| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
| |
Fastify 4.x is EOL with no backported fixes; all six open alerts
(critical http-proxy header stripping, static path traversal + auth
bypass, fastify body-validation bypass / host spoofing / DoS) are only
patched on the v5 line. Bump fastify to 5.12.0 and all @fastify/*
plugins to their v5-compatible majors, and migrate the two options v5
deprecated (disableRequestLogging -> logController, maxParamLength ->
routerOptions).
Co-Authored-By: Claude Fable 5 <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
| |
Register patches/@asoltys+clightning-client+0.1.10.patch via patchedDependencies
so bun install re-applies it. The library's reconnect() reused an already-dead
socket and never recovered after a cl restart (looping connect ENOENT, leaking a
socket+timer); the patch rebuilds a fresh socket + readline each reconnection and
clears its retry guard before reconnecting. Companion to the app-side
dropClient()/listener-recovery fixes.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
| |
|
|
|
|
|
|
|
| |
Regenerated via `bun install` inside the app container (the bind-mounted
node_modules is root-owned, so host-side bun install hits EEXIST). Pins
sharp at the CVE-fixed 0.35.3 in the lockfile so a frozen-lockfile build
resolves the fixed tree.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Clears two Dependabot alerts:
- file-type (medium): infinite loop in ASF parser on malformed input — reachable
via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4
- uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided —
we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1
Both are major bumps but drop-in for our usage: project is already ESM
("type":"module") so file-type's ESM-only requirement is fine, and we use the
stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and
fileTypeFromBuffer JPEG detection both work; full app compiles + healthy.
Installed inside the app container (node_modules is root-owned, volume-mounted).
The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need
a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window;
real exposure is low behind Cloudflare/Caddy with localhost binding.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
| | |
|
| | |
|
| |
|
|
| |
Co-Authored-By: Claude Opus 4.6 <[email protected]>
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
