upgrade dependencies

- Fastify 4→5 with all plugins
- @noble/hashes 1→2, @scure/base 1→2, @scure/bip32 1→2
- redis 4→5, pino 8→10, got 13→14, uuid 8→13, ws 7→8
- nostr-tools 2.16→2.23 (fix getPublicKey to pass Uint8Array)
- Remove unused deps: date-fns, buffer-crc32, readable-stream-clone
- Fix @noble/hashes import paths for v2 (.js extensions)
- Fix Fastify maxParamLength deprecation (use routerOptions)
- Convert sharp require() to ES import

Co-Authored-By: Claude Opus 4.6 <[email protected]>

2 files changed, 4 insertions, 3 deletions

diff --git a/routes/square.ts b/routes/square.ts
index 0359c82f..f738e1ef 100644
--- a/routes/square.ts
+++ b/routes/square.ts
@@ -3,8 +3,8 @@ import config from "$config";
 import { db, g, s } from "$lib/db";
 import { generate } from "$lib/invoices";
 import { SATS, bail, getUser } from "$lib/utils";
-import { sha256 } from "@noble/hashes/sha256";
-import { utf8ToBytes } from "@noble/hashes/utils";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { utf8ToBytes } from "@noble/hashes/utils.js";
 import { base64urlnopad as base64 } from "@scure/base";
 import { SquareClient } from "square";
 import { v4 } from "uuid";
diff --git a/routes/users.ts b/routes/users.ts
index f30d77ea..32ecebc4 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -17,6 +17,7 @@ import { $ } from "bun";
 import got from "got";
 import jwt from "jsonwebtoken";
 import { getPublicKey, nip19, verifyEvent } from "nostr-tools";
+import { hexToBytes } from "@noble/hashes/utils.js";
 import { authenticator } from "otplib";
 import { v4 } from "uuid";
 
@@ -1075,7 +1076,7 @@ export default {
       let app = await g(pubkey);
 
       if (app && uid !== app.uid) fail("Unauthorized");
-      if (secret) pubkey = getPublicKey(secret);
+      if (secret) pubkey = getPublicKey(hexToBytes(secret));
       notify = String(notify) === "true";
 
       app = {