1.5 KiB
dawarich — triage (group D)
Pins: freikin/dawarich:1.15.3 (app + sidekiq), postgis/postgis:17-3.5-alpine, redis:7.4-alpine.
release:Freika/dawarich@1.17.0 "Node.js 20 package, which no longer receives upstream security fixes" — NOT-A-FINDING
It is maintenance: the image swaps Debian's EOL Node.js 20 for Node.js 22 LTS. Node there only runs the server-side poster renderer for a logged-in user's own data; no vulnerability is named or fixed. (Hygiene, not a finding.)
Not flagged by the watch, but real hardening in 1.16.0 (affects 1.15.3)
"Clear pending two-factor challenges after successful authentication, preventing a stale challenge from switching
accounts"; "Prevent legacy or restored export URLs from deleting unrelated files"; admin-only test e-mail; protect last
admin from deletion; secrets kept out of logs. All need a login. If the operator wants them: 1.16.0 (Docker Hub tag
1.16.0 exists, not the -phoenix-rc* tags) — changes: "/" redirects to sign-in (our healthcheck uses /api/v1/health,
unaffected), background data backfills. 1.17.0+ is NOT quick-lane: the sidekiq container is removed (compose change:
drop dawarich-sidekiq, SIDEKIQ_EMBEDDED, WEB_CONCURRENCY=0); 1.18.0 asks for a DB backup first, converts Areas into
Places, breaking Visit API change.
Lane: NOT_A_FINDING (optional SECURITY_FIX to 1.16.0 for the hardening; anything newer = BIG_STEP).
Classifier note: the phrase "no longer receives upstream security fixes" describes a removed package — not a fix;
and the watch missed 1.16.0's hardening because no line says "security".