93-xvwx-jjg3
  What:        SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-8j93-xvwx-jjg3
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-fprh-3pp9-68m9
  What:        ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (incomplete fix of GHSA-xcwc-jhv2-w4h6)
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.2
  Severity:    critical
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-fprh-3pp9-68m9
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-j9m4-8qwf-jvx6
  What:        SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.2
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-j9m4-8qwf-jvx6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-mr29-2qg5-m4fw
  What:        ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-mr29-2qg5-m4fw
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-vj82-xj83-jp85
  What:        wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any other user's trail
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-vj82-xj83-jp85
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-vprp-gr6m-j375
  What:        ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.2
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-vprp-gr6m-j375
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — GHSA-xcwc-jhv2-w4h6
  What:        ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-xcwc-jhv2-w4h6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — release:open-wanderer/wanderer@v0.21.0
  What:        Inbound ActivityPub deliveries are now authenticated between the  web  and  db  services ( GHSA-mr29-2qg5-m4fw , PR  #1205 )
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/open-wanderer/wanderer/releases/tag/v0.21.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-db — release:open-wanderer/wanderer@v0.21.2
  What:        ( GHSA-fprh-3pp9-68m9 , thanks  @zer0d4y5 )
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-db)
  Fixed in:    v0.21.2
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/open-wanderer/wanderer/releases/tag/v0.21.2
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-332v-mq7g-5hqf
  What:        Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed to another user
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-332v-mq7g-5hqf
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-3xp7-7492-j2q6
  What:        ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.2
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-3xp7-7492-j2q6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-8j93-xvwx-jjg3
  What:        SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-8j93-xvwx-jjg3
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-fprh-3pp9-68m9
  What:        ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (incomplete fix of GHSA-xcwc-jhv2-w4h6)
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.2
  Severity:    critical
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-fprh-3pp9-68m9
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-j9m4-8qwf-jvx6
  What:        SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.2
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-j9m4-8qwf-jvx6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-mr29-2qg5-m4fw
  What:        ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-mr29-2qg5-m4fw
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-vj82-xj83-jp85
  What:        wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any other user's trail
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-vj82-xj83-jp85
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-vprp-gr6m-j375
  What:        ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.2
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-vprp-gr6m-j375
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — GHSA-xcwc-jhv2-w4h6
  What:        ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/open-wanderer/wanderer/security/advisories/GHSA-xcwc-jhv2-w4h6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — release:open-wanderer/wanderer@v0.21.0
  What:        Inbound ActivityPub deliveries are now authenticated between the  web  and  db  services ( GHSA-mr29-2qg5-m4fw , PR  #1205 )
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/open-wanderer/wanderer/releases/tag/v0.21.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

flomp/wanderer-web — release:open-wanderer/wanderer@v0.21.2
  What:        ( GHSA-fprh-3pp9-68m9 , thanks  @zer0d4y5 )
  Our version: v0.20.0  (wanderer; templates/wanderer/.felhom.yml upstream: flomp/wanderer-web)
  Fixed in:    v0.21.2
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/open-wanderer/wanderer/releases/tag/v0.21.2
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

