deps: bump file-type 18->21 and uuid 8->11 (Dependabot)

2026-06-07T15:18:40Z

Clears two Dependabot alerts: - file-type (medium): infinite loop in ASF parser on malformed input — reachable via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4 - uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided — we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1 Both are major bumps but drop-in for our usage: project is already ESM ("type":"module") so file-type's ESM-only requirement is fine, and we use the stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and fileTypeFromBuffer JPEG detection both work; full app compiles + healthy. Installed inside the app container (node_modules is root-owned, volume-mounted). The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window; real exposure is low behind Cloudflare/Caddy with localhost binding. Co-Authored-By: Claude Opus 4.8 (1M context)

fix transitive dependency vulnerabilities

2026-02-24T21:24:59Z

Co-Authored-By: Claude Opus 4.6

fix invoice user

2025-09-21T01:18:41Z

update dependencies

2025-09-10T19:11:54Z

bump dependency

2025-09-09T15:01:16Z

update dependency

2025-09-08T22:56:44Z

square endpoints

2025-07-17T23:16:56Z

return event parts

2025-01-18T00:54:13Z

use strfry scan

2025-01-14T23:50:49Z

coinos-server.git/package.json, branch regtest-fulcrum