The 0.32.0 security wording says what actually happened #421

2026-08-27T21:23:12Z

enricobuehler commented

2026-08-27 21:23:12 +00:00

Two overstatements in the published v0.32.0 notes, both caught on reading the release page. Nothing about the fix changed — only the description of its severity. The live release body (id 902) is already PATCHed to match this branch; this lands the same text in the repo so the announcement carries it.

1. "anyone who could open your web console page" was wrong

That was the lead-in sentence — the one the Discord embed shows — and it reads as an unauthenticated remote hole. It was not one.

Reaching the pairing routes required an already-authenticated console session. The actual defect: those routes rode the generic catch-all with the operator's admin bearer attached, so alone among the trust-root actions they never re-asked for the console password. That is privilege escalation inside the console, not something a stranger on the network could touch.

It still mattered, and the notes now say why in the same breath: pairing is what grants launch, so a console sign-in became the ability to start a process on the host. Scoping it correctly makes the entry more useful, not less — a reader can now tell whether it applies to them (it does if anyone else can sign in to their console).

2. "58 security issues" invites the wrong reading

There were 58 findings. The long tail is minor hardening and build-infrastructure tightening — not 58 exploitable defects. Both documents now lead with that proportion rather than the raw count, and the CHANGELOG says it outright: "Read that number for what it is."

Where it changed

docs/releases/v0.32.0.md — the lead-in, the TL;DR bullet, "Before you update", and the Security section (which now separates what the flaw was and was not from what changed).
CHANGELOG.md — the section intro, breaking-change entry 6, and the security-review heading (Critical: → Most serious:, with the escalation scope stated).

No tag re-point needed

announce.yml runs actions/checkout with no ref, so it checks out whatever the workflow is dispatched on — not the tag — and apply_release_notes re-syncs the body from docs/releases/<tag>.md there. Merging this before dispatching announce is enough for the corrected text to reach both the release page and Discord. The tag stays exactly where it is.

Gates

ISO 24495 auditor: back to its 2 standing findings (NVIDIA, AMD — company names, deliberately unexpanded). The new sentences were trimmed to the ≤30-word / ≤5-sentence limits.
check-docs-links.sh and check-docs-drift.sh — both exit 0.
Live body verified byte-identical to the file after CRLF normalisation, with all 48 release assets still attached (body-only PATCH, never delete-and-recreate).

Two overstatements in the published v0.32.0 notes, both caught on reading the release page. **Nothing about the fix changed — only the description of its severity.** The live release body (id 902) is already PATCHed to match this branch; this lands the same text in the repo so the announcement carries it. ## 1. "anyone who could open your web console page" was wrong That was the lead-in sentence — the one the Discord embed shows — and it reads as an unauthenticated remote hole. It was not one. Reaching the pairing routes required an **already-authenticated console session**. The actual defect: those routes rode the generic catch-all with the operator's admin bearer attached, so alone among the trust-root actions they never re-asked for the console password. That is privilege escalation *inside* the console, not something a stranger on the network could touch. It still mattered, and the notes now say why in the same breath: pairing is what grants launch, so a console sign-in became the ability to start a process on the host. Scoping it correctly makes the entry more useful, not less — a reader can now tell whether it applies to them (it does if anyone else can sign in to their console). ## 2. "58 security issues" invites the wrong reading There were 58 **findings**. The long tail is minor hardening and build-infrastructure tightening — not 58 exploitable defects. Both documents now lead with that proportion rather than the raw count, and the CHANGELOG says it outright: *"Read that number for what it is."* ## Where it changed - `docs/releases/v0.32.0.md` — the lead-in, the TL;DR bullet, "Before you update", and the Security section (which now separates what the flaw *was and was not* from what changed). - `CHANGELOG.md` — the section intro, breaking-change entry 6, and the security-review heading (`Critical:` → `Most serious:`, with the escalation scope stated). ## No tag re-point needed `announce.yml` runs `actions/checkout` with **no ref**, so it checks out whatever the workflow is dispatched on — not the tag — and `apply_release_notes` re-syncs the body from `docs/releases/<tag>.md` there. Merging this before dispatching `announce` is enough for the corrected text to reach both the release page and Discord. The tag stays exactly where it is. ## Gates - ISO 24495 auditor: back to its 2 standing findings (`NVIDIA`, `AMD` — company names, deliberately unexpanded). The new sentences were trimmed to the ≤30-word / ≤5-sentence limits. - `check-docs-links.sh` and `check-docs-drift.sh` — both exit 0. - Live body verified byte-identical to the file after CRLF normalisation, with all **48** release assets still attached (body-only PATCH, never delete-and-recreate).

enricobuehler added 1 commit 2026-08-27 21:23:14 +00:00

docs(release): scope the 0.32.0 security wording to what it actually was

ci / bun-nix (pull_request) Successful in 36s

Details

ci / docs-site (pull_request) Successful in 1m9s

Details

ci / web (pull_request) Successful in 1m44s

Details

ci / rust-arm64 (pull_request) Successful in 2m14s

Details

ci / docs-drift (pull_request) Successful in 2m15s

Details

ci / rust (pull_request) Successful in 8m42s

Details

ababeafce3

Two overstatements in the v0.32.0 notes, both flagged on reading the published
release.

**"anyone who could open your web console page"** was simply wrong, and it is the
sentence the Discord embed leads with. Reaching the pairing routes required an
ALREADY-AUTHENTICATED console session — it was privilege escalation inside the
console (those routes alone among the trust-root actions never re-asked for the
console password), not something an unauthenticated peer on the network could
touch. The notes now say so plainly, and say why it still mattered: pairing is
what grants launch, so a console sign-in became the ability to start a process on
the host.

**"58 security issues"** invites the reading that there were 58 exploitable
defects. There were 58 findings, and the long tail is minor hardening and
build-infrastructure tightening. Both documents now lead with that proportion
instead of the raw count.

Same correction applied to CHANGELOG.md in three places: the section intro, the
`Breaking changes` entry, and the security-review heading.

Nothing about the fix itself changed — only the description of its severity. The
tag does not need re-pointing: `announce.yml` checks out the ref it is dispatched
on rather than the tag, and `apply_release_notes` re-syncs the body from
`docs/releases/<tag>.md` there, so this lands in the announcement. The live
release body is PATCHed to match in the same pass.

Gates: the ISO 24495 auditor is back to its 2 standing findings (NVIDIA and AMD,
company names deliberately left unexpanded); check-docs-links.sh and
check-docs-drift.sh both exit 0.

enricobuehler merged commit 7a6b930867 into main

2026-08-27 21:24:53 +00:00

enricobuehler deleted branch worktree-release-notes-severity

2026-08-27 21:25:00 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unom/punktfunk#421