freikin/dawarich — release:Freika/dawarich@1.17.0
  What:        js 20 package, which no longer receives upstream security fixes
  Our version: 1.15.3  (dawarich; templates/dawarich/.felhom.yml upstream: freikin/dawarich)
  Fixed in:    1.17.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/Freika/dawarich/releases/tag/1.17.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/advplyr/audiobookshelf — release:advplyr/audiobookshelf@v2.37.2
  What:        1 (October 2026 security release)
  Our version: 2.37.1  (audiobookshelf; templates/audiobookshelf/.felhom.yml upstream: ghcr.io/advplyr/audiobookshelf)
  Fixed in:    v2.37.2
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/advplyr/audiobookshelf/releases/tag/v2.37.2
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/alam00000/bentopdf — GHSA-5xjf-rr5x-pcfj
  What:        SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass
  Our version: v2.8.6  (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
  Fixed in:    no fixed version named yet
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/alam00000/bentopdf/security/advisories/GHSA-5xjf-rr5x-pcfj
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/alam00000/bentopdf — GHSA-cx8x-7rrr-r9x8
  What:        Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests
  Our version: v2.8.6  (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
  Fixed in:    no fixed version named yet
  Severity:    low
  Source:      GitHub advisory
  Link:        https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/alam00000/bentopdf — GHSA-wh78-rcw2-hhg9
  What:        SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker
  Our version: v2.8.6  (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
  Fixed in:    v2.8.7
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/alam00000/bentopdf/security/advisories/GHSA-wh78-rcw2-hhg9
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/alam00000/bentopdf — release:alam00000/bentopdf@v2.8.10
  What:        Warning  This release addresses security vulnerabilities ( GHSA-v77x-cvmx-ggp4 ,  GHSA-qch9-77q9-j7p6 ) affecting all versions up to and including  v2
  Our version: v2.8.6  (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
  Fixed in:    v2.8.10
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/alam00000/bentopdf/releases/tag/v2.8.10
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/alam00000/bentopdf — release:alam00000/bentopdf@v2.8.7
  What:        Warning  This release addresses security vulnerabilities ( GHSA-wh78-rcw2-hhg9 ,  GHSA-5xjf-rr5x-pcfj ,  GHSA-cx8x-7rrr-r9x8 ) affecting all versions up to and including  v2
  Our version: v2.8.6  (bentopdf; templates/bentopdf/.felhom.yml upstream: ghcr.io/alam00000/bentopdf)
  Fixed in:    v2.8.7
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/alam00000/bentopdf/releases/tag/v2.8.7
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/cmintey/wishlist — release:cmintey/wishlist@v0.68.0
  What:        Update dependency nodemailer to v10 [SECURITY] by  @renovate [bot] in  #798
  Our version: v0.67.1  (wishlist; templates/wishlist/.felhom.yml upstream: ghcr.io/cmintey/wishlist)
  Fixed in:    v0.68.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/cmintey/wishlist/releases/tag/v0.68.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/cmintey/wishlist — release:cmintey/wishlist@v0.69.0
  What:        org/en/blog/vulnerability/october-2026-security-releases
  Our version: v0.67.1  (wishlist; templates/wishlist/.felhom.yml upstream: ghcr.io/cmintey/wishlist)
  Fixed in:    v0.69.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/cmintey/wishlist/releases/tag/v0.69.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/home-assistant/home-assistant — GHSA-jff5-5j3g-vhqc
  What:        Actions expression injection in `helpers/version/action.yml`
  Our version: 2026.9.4  (home-assistant; templates/home-assistant/.felhom.yml upstream: ghcr.io/home-assistant/home-assistant)
  Fixed in:    the range is unreadable — check by hand
  Severity:    low
  Source:      GitHub advisory — the range could not be read; check by hand
  Link:        https://github.com/home-assistant/core/security/advisories/GHSA-jff5-5j3g-vhqc
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/immich-app/immich-machine-learning — GHSA-8244-8vpr-vp9c
  What:        One-click account takeover via XSS in login page continue redirect
  Our version: v3.2.4  (immich; templates/immich/.felhom.yml upstream: ghcr.io/immich-app/immich-machine-learning)
  Fixed in:    the range is unreadable — check by hand
  Severity:    critical
  Source:      GitHub advisory — the range could not be read; check by hand
  Link:        https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/immich-app/immich-machine-learning — release:immich-app/immich@v3.3.5
  What:        com/ ) as well as some  nodejs security patches
  Our version: v3.2.4  (immich; templates/immich/.felhom.yml upstream: ghcr.io/immich-app/immich-machine-learning)
  Fixed in:    v3.3.5
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/immich-app/immich/releases/tag/v3.3.5
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/immich-app/immich-server — GHSA-8244-8vpr-vp9c
  What:        One-click account takeover via XSS in login page continue redirect
  Our version: v3.2.4  (immich; templates/immich/.felhom.yml upstream: ghcr.io/immich-app/immich-server)
  Fixed in:    the range is unreadable — check by hand
  Severity:    critical
  Source:      GitHub advisory — the range could not be read; check by hand
  Link:        https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/immich-app/immich-server — release:immich-app/immich@v3.3.5
  What:        com/ ) as well as some  nodejs security patches
  Our version: v3.2.4  (immich; templates/immich/.felhom.yml upstream: ghcr.io/immich-app/immich-server)
  Fixed in:    v3.3.5
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/immich-app/immich/releases/tag/v3.3.5
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/karakeep-app/karakeep — GHSA-pp34-2c9r-mchw
  What:        karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV
  Our version: 0.33.2  (karakeep; templates/karakeep/.felhom.yml upstream: ghcr.io/karakeep-app/karakeep)
  Fixed in:    no fixed version named yet
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/karakeep-app/karakeep/security/advisories/GHSA-pp34-2c9r-mchw
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/karakeep-app/karakeep — release:karakeep-app/karakeep@v0.34.0
  What:        1 for its October security release ( #3196 )
  Our version: 0.33.2  (karakeep; templates/karakeep/.felhom.yml upstream: ghcr.io/karakeep-app/karakeep)
  Fixed in:    v0.34.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/karakeep-app/karakeep/releases/tag/v0.34.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/karakeep-app/karakeep — release:karakeep-app/karakeep@v0.34.1
  What:        This is a security release on top of 0
  Our version: 0.33.2  (karakeep; templates/karakeep/.felhom.yml upstream: ghcr.io/karakeep-app/karakeep)
  Fixed in:    v0.34.1
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/karakeep-app/karakeep/releases/tag/v0.34.1
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/sysadminsmedia/homebox — release:sysadminsmedia/homebox@v0.27.0
  What:        Security Issues Patched
  Our version: 0.26.2  (homebox; templates/homebox/.felhom.yml upstream: ghcr.io/sysadminsmedia/homebox)
  Fixed in:    v0.27.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/sysadminsmedia/homebox — release:sysadminsmedia/homebox@v0.27.1
  What:        Warning  This release is a security release to patch a NodeJS upstream vulnerability
  Our version: 0.26.2  (homebox; templates/homebox/.felhom.yml upstream: ghcr.io/sysadminsmedia/homebox)
  Fixed in:    v0.27.1
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.1
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

