From a44bcd511da7216c4cd3782ac24997cc7a82f186 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 7 Jun 2026 08:18:40 -0700 Subject: deps: bump file-type 18->21 and uuid 8->11 (Dependabot) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears two Dependabot alerts: - file-type (medium): infinite loop in ASF parser on malformed input — reachable via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4 - uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided — we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1 Both are major bumps but drop-in for our usage: project is already ESM ("type":"module") so file-type's ESM-only requirement is fine, and we use the stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and fileTypeFromBuffer JPEG detection both work; full app compiles + healthy. Installed inside the app container (node_modules is root-owned, volume-mounted). The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window; real exposure is low behind Cloudflare/Caddy with localhost binding. Co-Authored-By: Claude Opus 4.8 (1M context) --- bun.lockb | Bin 234172 -> 234580 bytes 1 file changed, 0 insertions(+), 0 deletions(-) (limited to 'bun.lockb') diff --git a/bun.lockb b/bun.lockb index 5fb5f0ad..2cbf66f9 100755 Binary files a/bun.lockb and b/bun.lockb differ -- cgit v1.2.3