16 lines
1.1 KiB
Markdown
16 lines
1.1 KiB
Markdown
# mealie — triage (pin ghcr.io/mealie-recipes/mealie:v3.28.0, single image, SQLite)
|
|
|
|
Template: no gate field; ALLOW_SIGNUP=false; Mealie's own login is the door. No OIDC/LDAP/OpenAI env.
|
|
|
|
## Notices (1 GHSA)
|
|
- GHSA-99wf-32rc-2767 (medium, <= 3.28.0, patched 3.29.0): REAL — recipe zip import trusts object ids across GROUPS
|
|
(take over another group's tools, read another group's recipe). Login: any user. Reachable: only on a box with 2+ groups
|
|
(default is one group "home"); with one group there is no other group to attack.
|
|
Real 1 / 1.
|
|
|
|
## Fix
|
|
Smallest 3.29.0; TARGET `ghcr.io/mealie-recipes/mealie:v3.29.0` (newest stable; ghcr tags v3.28.0, v3.29.0 — `v` prefix as our pin). Same main (3): yes.
|
|
Breaking/migrations (read v3.29.0 full body via GitHub API, 16.9k chars): none found. App-run DB changes (structured recipe times, trigram indexes on Postgres — we use SQLite). New reverse-proxy auth is OFF by default (settings.py@v3.29.0 REVERSE_PROXY_AUTH_ENABLED=False). Docs drop obsolete OIDC_SIGNING_ALGORITHM (we do not set it). New iCal feed is opt-in.
|
|
Lane: SECURITY_FIX.
|
|
Classifier note: none.
|