ghcr.io/tandoorrecipes/recipes — release:TandoorRecipes/recipes@2.7.0
  What:        fixed  shopping list bulk API endpoint accepted IDs from foreign spaces  GHSA-5p9v-743w-79h3
  Our version: 2.6.15  (tandoor; templates/tandoor/.felhom.yml upstream: ghcr.io/tandoorrecipes/recipes)
  Fixed in:    2.7.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

grafana/grafana — release:grafana/grafana@v13.2.4
  What:        Security: Fix  CVE-2026-15577
  Our version: 13.2.3  (grafana; templates/grafana/.felhom.yml upstream: grafana/grafana)
  Fixed in:    v13.2.4
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/grafana/grafana/releases/tag/v13.2.4
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

jellyfin/jellyfin — GHSA-4vx8-xhc9-qg6x
  What:         Broken access control in session remote-control API
  Our version: 10.11.11  (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
  Fixed in:    12.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/jellyfin/jellyfin/security/advisories/GHSA-4vx8-xhc9-qg6x
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

jellyfin/jellyfin — GHSA-6828-c7cx-hvqm
  What:         Path traversal in the virtual-folder management endpoints allows deletion and relocation of arbitrary directories
  Our version: 10.11.11  (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
  Fixed in:    12.0
  Severity:    critical
  Source:      GitHub advisory
  Link:        https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

jellyfin/jellyfin — GHSA-9x85-gx46-6522
  What:        Potential IDOR in playlist management
  Our version: 10.11.11  (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
  Fixed in:    12.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9x85-gx46-6522
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

jellyfin/jellyfin — GHSA-c39p-cgf8-866g
  What:        Potential path transversal exposure in PluginsController.cs
  Our version: 10.11.11  (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
  Fixed in:    12.0
  Severity:    low
  Source:      GitHub advisory
  Link:        https://github.com/jellyfin/jellyfin/security/advisories/GHSA-c39p-cgf8-866g
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

jellyfin/jellyfin — GHSA-cf3c-8m59-2vhx
  What:        Memory exhaustion and SSRF via external references in user-supplied SVG images
  Our version: 10.11.11  (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
  Fixed in:    12.0
  Severity:    high
  Source:      GitHub advisory
  Link:        https://github.com/jellyfin/jellyfin/security/advisories/GHSA-cf3c-8m59-2vhx
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

