Paul Nothaft f6b81fabf0 fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (#1374) ...

* fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes

Resolves 12 open code-scanning alerts (#589-600): sharp libheif RCE,
nodemailer address-parser ReDoS + domain-validation bypasses, multer
upload DoS/race conditions, js-yaml parsing DoS, and joi prototype
pollution. All patch/minor bumps within the currently used major
version.

* fix(backend): set multer's fieldArrayIndexLimit to actually close CVE-2026-82333

The advisory is explicit that the 2.3.0 version bump alone doesn't
remediate the array-index DoS — an app must also set
limits.fieldArrayIndexLimit. Set it on every multer instance, sized to
what each route's form actually needs.

---------

Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>

2026-09-11 10:40:17 +02:00

..

__tests__

fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (#1374)

2026-09-11 10:40:17 +02:00

assets/fonts

feat(events): gallery QR code + printable table-card/poster PDFs (#847)

2026-07-19 22:35:44 +02:00

docs

feat(settings): expose the API rate limiter in the Security tab (#1338)

2026-09-07 20:02:40 +02:00

migrations

Merge pull request #1361 from PicPeak/feat/usage-reporting-update-prompt

2026-09-08 19:23:54 +02:00

scripts

fix(scripts): regenerate-thumbnails resolves external sources through ensureThumbnail (#1148) (#1151)

2026-08-23 22:06:11 +02:00

src

fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (#1374)

2026-09-11 10:40:17 +02:00

.dockerignore

chore(backend): ignore runtime storage in git/docker, remove dead getSafeFilename

2026-07-19 00:40:53 +02:00

.env.example

feat(external-media): watch reference folders and import new files automatically (#1345)

2026-09-07 22:29:55 +02:00

.eslintrc.js

chore(backend): teach eslint the rest-sibling omission idiom

2026-09-02 09:43:11 +02:00

audit-backend.json

…

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1039)

2026-08-13 18:50:56 +02:00

Dockerfile.dev

fix(uploads): RAW derivative key collision, watermark skip, dev exiftool (codex review of #833 round 2)

2026-07-17 22:50:24 +02:00

ecosystem.config.js

…

jest.config.js

fix(security): bump sanitize-html to 2.17.7

2026-09-06 23:06:43 +02:00

jest.sanitizeHtml.js

fix(security): bump sanitize-html to 2.17.7

2026-09-06 23:06:43 +02:00

jest.setup.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

knexfile.js

fix(docker): default NODE_ENV=production so non-compose deploys don't fall back to SQLite (#1038) (#1039)

2026-08-13 18:50:56 +02:00

package-lock.json

fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (#1374)

2026-09-11 10:40:17 +02:00

package.json

fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (#1374)

2026-09-11 10:40:17 +02:00

server.js

fix: enforce gallery access and consolidate gallery workflows (#1357)

2026-09-08 15:34:09 +02:00

test-filter.js

…

wait-for-db.sh

feat(deploy): make the all-in-one image installable without a shell (#1124)

2026-08-22 18:37:12 +02:00