1.0 KiB
1.0 KiB
glance — triage (pin glanceapp/glance:v0.8.5)
Template: family_gate: true (only signed-in household members reach it). Seeded glance.yml has NO auth: block (Glance has no login of its own here).
Notices (1 GHSA)
- GHSA-r225-jhr6-68cc (high, >= 0.8.0 <= 0.8.6, fixed 0.8.7): unbounded body read on POST /api/authenticate.
NOT-A-FINDING: the route is registered only
if a.RequiresAuth(internal/glance/glance.go @ v0.8.5 line 453-456); our seeded config enables no auth, so the endpoint does not exist. Even if a household adds auth, the family gate keeps strangers out. Real 0 / 1.
Fix
None required. Optional routine bump: glanceapp/glance:v0.8.7 (Hub tag exists). Same main (0): yes. v0.8.7 note: Reddit widget search
property needs app-auth now (our seed uses no reddit widget). v0.8.6: XFF rate-limit spoof fix (auth only).
Lane: NOT_A_FINDING.
Classifier note: GHSA-r225 applies only when Glance auth is configured; the watch cannot see the household's glance.yml, but for the catalog default it is not reachable.