jellyfin/jellyfin — GHSA-hw73-62vp-9gxf
  What:        Potential path transversal exposure in HlsSegmentController.cs
  Our version: 10.11.11  (jellyfin; templates/jellyfin/.felhom.yml upstream: jellyfin/jellyfin)
  Fixed in:    12.0
  Severity:    medium
  Source:      GitHub advisory
  Link:        https://github.com/jellyfin/jellyfin/security/advisories/GHSA-hw73-62vp-9gxf
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

louislam/uptime-kuma — GHSA-qjxc-h5jf-c7rj
  What:        GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accounts in uptime kuma
  Our version: 2.5.5  (uptime-kuma; templates/uptime-kuma/.felhom.yml upstream: louislam/uptime-kuma)
  Fixed in:    the range is unreadable — check by hand
  Severity:    medium
  Source:      GitHub advisory — the range could not be read; check by hand
  Link:        https://github.com/louislam/uptime-kuma/security/advisories/GHSA-qjxc-h5jf-c7rj
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

louislam/uptime-kuma — release:louislam/uptime-kuma@2.5.6
  What:        ⬆️ Security Fixes
  Our version: 2.5.5  (uptime-kuma; templates/uptime-kuma/.felhom.yml upstream: louislam/uptime-kuma)
  Fixed in:    2.5.6
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/louislam/uptime-kuma/releases/tag/2.5.6
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

louislam/uptime-kuma — release:louislam/uptime-kuma@2.5.7
  What:        ⬆️ Security Fixes
  Our version: 2.5.5  (uptime-kuma; templates/uptime-kuma/.felhom.yml upstream: louislam/uptime-kuma)
  Fixed in:    2.5.7
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/louislam/uptime-kuma/releases/tag/2.5.7
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

louislam/uptime-kuma — release:louislam/uptime-kuma@2.5.8
  What:        ⬆️ Security Fixes
  Our version: 2.5.5  (uptime-kuma; templates/uptime-kuma/.felhom.yml upstream: louislam/uptime-kuma)
  Fixed in:    2.5.8
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/louislam/uptime-kuma/releases/tag/2.5.8
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

lscr.io/linuxserver/bookstack — release:BookStackApp/BookStack@v26.09.2
  What:        Security Release
  Our version: 26.09.1  (bookstack; templates/bookstack/.felhom.yml upstream: lscr.io/linuxserver/bookstack)
  Fixed in:    v26.09.2
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/BookStackApp/BookStack/releases/tag/v26.09.2
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

lscr.io/linuxserver/code-server — release:coder/code-server@v4.141.1
  What:        Brotli decoder ( CVE-2026-111497 )
  Our version: 4.129.0  (code-server; templates/code-server/.felhom.yml upstream: lscr.io/linuxserver/code-server)
  Fixed in:    v4.141.1
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/coder/code-server/releases/tag/v4.141.1
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

lukevella/rallly — GHSA-gmq4-f8j5-8w8q
  What:        Remote code execution in poll preview images via vulnerable Next.js next/og
  Our version: 4.15.3  (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
  Fixed in:    4.15.4
  Severity:    critical
  Source:      GitHub advisory
  Link:        https://github.com/lukevella/rallly/security/advisories/GHSA-gmq4-f8j5-8w8q
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

lukevella/rallly — release:lukevella/rallly@v4.15.4
  What:        🔒 Critical security fix: remote code execution in poll preview images
  Our version: 4.15.3  (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
  Fixed in:    v4.15.4
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/lukevella/rallly/releases/tag/v4.15.4
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

lukevella/rallly — release:lukevella/rallly@v4.15.5
  What:        🔒 Security fix: denial of service through Server Actions
  Our version: 4.15.3  (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
  Fixed in:    v4.15.5
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/lukevella/rallly/releases/tag/v4.15.5
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

lukevella/rallly — release:lukevella/rallly@v4.16.0
  What:        The Control Panel tells you when an update is available and whether it fixes a security issue
  Our version: 4.15.3  (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
  Fixed in:    v4.16.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/lukevella/rallly/releases/tag/v4.16.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

