2026-10-20 - 2026-10-23
Overview
3 Releases published by 1 user
Published
v1.5.0
ipx 1.5.0
Published
directory-v1.4.0
ipx-directory 1.4.0
Published
web-v1.3.0
ipx-web 1.3.0
40 Issues closed from 1 user
Closed
#356 Rust: the root modules hold most of the code
Closed
#355 Rust: types written with their full path instead of imported
Closed
#354 Rust: ipx-feed and ipx-directory have public items without doc comments
Closed
#353 Rust: small departures from the style guide (imports, unwrap, for headers, must_use, bool parameters, SAFETY)
Closed
#352 Unread counts still hash every read-state row a person has
Closed
#347 Unread lists and counts read all of a person's items to find the few unread
Closed
#349 Two requests for the same missing artwork fetch it twice
Closed
#345 Artwork kept on disk is read from FUSE, blocking the async threads
Closed
#348 A Signal's counts run the same verdict query twice
Closed
#346 The item list and feed list wait on queries one at a time that could run together
Closed
#344 A page of items reads every enclosure in the database to find its files
Closed
#323 ipx-web strips only the Cf-Access header names, while ipx trusts whatever header trusted_header names from Caddy's address
Closed
#342 One rw snapshot with an enormous subscriber count breaks the directory's listings for everyone
Closed
#343 On the server's key, one user's Signal text shares a Jev call with other users' Signals and may steer their verdicts
Closed
#340 Any signed-in user can make unlimited TypeSafe calls on the server's key through the icon route, even with signals_on_server off
Closed
#324 Disconnecting sign-in requests escape the password-check limit and run unbounded Argon2 work on the blocking pool
Closed
#338 One OPML upload of many same-titled outlines does quadratic work while holding the catalogue lock, and adds tens of thousands of permanent feeds to the shared scan
Closed
#333 Any signed-in user can mark a feed they do not subscribe to private, and promote an OPML-derived feed out of its OPML
Closed
#335 An open /api/events stream keeps sending daemon events to an account after it is removed
Closed
#325 Private feed keys in the URL path reach every signed-in user through /api/events
Closed
#334 Changing a password leaves every existing session and API token valid
Closed
#336 Bodyless POST routes accept cross-origin simple requests carrying ambient credentials
Closed
#337 A subscribed OPML with very many outlines causes quadratic sync work and an unbounded set of child feeds scanned on the shared worker
Closed
#339 One feed listing many distinct http artwork hosts holds the shared scan worker for hours, on every scan
Closed
#329 The directory's refresher fetches LAN and container-network addresses named by an rw peer or by a listed feed's redirect
Closed
#341 Anonymous directory pages each run an unpaged query over the whole catalogue on a shared 10-connection pool
Closed
#327 Feeds listed in a password-protected OPML inherit its username and password and send them to their own, unrelated hosts
Closed
#328 Enclosure downloads send the feed's basic-auth password to whatever host the feed names, unlike feed fetches
Closed
#332 A kept feed from a private OPML loses its private mark when the OPML is removed and is shared to the directory
Closed
#321 Every fresh install seeds an admin account with the public password 'ipodderx', usable through the unauthenticated login endpoint
Closed
#351 cargo deny: RUSTSEC-2026-0385 (ctutils 0.4.2) and RUSTSEC-2026-0382 (rustls-webpki 0.103.15)
Closed
#330 A feed's .torrent URL, or a tracker it names, can make the daemon buffer an unbounded body in memory
Closed
#320 Feed, enclosure, OPML and artwork fetches reach any internal address, and the responses come back to the user
Closed
#322 A deeply nested OPML, uploaded by any signed-in user or served by any feed publisher, can overflow the stack and abort the whole daemon
Closed
#326 Item and enclosure links from feeds are used as href and window.open targets without a scheme check
Closed
#319 Downloaded enclosure served same-origin with an extension-guessed type allows stored XSS
Closed
#331 Torrent enclosures write with overwrite enabled straight into a folder other feeds share, so one publisher can replace another feed's downloaded episodes
Closed
#318 A multi-file torrent's name is recorded unchecked as the enclosure path, so a feed publisher can point Delete, reap and media serving at any path
Closed
