From a44bcd511da7216c4cd3782ac24997cc7a82f186 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 7 Jun 2026 08:18:40 -0700 Subject: deps: bump file-type 18->21 and uuid 8->11 (Dependabot) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears two Dependabot alerts: - file-type (medium): infinite loop in ASF parser on malformed input — reachable via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4 - uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided — we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1 Both are major bumps but drop-in for our usage: project is already ESM ("type":"module") so file-type's ESM-only requirement is fine, and we use the stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and fileTypeFromBuffer JPEG detection both work; full app compiles + healthy. Installed inside the app container (node_modules is root-owned, volume-mounted). The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window; real exposure is low behind Cloudflare/Caddy with localhost binding. Co-Authored-By: Claude Opus 4.8 (1M context) --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'package.json') diff --git a/package.json b/package.json index e9f46d0d..1cf2b00a 100644 --- a/package.json +++ b/package.json @@ -27,7 +27,7 @@ "clightning-client": "github:asoltys/lightning-client-js#master", "date-fns": "^2.30.0", "fastify": "^4.29.1", - "file-type": "^18.7.0", + "file-type": "^21.3.1", "fluent-ffmpeg": "^2.1.3", "got": "^13.0.0", "handlebars": "^4.7.8", @@ -48,7 +48,7 @@ "sharp": "^0.33.5", "square": "^43.2.1", "strfry-rpc": "^0.0.1", - "uuid": "^8.3.2", + "uuid": "^11.1.1", "web-push": "^3.6.7", "ws": "^7.5.10" }, -- cgit v1.2.3