coinos-server.git/bun.lockb, branch master

deps: upgrade fastify v4 to v5 line to fix dependabot alerts

2026-08-22T15:43:53Z

Fastify 4.x is EOL with no backported fixes; all six open alerts (critical http-proxy header stripping, static path traversal + auth bypass, fastify body-validation bypass / host spoofing / DoS) are only patched on the v5 line. Bump fastify to 5.12.0 and all @fastify/* plugins to their v5-compatible majors, and migrate the two options v5 deprecated (disableRequestLogging -> logController, maxParamLength -> routerOptions). Co-Authored-By: Claude Fable 5

deps: patch @asoltys/clightning-client to fix cl reconnect

2026-08-16T07:23:28Z

Register patches/@asoltys+clightning-client+0.1.10.patch via patchedDependencies so bun install re-applies it. The library's reconnect() reused an already-dead socket and never recovered after a cl restart (looping connect ENOENT, leaking a socket+timer); the patch rebuilds a fresh socket + readline each reconnection and clears its retry guard before reconnecting. Companion to the app-side dropClient()/listener-recovery fixes. Co-Authored-By: Claude Opus 4.8

deps: refresh bun.lockb with sharp 0.35.3 (S7/S19)

2026-08-08T06:29:27Z

Regenerated via `bun install` inside the app container (the bind-mounted node_modules is root-owned, so host-side bun install hits EEXIST). Pins sharp at the CVE-fixed 0.35.3 in the lockfile so a frozen-lockfile build resolves the fixed tree. Co-Authored-By: Claude Opus 4.8

deps: bump file-type 18->21 and uuid 8->11 (Dependabot)

2026-06-07T15:18:40Z

Clears two Dependabot alerts: - file-type (medium): infinite loop in ASF parser on malformed input — reachable via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4 - uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided — we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1 Both are major bumps but drop-in for our usage: project is already ESM ("type":"module") so file-type's ESM-only requirement is fine, and we use the stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and fileTypeFromBuffer JPEG detection both work; full app compiles + healthy. Installed inside the app container (node_modules is root-owned, volume-mounted). The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window; real exposure is low behind Cloudflare/Caddy with localhost binding. Co-Authored-By: Claude Opus 4.8 (1M context)

pass bytes for app secret

2026-03-14T17:12:37Z

use bytes for nostr tools

2026-03-13T17:13:34Z

fix transitive dependency vulnerabilities

2026-02-24T21:24:59Z

Co-Authored-By: Claude Opus 4.6

fix invoice user

2025-09-21T01:18:41Z

bun lock

2025-09-11T05:38:13Z

update dependencies

2025-09-10T19:11:54Z