GHSA-F3FJ-9625-RV3M charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users

Summary Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. SetPrivate cleared the cached record before it saved the new visibility, and not afterwards. A request that arrived between the two read the old, public record from the...

charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users

Summary Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. SetPrivate cleared the cached record before it saved the new visibility, and not afterwards. A request that arrived between the two read the old, public record from the...