External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): revert archiver v8 and @fastify/static v9 upgrades

Browse Source 
archiver v8 changed its default export, breaking all ZIP-producing
tools (pdf-to-image, split, batch, favicon, bulk-rename, svg-to-raster).
Reverted to v7 -- the lodash vulnerability via archiver is _.template
which is never called directly.

@fastify/static v9 has breaking changes incompatible with the current
static file serving setup. Reverted to v8 -- the path traversal CVEs
in v8 are mitigated by the existing path traversal guards in files.ts.

Updated edge-cases test to expect 400 for >64KB settings payloads
(new security limit).
This commit is contained in:
SnapOtter
2026-05-14 16:59:40 +08:00
parent 4e64ee2779
commit 20ab04c5bd
3 changed files with 91 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/package.json
+2 -2
View File
@@ -15,14 +15,14 @@
"@fastify/cors": "^11.0.0",
"@fastify/multipart": "^9.0.0",
"@fastify/rate-limit": "^10.2.0",
"@fastify/static": "^9.1.0",
"@fastify/static": "^8.1.0",
"@neplex/vectorizer": "^0.0.5",
"@scalar/fastify-api-reference": "^1.49.5",
"@sentry/node": "^10.49.0",
"@snapotter/ai": "workspace:*",
"@snapotter/image-engine": "workspace:*",
"@snapotter/shared": "workspace:*",
"archiver": "^8.0.0",
"archiver": "^7.0.1",
"better-sqlite3": "^11.7.0",
"dotenv": "^16.4.0",
"drizzle-orm": "^0.45.2",