rays 80f12cda70 A feed's credentials go to its own host alone (#327 #328) ...

feed::fetch already sent basic auth only to the feed's own host, but
two paths around it did not:

- download::download attached the feed's username and password to
  every enclosure, on whatever host the feed named: a CDN, or the
  measurement and ad-insertion prefixes podcasts route through (#328).
- subscriptions() and promote_kept() gave every feed an OPML or Patreon
  list derives the list's credentials, and fetch's same-host check then
  compared against the derived feed's own URL, so the list's password
  went to every host the OPML named, on every scan (#327).

config::Feed::auth_for and credentials_for compare hosts once, and
each of the three uses them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-23 14:02:10 +00:00

..

directory

Update rustls-webpki, webpki-roots and ctutils for three advisories (#351)

2026-10-23 13:43:09 +00:00

feed

Fetches refuse internal addresses unless fetch_internal lists them (#320)

2026-10-23 13:27:40 +00:00

ipx

A feed's credentials go to its own host alone (#327 #328)

2026-10-23 14:02:10 +00:00