coinos-server.git/package.json, branch master

deps: upgrade fastify v4 to v5 line to fix dependabot alerts

2026-08-22T15:43:53Z

Fastify 4.x is EOL with no backported fixes; all six open alerts (critical http-proxy header stripping, static path traversal + auth bypass, fastify body-validation bypass / host spoofing / DoS) are only patched on the v5 line. Bump fastify to 5.12.0 and all @fastify/* plugins to their v5-compatible majors, and migrate the two options v5 deprecated (disableRequestLogging -> logController, maxParamLength -> routerOptions). Co-Authored-By: Claude Fable 5

deps: patch @asoltys/clightning-client to fix cl reconnect

2026-08-16T07:23:28Z

Register patches/@asoltys+clightning-client+0.1.10.patch via patchedDependencies so bun install re-applies it. The library's reconnect() reused an already-dead socket and never recovered after a cl restart (looping connect ENOENT, leaking a socket+timer); the patch rebuilds a fresh socket + readline each reconnection and clears its retry guard before reconnecting. Companion to the app-side dropClient()/listener-recovery fixes. Co-Authored-By: Claude Opus 4.8

test: regtest regression suite for the security-disclosure fixes

2026-08-08T06:29:27Z

16 tests covering S1 (jwt.verify vs forged tokens), S2 (bcrypt cost 12 + legacy detection), S3 (adminpass fails closed on omitted/empty password), S5 (session cookie flags), S6 (atomic SET NX dedup), S7 (/upload auth), fnd-003/004 (memo truncation), fnd-006 (deleteSelf sub-account guard), and S8/fnd-007 (spend/cash mutex serialization). Black-box HTTP + redis against the live regtest stack; run with `bun run test:regtest`. Co-Authored-By: Claude Opus 4.8

upload: require auth on /upload/:type; bump sharp past libvips CVEs (S7)

2026-08-08T06:29:25Z

POST /upload/:type fed the raw uploaded image straight into sharp with no auth preValidation (unlike neighboring routes), reaching a native libvips decoder in the container that holds the JWT secret and CLN hot wallet. Require auth, and bump sharp 0.33.5 -> 0.35.3 (out of the vulnerable < 0.35.0 libvips range, GHSA-f88m-g3jw-g9cj et al.). Co-Authored-By: Claude Opus 4.8

deps: bump file-type 18->21 and uuid 8->11 (Dependabot)

2026-06-07T15:18:40Z

Clears two Dependabot alerts: - file-type (medium): infinite loop in ASF parser on malformed input — reachable via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4 - uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided — we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1 Both are major bumps but drop-in for our usage: project is already ESM ("type":"module") so file-type's ESM-only requirement is fine, and we use the stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and fileTypeFromBuffer JPEG detection both work; full app compiles + healthy. Installed inside the app container (node_modules is root-owned, volume-mounted). The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window; real exposure is low behind Cloudflare/Caddy with localhost binding. Co-Authored-By: Claude Opus 4.8 (1M context)

fix transitive dependency vulnerabilities

2026-02-24T21:24:59Z

Co-Authored-By: Claude Opus 4.6

fix invoice user

2025-09-21T01:18:41Z

update dependencies

2025-09-10T19:11:54Z

bump dependency

2025-09-09T15:01:16Z

update dependency

2025-09-08T22:56:44Z