1.1 KiB
1.1 KiB
mealie — triage (pin ghcr.io/mealie-recipes/mealie:v3.28.0, single image, SQLite)
Template: no gate field; ALLOW_SIGNUP=false; Mealie's own login is the door. No OIDC/LDAP/OpenAI env.
Notices (1 GHSA)
- GHSA-99wf-32rc-2767 (medium, <= 3.28.0, patched 3.29.0): REAL — recipe zip import trusts object ids across GROUPS (take over another group's tools, read another group's recipe). Login: any user. Reachable: only on a box with 2+ groups (default is one group "home"); with one group there is no other group to attack. Real 1 / 1.
Fix
Smallest 3.29.0; TARGET ghcr.io/mealie-recipes/mealie:v3.29.0 (newest stable; ghcr tags v3.28.0, v3.29.0 — v prefix as our pin). Same main (3): yes.
Breaking/migrations (read v3.29.0 full body via GitHub API, 16.9k chars): none found. App-run DB changes (structured recipe times, trigram indexes on Postgres — we use SQLite). New reverse-proxy auth is OFF by default (settings.py@v3.29.0 REVERSE_PROXY_AUTH_ENABLED=False). Docs drop obsolete OIDC_SIGNING_ALGORITHM (we do not set it). New iCal feed is opt-in.
Lane: SECURITY_FIX.
Classifier note: none.