Paul Nothaft
b7d6ca0b65
Closes the open Trivy code-scanning alerts for app-side dependencies. The npm-bundled CVEs in /usr/local/lib/node_modules/npm (picomatch, brace-expansion, ip-address inside the Node image itself) are deferred to a separate Node-base-image PR — they're build-environment-side and need their own compatibility testing. ## Direct dependency bumps | Package | From | To | CVEs cleared | |---|---|---|---| | axios (backend + frontend) | 1.14.0 | 1.15.2 | CVE-2026-42264 (HIGH), CVE-2026-42043 (HIGH), CVE-2026-42035 (HIGH), CVE-2026-42033 (HIGH), CVE-2026-42044, CVE-2026-42042, CVE-2026-42041, CVE-2026-42040, CVE-2026-42039, CVE-2026-42038, CVE-2026-42037, CVE-2026-42036, CVE-2026-42034, CVE-2026-40175, CVE-2025-62718 | | nodemailer (backend) | ^7.0.13 | ^8.0.5 | GHSA-vvjj-xcjg-gr5g, GHSA-c7w3-x93f-qmm8 | | i18next-http-backend (frontend) | ^3.0.2 | ^3.0.5 | CVE-2026-41691 | | uuid (backend) | ^11.1.0 | ^11.1.1 | CVE-2026-41907 | | postcss (frontend, devDep) | ^8.4.21 | ^8.5.10 | CVE-2026-41305 | ## Transitive bumps (npm overrides) For transitives whose direct parents haven't released a version that picks up the patched range, pinned via npm overrides: | Package | Min | CVE | |---|---|---| | follow-redirects (backend + frontend) | >=1.16.0 | GHSA-r4q5-vmmm-2653 | | fast-xml-parser (backend) | >=5.7.0 | CVE-2026-41650 | | @tootallnate/once (backend) | >=3.0.1 | CVE-2026-3449 | | ip-address (backend) | >=10.1.1 | CVE-2026-42338 | ## Why axios is now safe to bump past 1.14.0 PR #268 originally pinned axios to 1.14.0 to avoid a supply-chain attack on a specific compromised version range. The 1.15.x series are post-incident upstream releases — clean. Confirmed with the maintainer before bumping. ## Verified * `npx tsc --noEmit` (frontend) — clean * `npx vite build` (frontend) — clean (~4s, existing bundle-size warning, not new) * Backend module-load smoke test — all critical modules load (`auth`, `adminAuth` middleware, `emailProcessor`, `recaptcha`, `storage`) with the new axios + nodemailer * Lockfile re-verification — every targeted CVE now resolves to the patched version range ## Remaining out of scope * npm-bundled CVEs inside `/usr/local/lib/node_modules/npm/` — picomatch CVE-2026-33671 (HIGH), CVE-2026-33672, brace-expansion CVE-2026-33750, ip-address (npm-internal) CVE-2026-42338. These live in the Node base image and require a Node base image bump with its own compatibility testing — separate PR. Targeting `beta` so the bumps go through the normal release-please flow before promotion to `main`.
84 lines
2.3 KiB
JSON
84 lines
2.3 KiB
JSON
{
|
|
"name": "picpeak-backend",
|
|
"version": "3.42.1-beta.0",
|
|
"description": "Backend for PicPeak event photo sharing platform",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node server.js",
|
|
"dev": "nodemon server.js",
|
|
"migrate": "node migrations/run-migrations.js",
|
|
"migrate:safe": "node migrations/run-migrations-safe.js",
|
|
"generate:watermarks": "node scripts/generate-watermarks.js",
|
|
"test": "jest",
|
|
"test:s3": "SKIP_S3_TESTS=false jest __tests__/integration/backup-s3",
|
|
"lint": "eslint src/"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-s3": "^3.850.0",
|
|
"@aws-sdk/lib-storage": "^3.850.0",
|
|
"@aws-sdk/s3-request-presigner": "^3.850.0",
|
|
"adm-zip": "^0.5.16",
|
|
"archiver": "^5.3.1",
|
|
"axios": "1.15.2",
|
|
"bcrypt": "6.0.0",
|
|
"chokidar": "4.0.3",
|
|
"cookie-parser": "^1.4.7",
|
|
"cors": "^2.8.5",
|
|
"dotenv": "^16.0.3",
|
|
"exifr": "^7.1.3",
|
|
"express": "^4.18.2",
|
|
"express-rate-limit": "^6.7.0",
|
|
"express-validator": "^7.0.1",
|
|
"fluent-ffmpeg": "^2.1.3",
|
|
"form-data": "^4.0.4",
|
|
"handlebars": "^4.7.9",
|
|
"helmet": "^7.0.0",
|
|
"i18next": "25.3.2",
|
|
"i18next-browser-languagedetector": "^8.2.0",
|
|
"i18next-http-backend": "^3.0.2",
|
|
"ipaddr.js": "^2.3.0",
|
|
"joi": "^17.9.1",
|
|
"js-yaml": "^4.1.1",
|
|
"jsonwebtoken": "^9.0.0",
|
|
"knex": "^2.4.2",
|
|
"mime-types": "^3.0.1",
|
|
"multer": "^2.0.2",
|
|
"node-cron": "^3.0.2",
|
|
"nodemailer": "^8.0.5",
|
|
"pg": "^8.16.3",
|
|
"react-i18next": "^15.6.0",
|
|
"sanitize-html": "^2.17.0",
|
|
"sharp": "0.34.3",
|
|
"sqlite3": "^5.1.6",
|
|
"swagger-jsdoc": "^6.2.8",
|
|
"swagger-ui-express": "^5.0.1",
|
|
"uuid": "^11.1.1",
|
|
"winston": "^3.8.2",
|
|
"zxcvbn": "^4.4.2"
|
|
},
|
|
"devDependencies": {
|
|
"eslint": "^8.40.0",
|
|
"jest": "^29.5.0",
|
|
"mock-fs": "^5.5.0",
|
|
"nodemon": "^3.1.10",
|
|
"supertest": "^6.3.3"
|
|
},
|
|
"overrides": {
|
|
"prebuild-install": {
|
|
"tar-fs": "2.1.4"
|
|
},
|
|
"glob": "^11.1.0",
|
|
"js-yaml": "^4.1.1",
|
|
"fast-xml-parser": ">=5.7.0",
|
|
"qs": ">=6.14.2",
|
|
"tar": ">=7.5.13",
|
|
"brace-expansion": ">=5.0.5",
|
|
"minimatch": ">=9.0.7",
|
|
"path-to-regexp": "0.1.13",
|
|
"lodash": ">=4.18.1",
|
|
"follow-redirects": ">=1.16.0",
|
|
"@tootallnate/once": ">=3.0.1",
|
|
"ip-address": ">=10.1.1"
|
|
}
|
|
}
|