From 582eab0d3e78d3c92b3fbf2d41d1845ca5761387 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 7 Aug 2026 22:59:45 -0700 Subject: upload: require auth on /upload/:type; bump sharp past libvips CVEs (S7) POST /upload/:type fed the raw uploaded image straight into sharp with no auth preValidation (unlike neighboring routes), reaching a native libvips decoder in the container that holds the JWT secret and CLN hot wallet. Require auth, and bump sharp 0.33.5 -> 0.35.3 (out of the vulnerable < 0.35.0 libvips range, GHSA-f88m-g3jw-g9cj et al.). Co-Authored-By: Claude Opus 4.8 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'package.json') diff --git a/package.json b/package.json index 1cf2b00a..2ddf5241 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "ramda": "^0.30.1", "readable-stream-clone": "^0.0.7", "redis": "^4.7.1", - "sharp": "^0.33.5", + "sharp": "^0.35.3", "square": "^43.2.1", "strfry-rpc": "^0.0.1", "uuid": "^11.1.1", -- cgit v1.2.3