[GHSA-3qjf-qh38-x73v] miniflux.app: v1.0.46 contains the fix, set patched version

[zyl71]

Updates

• Affected products

Comments
The second affected product, the pre-/v2 module path miniflux.app, is currently recorded as <= 1.0.46 with no patched version. That marks a patched build as vulnerable and gives users no upgrade path:

• v1.0.46 is the only tagged version of the miniflux.app module path on the Go module proxy (https://proxy.golang.org/miniflux.app/@v/list), and go.mod at that tag declares module miniflux.app.
• The v1.0.46 tag is identical to the 2.0.46 release tag (miniflux/v2@2.0.46...v1.0.46 reports "identical"); it was added so that go install miniflux.app@latest resolves.
• The fix for this issue, commit b46b5dfb2aa3a1f5320a7a3420b9186bb8fc655f ("Use r.RemoteAddr to check /metrics endpoint network access", PR Improve https://github.com/advisories/GHSA-6q8m-42qq-64r7 #1745), shipped in 2.0.43 and is therefore contained in 2.0.46 = v1.0.46 (miniflux/v2@v1.0.46...b46b5df shows the commit as an ancestor of the tag).

Suggested change: miniflux.app affected < 1.0.46, patched 1.0.46 (replace the last_affected: 1.0.46 event with fixed: 1.0.46). Pseudo-versions of miniflux.app that predate the fix remain covered by < 1.0.46; the miniflux.app/v2 entry (<= 2.0.42, patched 2.0.43) is unchanged.