diff options
| author | Adam Soltys <[email protected]> | 2026-06-07 08:18:40 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-06-07 08:18:40 -0700 |
| commit | a44bcd511da7216c4cd3782ac24997cc7a82f186 (patch) | |
| tree | ff8cce912ffda1a44850d45204d2eea4024f638c /server.c | |
| parent | 7b71c96b5ed9728c63e8fcbb7b2a8bb7155ec7af (diff) | |
| download | coinos-server-a44bcd511da7216c4cd3782ac24997cc7a82f186.tar.gz coinos-server-a44bcd511da7216c4cd3782ac24997cc7a82f186.zip | |
deps: bump file-type 18->21 and uuid 8->11 (Dependabot)
Clears two Dependabot alerts:
- file-type (medium): infinite loop in ASF parser on malformed input — reachable
via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4
- uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided —
we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1
Both are major bumps but drop-in for our usage: project is already ESM
("type":"module") so file-type's ESM-only requirement is fine, and we use the
stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and
fileTypeFromBuffer JPEG detection both work; full app compiles + healthy.
Installed inside the app container (node_modules is root-owned, volume-mounted).
The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need
a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window;
real exposure is low behind Cloudflare/Caddy with localhost binding.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Diffstat (limited to 'server.c')
0 files changed, 0 insertions, 0 deletions