Paul Nothaft
7546f104a3
Single PR closing every open code-scanning alert at https://github.com/PicPeak/picpeak/security/code-scanning. Both repos go from 27 open alerts → 0 across direct deps, transitive deps, and build- time bundled deps. ## Backend (`backend/package.json` + overrides) Direct dep bumps: - axios 1.15.2 → 1.16.0 (closes 9 alerts: 7 high + 1 med + 1 low) - nodemailer 8.0.10 → ^9.0.1 (closes 1 high — SSRF + file-read via raw option) - multer 2.1.1 → 2.2.0 (closes 2 alerts: 1 high + 1 med) - form-data 4.0.5 → 4.0.6 (closes 1 high) - tar ≥7.5.13 → ≥7.5.16 (closes 1 med) - postcss 8.5.6 → 8.5.10 (closes 1 med) - i18next-http-backend 3.0.2 → 3.0.5 (closes 1 med — backend lagged frontend) - js-yaml 4.1.1 → ^4.2.0 (closes 1 med) - joi 17.13.3 → ^17.13.4 (closes 1 med) Overrides updated to match deps (npm rejected the install otherwise) + nodemailer ^9.0.1 added as override so imapflow + mailparser transitive bundling of older nodemailer is also fixed. Babel devDep auto-bumped via `npm audit fix` (low-severity arbitrary file read). Backend npm audit: 0 vulnerabilities. ## Frontend (`frontend/package.json`) Direct dep bumps: - axios 1.15.2 → 1.16.0 - postcss 8.5.6 → 8.5.10 - i18next-http-backend 3.0.5 → 3.0.5 (already current — kept for parity) `npm audit fix` swept up 12 transitive issues at the same time: - vitest (1 critical — file read on UI server) - vite (2 high — fs.deny bypass, NTLM hash via launch-editor) - ws (2 high — uninitialized memory + DoS) - dompurify (8 mod — multiple IN_PLACE / hook-pollution XSS vectors) - react-router-dom + react-router (1 mod transitive) - esbuild (1 mod — dev server file read) - @babel/core (1 low) Frontend npm audit: 0 vulnerabilities. ## Frontend Dockerfile - Build stage: `node:20-alpine` → `node:22-alpine` Closes the npm-bundled CVE class (picomatch, ip-address, brace-expansion, @sigstore/core, tar) that came from Node 20's older bundled npm. Matches the backend Dockerfile base. The nginx serving stage stays at `nginx:1.28-alpine` — that tag is rolling, so the next build picks up the fixed 1.28.3-r4 layer that closes the 4 nginx CVEs. ## Verification - Backend: `npm audit` → 0 vulnerabilities ✅ - Frontend: `npm audit` → 0 vulnerabilities ✅ - Backend Jest (workflow engine, rounding, WhatsApp): 47/47 pass ✅ - Frontend Vitest: 84/84 pass ✅ - `frontend npm run build`: succeeds ✅ - nodemailer 9 sanity check: our usage is `createTransport({host,port,secure,auth})` + `sendMail({from,to,subject,html,text})` — we don't touch the `raw` option that 9.x tightened, so the major bump is API-compatible.
93 lines
2.5 KiB
JSON
93 lines
2.5 KiB
JSON
{
|
|
"name": "picpeak-backend",
|
|
"version": "3.74.0-beta.0",
|
|
"description": "Backend for PicPeak event photo sharing platform",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node server.js",
|
|
"dev": "nodemon server.js",
|
|
"migrate": "node migrations/run-migrations.js",
|
|
"migrate:safe": "node migrations/run-migrations-safe.js",
|
|
"generate:watermarks": "node scripts/generate-watermarks.js",
|
|
"test": "jest",
|
|
"test:s3": "SKIP_S3_TESTS=false jest __tests__/integration/backup-s3",
|
|
"lint": "eslint src/"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.850.0",
|
|
"@aws-sdk/lib-storage": "^3.850.0",
|
|
"@aws-sdk/s3-request-presigner": "^3.850.0",
|
|
"archiver": "^5.3.1",
|
|
"axios": "1.16.0",
|
|
"bcrypt": "6.0.0",
|
|
"chokidar": "4.0.3",
|
|
"cookie-parser": "^1.4.7",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^16.0.3",
|
|
"exifr": "^7.1.3",
|
|
"express": "^4.18.2",
|
|
"express-rate-limit": "^6.7.0",
|
|
"express-validator": "^7.0.1",
|
|
"fluent-ffmpeg": "^2.1.3",
|
|
"form-data": "4.0.6",
|
|
"helmet": "^7.0.0",
|
|
"i18next": "25.3.2",
|
|
"i18next-browser-languagedetector": "^8.2.0",
|
|
"i18next-http-backend": "3.0.5",
|
|
"imapflow": "^1.4.0",
|
|
"ipaddr.js": "^2.3.0",
|
|
"joi": "^17.13.4",
|
|
"js-yaml": "^4.2.0",
|
|
"jsonwebtoken": "^9.0.0",
|
|
"knex": "^2.4.2",
|
|
"mailparser": "^3.9.9",
|
|
"mime-types": "^3.0.1",
|
|
"multer": "2.2.0",
|
|
"node-cron": "^3.0.2",
|
|
"node-stream-zip": "^1.15.0",
|
|
"nodemailer": "^9.0.1",
|
|
"pdf-lib": "^1.17.1",
|
|
"pdfkit": "^0.17.2",
|
|
"pg": "^8.16.3",
|
|
"qrcode": "^1.5.4",
|
|
"react-i18next": "^15.6.0",
|
|
"sanitize-html": "^2.17.0",
|
|
"sharp": "0.34.3",
|
|
"sqlite3": "^5.1.6",
|
|
"swagger-jsdoc": "^6.2.8",
|
|
"swagger-ui-express": "^5.0.1",
|
|
"swissqrbill": "^4.3.0",
|
|
"uuid": "^11.1.1",
|
|
"winston": "^3.8.2",
|
|
"zxcvbn": "^4.4.2",
|
|
"postcss": "8.5.10",
|
|
"tar": ">=7.5.16"
|
|
},
|
|
"devDependencies": {
|
|
"eslint": "^8.40.0",
|
|
"jest": "^29.5.0",
|
|
"mock-fs": "^5.5.0",
|
|
"nodemon": "^3.1.10",
|
|
"supertest": "^6.3.3"
|
|
},
|
|
"overrides": {
|
|
"prebuild-install": {
|
|
"tar-fs": "2.1.4"
|
|
},
|
|
"glob": "^11.1.0",
|
|
"js-yaml": "^4.2.0",
|
|
"fast-xml-parser": ">=5.7.0",
|
|
"qs": ">=6.15.2",
|
|
"tar": ">=7.5.16",
|
|
"brace-expansion": ">=5.0.6",
|
|
"minimatch": ">=9.0.7",
|
|
"path-to-regexp": "0.1.13",
|
|
"lodash": ">=4.18.1",
|
|
"follow-redirects": ">=1.16.0",
|
|
"@tootallnate/once": ">=3.0.1",
|
|
"ip-address": ">=10.1.1",
|
|
"uuid": "^11.1.1",
|
|
"nodemailer": "^9.0.1"
|
|
}
|
|
}
|