Promote the 2026-08-30 review security fixes and supplies ordering to main

shopdb/core/api/applications.py

@@ -656,13 +656,17 @@ def upload_application_package(app_id: int):
 
 
 @applications_bp.route('/package/<path:filename>', methods=['GET'])
-@require_permission('applications.view')
+@require_permission('applications.download')
 def serve_application_package(filename):
     """Download an uploaded installer.
 
     Authenticated, unlike the image: this is licensed vendor software, and an
     open URL would publish it to anything that can reach the site. Always sent
     as an attachment so a browser saves it rather than trying to render it.
+
+    Gated on applications.download, not applications.view: a guest may be
+    granted the metadata permission, and "an open URL would publish it" is just
+    as true of a URL any anonymous visitor can reach.
     """
     return send_upload(_apppackage_dir(), filename, as_attachment=True)