[Bunton33]

Draft for bundle b9. Do not merge until Justin decides the scope and the hardware gates pass (virgin boot, QA_CHECKLIST D13 AP walkthrough, OTA b8 to b9; see apollo/RELEASE_CHECKLIST.md once #5 is merged).

Why now

Upstream published security advisory GHSA-rrjq-j36x-xrpq (medium, 2026-10-15): an out-of-bounds read on an empty playlist transition array, affecting WLED <= 16.0.1. Bundle b8 ships the vulnerable line unchanged (wled00/playlist.cpp). The M-1 setup hotspot is open by design, so an unconfigured unit is reachable by anyone in WiFi range, and a configured one by anyone on its LAN. Impact is limited (one out-of-bounds read, no write).

There is no upstream v16.0.2 tag yet, so this takes the fixes from upstream's 16.x release line as a recorded exception to "merge release tags only": each commit is a git cherry-pick -x of the upstream commit, so the origin is named in the message.

Commits (all from upstream 16_x, all applied cleanly)

Upstream	Fix	File
38df4cc (wled#5909)	Security: OOB playlist transition read	playlist.cpp
4ee90bd (wled#5866)	Reconnect when the AP SSID changes (condition was inverted)	set.cpp
bd31a83 (wled#5736)	Create a default segment when out of heap	FX_fcn.cpp
c39d929 (wled#5726)	On/off transition flick	FX_fcn.cpp
2d738c8 (wled#5733)	uint8 underflow in the AP client disconnect handler	network.cpp

Each is a separate commit, so any of the last four can be dropped if b9 should be security-only.

Not included: wled#5828 (069a676) does not apply to this tree, and the M-1 already carries its own fixes for both bugs it addresses.

Checked so far

• Builds with the pinned libraries from Release hardening: pinned libraries, build script keeps symbols, M-1 CI build, release checklist #5 (local merge, pio run -e apollo_m1): SUCCESS, flash 1,250,513 bytes (b8: 1,250,461), RAM unchanged.
• Not yet tested on hardware.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: ApolloAutomation/WLED-M1
• Branch: b9/upstream-16x-fixes
• File: .coderabbit.yaml
• Commit: 5cbb475
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5f77473c-dfd3-4bc5-8f99-f2ffb5b74017

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}