lukevella/rallly — release:lukevella/rallly@v4.16.2
  What:        js security update
  Our version: 4.15.3  (rallly; templates/rallly/.felhom.yml upstream: lukevella/rallly)
  Fixed in:    v4.16.2
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/lukevella/rallly/releases/tag/v4.16.2
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

outlinewiki/outline — release:outline/outline@v1.12.0
  What:        1 which fixes multiple recently disclosed  vulnerabilities
  Our version: 1.10.1  (outline; templates/outline/.felhom.yml upstream: outlinewiki/outline)
  Fixed in:    v1.12.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/outline/outline/releases/tag/v1.12.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

privatebin/pdo — release:PrivateBin/PrivateBin@2.1.0
  What:        More details on this issue can be found in the security advisory:
  Our version: 2.0.6  (privatebin; templates/privatebin/.felhom.yml upstream: privatebin/pdo)
  Fixed in:    2.1.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/PrivateBin/PrivateBin/releases/tag/2.1.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

rommapp/romm — release:rommapp/romm@5.4.0
  What:        0 [security] by  @renovate [bot] in  #4966
  Our version: 5.3.1  (romm; templates/romm/.felhom.yml upstream: rommapp/romm)
  Fixed in:    5.4.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/rommapp/romm/releases/tag/5.4.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

rommapp/romm — release:rommapp/romm@5.4.1
  What:        While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible
  Our version: 5.3.1  (romm; templates/romm/.felhom.yml upstream: rommapp/romm)
  Fixed in:    5.4.1
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/rommapp/romm/releases/tag/5.4.1
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

vikunja/vikunja — release:go-vikunja/vikunja@v2.7.0
  What:        🔒 Six security fixes
  Our version: 2.6.0  (vikunja; templates/vikunja/.felhom.yml upstream: vikunja/vikunja)
  Fixed in:    v2.7.0
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/go-vikunja/vikunja/releases/tag/v2.7.0
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

vikunja/vikunja — release:go-vikunja/vikunja@v2.7.1
  What:        🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes
  Our version: 2.6.0  (vikunja; templates/vikunja/.felhom.yml upstream: vikunja/vikunja)
  Fixed in:    v2.7.1
  Severity:    not given
  Source:      release notes
  Link:        https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1
  Next:        the security-fix lane (B23) — capability map B23; for a box program, a controller release

A notice is mailed once, and again every 7 days while it stays open. Night of 2026-10-26.
STATE written: documentation/security-watch/state.json (142 known advisories)
::group::Run set -u
set -u
f=documentation/security-watch/state.json
if [ ! -f "$f" ]; then
  echo "no memory file was written - nothing to commit"; exit 0
fi
if git ls-files --error-unmatch "$f" >/dev/null 2>&1 && git diff --quiet -- "$f"; then
  echo "memory unchanged - nothing to commit"; exit 0
fi
cp "$f" /tmp/state.json
auth=$(python3 -c 'import base64,os;print(base64.b64encode(("x:"+os.environ["PUSH_TOKEN"]).encode()).decode())')
for attempt in 1 2 3; do
  git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
  mkdir -p "$(dirname "$f")" && cp /tmp/state.json "$f"
  git add "$f"
  git -c user.name="felhom security watch" -c user.email=monitoring@felhom.eu \
    commit -q -m "security-watch: memory of $(date -u +%F) (R-1303). Docs only." || { echo "nothing to commit"; exit 0; }
  if git -c http.extraHeader="Authorization: Basic $auth" push -q origin HEAD:main; then
    echo "memory pushed: $(git rev-parse --short=12 HEAD)"; exit 0
  fi
  echo "push refused (attempt $attempt) - re-fetching main"
  sleep 5
done
echo "MEMORY NOT SAVED after 3 attempts"; exit 1
shell: bash --noprofile --norc -e -o pipefail {0}
env:
  PUSH_TOKEN: ***
::endgroup::
remote: . Processing 1 references        
remote: Processed 1 references in total        
memory pushed: ed843da7887a
Cleaning up container for job watch
🏁  Job succeeded