mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-14 06:16:20 -06:00
5a352423ac
Ran `npm audit fix` (no --force) in server/. Only transitive dependencies moved, within existing semver ranges — package.json is unchanged, so this is purely a package-lock.json update: ws 8.18.3 -> 8.21.1, qs -> 6.15.3, body-parser -> 1.20.6, engine.io -> 6.6.9, js-yaml -> 4.3.0, plus express/socket.io sub-deps. Vulnerabilities: 13 (6 moderate, 7 high) -> 2 high. Verified: full server suite 556/556 (incl. socket-handler + reconnect-storm tests that exercise ws); boot smoke OK (server starts, /api/version responds, socket.io/engine.io handshake returns 200). Left for a separate, deliberate change (both need breaking major bumps): - nodemailer 6 -> 9 (email send API; several CRLF/SSRF advisories) - sharp 0.33 -> 0.35 (libvips CVEs; thumbnail/image path) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| config | ||
| db | ||
| lib | ||
| middleware | ||
| player | ||
| routes | ||
| scripts | ||
| services | ||
| test | ||
| ws | ||
| .gitignore | ||
| config.js | ||
| package-lock.json | ||
| package.json | ||
| server.js | ||
| version.js | ||