https://github.com/discourse/discourse/security/advisories/GHSA-jcjx-pvpc-qgwq