Paul Nothaft 024ffed1ca fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (stable) (#1375) ...

* fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes

Backport of the same dependency bump on main (#1374). Resolves the
same 12 code-scanning alerts flagged on stable's backend deps: sharp
libheif RCE, nodemailer address-parser ReDoS + domain-validation
bypasses, multer upload DoS/race conditions, js-yaml parsing DoS, and
joi prototype pollution. All patch/minor bumps within the currently
used major version.

* fix(backend): set multer's fieldArrayIndexLimit to actually close CVE-2026-82333

The advisory is explicit that the 2.3.0 version bump alone doesn't
remediate the array-index DoS — an app must also set
limits.fieldArrayIndexLimit. Set it on every multer instance, sized to
what each route's form actually needs.

---------

Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>

2026-09-11 11:21:34 +02:00

..

__tests__

fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (stable) (#1375)

2026-09-11 11:21:34 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

…

migrations

fix(previews): preserve alpha and animation in the preview tier (#1176)

2026-08-26 09:14:42 +02:00

scripts

fix(scripts): regenerate-thumbnails resolves external sources through ensureThumbnail (#1148) (#1155)

2026-08-23 22:06:30 +02:00

src

fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (stable) (#1375)

2026-09-11 11:21:34 +02:00

.dockerignore

…

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1040)

2026-08-13 18:51:20 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

ecosystem.config.js

…

jest.config.js

fix(security): bump sanitize-html to 2.17.7

2026-09-06 23:06:45 +02:00

jest.sanitizeHtml.js

fix(security): bump sanitize-html to 2.17.7

2026-09-06 23:06:45 +02:00

jest.setup.js

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

knexfile.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1040)

2026-08-13 18:51:20 +02:00

package-lock.json

fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (stable) (#1375)

2026-09-11 11:21:34 +02:00

package.json

fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (stable) (#1375)

2026-09-11 11:21:34 +02:00

server.js

fix(security): close three middleware gaps around the API edge

2026-09-03 12:14:02 +02:00

test-filter.js

…

wait-for-db.sh

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1040)

2026-08-13 18:51:20 +02:00