19 lines
1.5 KiB
Markdown
19 lines
1.5 KiB
Markdown
# dawarich — triage (group D)
|
|
Pins: freikin/dawarich:1.15.3 (app + sidekiq), postgis/postgis:17-3.5-alpine, redis:7.4-alpine.
|
|
|
|
## release:Freika/dawarich@1.17.0 "Node.js 20 package, which no longer receives upstream security fixes" — NOT-A-FINDING
|
|
It is maintenance: the image swaps Debian's EOL Node.js 20 for Node.js 22 LTS. Node there only runs the server-side
|
|
poster renderer for a logged-in user's own data; no vulnerability is named or fixed. (Hygiene, not a finding.)
|
|
|
|
## Not flagged by the watch, but real hardening in 1.16.0 (affects 1.15.3)
|
|
"Clear pending two-factor challenges after successful authentication, preventing a stale challenge from switching
|
|
accounts"; "Prevent legacy or restored export URLs from deleting unrelated files"; admin-only test e-mail; protect last
|
|
admin from deletion; secrets kept out of logs. All need a login. If the operator wants them: 1.16.0 (Docker Hub tag
|
|
`1.16.0` exists, not the `-phoenix-rc*` tags) — changes: "/" redirects to sign-in (our healthcheck uses /api/v1/health,
|
|
unaffected), background data backfills. 1.17.0+ is NOT quick-lane: the sidekiq container is removed (compose change:
|
|
drop dawarich-sidekiq, SIDEKIQ_EMBEDDED, WEB_CONCURRENCY=0); 1.18.0 asks for a DB backup first, converts Areas into
|
|
Places, breaking Visit API change.
|
|
Lane: NOT_A_FINDING (optional SECURITY_FIX to 1.16.0 for the hardening; anything newer = BIG_STEP).
|
|
Classifier note: the phrase "no longer receives upstream security fixes" describes a removed package — not a fix;
|
|
and the watch missed 1.16.0's hardening because no line says "security".
|