#350 Traces of some routes show their time with nothing under it
Closed
#317 WordPress.com sites answer the feed with a browser check, and the feed fails for hours
39 Issues created by 0 users
Opened
#318 A multi-file torrent's name is recorded unchecked as the enclosure path, so a feed publisher can point Delete, reap and media serving at any path
Opened
#319 Downloaded enclosure served same-origin with an extension-guessed type allows stored XSS
Opened
#320 Feed, enclosure, OPML and artwork fetches reach any internal address, and the responses come back to the user
Opened
#321 Every fresh install seeds an admin account with the public password 'ipodderx', usable through the unauthenticated login endpoint
Opened
#322 A deeply nested OPML, uploaded by any signed-in user or served by any feed publisher, can overflow the stack and abort the whole daemon
Opened
#323 ipx-web strips only the Cf-Access header names, while ipx trusts whatever header trusted_header names from Caddy's address
Opened
#324 Disconnecting sign-in requests escape the password-check limit and run unbounded Argon2 work on the blocking pool
Opened
#325 Private feed keys in the URL path reach every signed-in user through /api/events
Opened
#326 Item and enclosure links from feeds are used as href and window.open targets without a scheme check
Opened
#327 Feeds listed in a password-protected OPML inherit its username and password and send them to their own, unrelated hosts
Opened
#328 Enclosure downloads send the feed's basic-auth password to whatever host the feed names, unlike feed fetches
Opened
#329 The directory's refresher fetches LAN and container-network addresses named by an rw peer or by a listed feed's redirect
Opened
#330 A feed's .torrent URL, or a tracker it names, can make the daemon buffer an unbounded body in memory
Opened
#331 Torrent enclosures write with overwrite enabled straight into a folder other feeds share, so one publisher can replace another feed's downloaded episodes
Opened
#332 A kept feed from a private OPML loses its private mark when the OPML is removed and is shared to the directory
Opened
#333 Any signed-in user can mark a feed they do not subscribe to private, and promote an OPML-derived feed out of its OPML
Opened
#334 Changing a password leaves every existing session and API token valid
Opened
#335 An open /api/events stream keeps sending daemon events to an account after it is removed
Opened
#336 Bodyless POST routes accept cross-origin simple requests carrying ambient credentials
Opened
#337 A subscribed OPML with very many outlines causes quadratic sync work and an unbounded set of child feeds scanned on the shared worker
Opened
#338 One OPML upload of many same-titled outlines does quadratic work while holding the catalogue lock, and adds tens of thousands of permanent feeds to the shared scan
Opened
#339 One feed listing many distinct http artwork hosts holds the shared scan worker for hours, on every scan
Opened
#340 Any signed-in user can make unlimited TypeSafe calls on the server's key through the icon route, even with signals_on_server off
Opened
#341 Anonymous directory pages each run an unpaged query over the whole catalogue on a shared 10-connection pool
Opened
#342 One rw snapshot with an enormous subscriber count breaks the directory's listings for everyone
Opened
#343 On the server's key, one user's Signal text shares a Jev call with other users' Signals and may steer their verdicts
Opened
#344 A page of items reads every enclosure in the database to find its files
Opened
#345 Artwork kept on disk is read from FUSE, blocking the async threads
Opened
#346 The item list and feed list wait on queries one at a time that could run together
Opened
#347 Unread lists and counts read all of a person's items to find the few unread
Opened
#348 A Signal's counts run the same verdict query twice
Opened
#349 Two requests for the same missing artwork fetch it twice
Opened
#350 Traces of some routes show their time with nothing under it
Opened
#351 cargo deny: RUSTSEC-2026-0385 (ctutils 0.4.2) and RUSTSEC-2026-0382 (rustls-webpki 0.103.15)
Opened
#352 Unread counts still hash every read-state row a person has
Opened
#353 Rust: small departures from the style guide (imports, unwrap, for headers, must_use, bool parameters, SAFETY)
Opened
#354 Rust: ipx-feed and ipx-directory have public items without doc comments
Opened
#355 Rust: types written with their full path instead of imported
Opened
#356 Rust: the root modules hold most of the code