aboutsummaryrefslogtreecommitdiffstats
path: root/package.json
Commit message (Collapse)AuthorAgeFilesLines
* deps: upgrade fastify v4 to v5 line to fix dependabot alertsAdam Soltys2026-08-221-9/+9
| | | | | | | | | | | | Fastify 4.x is EOL with no backported fixes; all six open alerts (critical http-proxy header stripping, static path traversal + auth bypass, fastify body-validation bypass / host spoofing / DoS) are only patched on the v5 line. Bump fastify to 5.12.0 and all @fastify/* plugins to their v5-compatible majors, and migrate the two options v5 deprecated (disableRequestLogging -> logController, maxParamLength -> routerOptions). Co-Authored-By: Claude Fable 5 <[email protected]>
* deps: patch @asoltys/clightning-client to fix cl reconnectAdam Soltys2026-08-161-0/+3
| | | | | | | | | | | Register patches/@asoltys+clightning-client+0.1.10.patch via patchedDependencies so bun install re-applies it. The library's reconnect() reused an already-dead socket and never recovered after a cl restart (looping connect ENOENT, leaking a socket+timer); the patch rebuilds a fresh socket + readline each reconnection and clears its retry guard before reconnecting. Companion to the app-side dropClient()/listener-recovery fixes. Co-Authored-By: Claude Opus 4.8 <[email protected]>
* test: regtest regression suite for the security-disclosure fixesAdam Soltys2026-08-071-0/+1
| | | | | | | | | | | 16 tests covering S1 (jwt.verify vs forged tokens), S2 (bcrypt cost 12 + legacy detection), S3 (adminpass fails closed on omitted/empty password), S5 (session cookie flags), S6 (atomic SET NX dedup), S7 (/upload auth), fnd-003/004 (memo truncation), fnd-006 (deleteSelf sub-account guard), and S8/fnd-007 (spend/cash mutex serialization). Black-box HTTP + redis against the live regtest stack; run with `bun run test:regtest`. Co-Authored-By: Claude Opus 4.8 <[email protected]>
* upload: require auth on /upload/:type; bump sharp past libvips CVEs (S7)Adam Soltys2026-08-071-1/+1
| | | | | | | | | | POST /upload/:type fed the raw uploaded image straight into sharp with no auth preValidation (unlike neighboring routes), reaching a native libvips decoder in the container that holds the JWT secret and CLN hot wallet. Require auth, and bump sharp 0.33.5 -> 0.35.3 (out of the vulnerable < 0.35.0 libvips range, GHSA-f88m-g3jw-g9cj et al.). Co-Authored-By: Claude Opus 4.8 <[email protected]>
* deps: bump file-type 18->21 and uuid 8->11 (Dependabot)Adam Soltys2026-06-071-2/+2
| | | | | | | | | | | | | | | | | | | | Clears two Dependabot alerts: - file-type (medium): infinite loop in ASF parser on malformed input — reachable via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4 - uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided — we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1 Both are major bumps but drop-in for our usage: project is already ESM ("type":"module") so file-type's ESM-only requirement is fine, and we use the stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and fileTypeFromBuffer JPEG detection both work; full app compiles + healthy. Installed inside the app container (node_modules is root-owned, volume-mounted). The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window; real exposure is low behind Cloudflare/Caddy with localhost binding. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* fix transitive dependency vulnerabilitiesAdam Soltys2026-02-241-9/+17
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix invoice userAdam Soltys2025-09-201-1/+1
|
* update dependenciesAdam Soltys2025-09-101-27/+27
|
* bump dependencyAdam Soltys2025-09-091-1/+1
|
* update dependencyAdam Soltys2025-09-081-1/+1
|
* square endpointsAdam Soltys2025-07-171-0/+2
|
* return event partsAdam Soltys2025-01-171-0/+1
|
* use strfry scanAdam Soltys2025-01-141-0/+1
|
* xpayAdam Soltys2024-11-271-0/+1
|
* wipAdam Soltys2024-11-211-1/+1
|
* use renepayAdam Soltys2024-11-071-1/+1
|
* subscriptionsAdam Soltys2024-10-191-1/+1
|
* reconcile on-chain balanceAdam Soltys2024-09-231-1/+1
|
* nwcAdam Soltys2024-09-161-1/+1
|
* descriptor importAdam Soltys2024-09-121-1/+1
|
* accountsAdam Soltys2024-09-101-1/+1
|
* bump rpcAdam Soltys2024-09-091-1/+1
|
* rm jimpAdam Soltys2024-09-081-3/+0
|
* package rpcAdam Soltys2024-09-081-0/+1
|
* fix upload endpointAdam Soltys2024-09-061-1/+4
|
* tsAdam Soltys2024-09-031-1/+1
|
* cashu dev branchAdam Soltys2024-09-031-3/+3
|
* more ts housekeepingAdam Soltys2024-08-261-0/+1
|
* typescriptAdam Soltys2024-08-261-1/+3
|
* switch to bunAdam Soltys2024-08-261-4/+3
|
* update fastifyAdam Soltys2024-08-251-1/+1
|
* add nwc field to userAdam Soltys2024-08-251-0/+1
|
* transfer ecashAdam Soltys2024-08-161-0/+1
|
* rate limitingAdam Soltys2024-03-051-0/+1
|
* biomeAdam Soltys2023-12-201-1/+2
|
* node 21Adam Soltys2023-12-201-3/+4
|
* biome formatterAdam Soltys2023-12-011-3/+1
|
* zaps and emailsAdam Soltys2023-11-301-0/+1
|
* mail helperAdam Soltys2023-11-291-0/+1
|
* use lua script for debitAdam Soltys2023-11-131-1/+1
|
* update depsAdam Soltys2023-11-111-7/+6
|
* send missing chunksAdam Soltys2023-09-011-0/+1
|
* ffmpeg encode mp3Adam Soltys2023-08-251-0/+1
|
* mqttAdam Soltys2023-08-091-0/+1
|
* text to speech notificationAdam Soltys2023-07-131-0/+1
|
* enable corsAdam Soltys2023-06-281-0/+1
|
* upgrade websocket libAdam Soltys2023-04-111-1/+1
|
* set maxfee on lightning paymentsAdam Soltys2023-04-061-1/+1
|
* ses mailAdam Soltys2023-03-211-1/+1
|
* update jwt libAdam Soltys2023-03-161-1/+1
|
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-15 04:31:37 +0000