mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-14 14:23:14 -06:00
955a691bcd
npm audit reports 8 high findings. Four of them reach production; the other four are
dev-only and cannot, because prod installs with --omit=dev. Verified rather than
assumed: puppeteer-core, extract-zip, @puppeteer/browsers and js-yaml are all absent
from prod's node_modules.
Three of the four are transitive, and the fix is a patch or minor inside the range
package.json already declares — no API moves, and package.json is untouched by them:
brace-expansion 2.1.2 -> 2.1.4 (archiver -> glob/minimatch)
ip-address 10.2.0 -> 10.5.0 (express-rate-limit)
socket.io-parser 4.2.6 -> 4.2.7 (socket.io)
socket.io-parser was the one worth checking, because a parser change that altered the
wire format would break every deployed player at once rather than fail a test. It does
not: socket.io stays at 4.8.3, engine.io at 6.6.9, and the parser's protocol constant
is still 5. Nothing a player speaks changes.
The fourth is a real bump — nodemailer 6.10.1 -> 9.0.5, across three majors, closing
eight advisories including SMTP command injection and header injection. Our surface is
about as small as it gets: createTransport({host, port, secure, auth}) and sendMail with
from/to/subject/text/html. Engine requirements are unchanged (>=6.0.0), and the entry
point is the same.
The existing email tests mock nodemailer through require.cache, so they would have
stayed green through any breaking change in the library itself — proven, not guessed:
with sendMail patched to throw, those 15 tests still pass. So this adds a test that
drives the REAL library over a loopback SMTP server and asserts on the conversation,
using messages built by our own buildSmtpMessage rather than hand-written ones. That
test does fail against the broken build.
Left alone: extract-zip under puppeteer-core, now with no fix available. It is a
devDependency used only by smoke-ui.js, which already no-ops when it is missing, and the
advisory is symlink traversal while unpacking a downloaded browser — puppeteer-core with
an explicit executablePath never downloads or extracts one.
Production audit goes from 4 high to 0. 1671/1671 pass.
41 lines
1.1 KiB
JSON
41 lines
1.1 KiB
JSON
{
|
|
"name": "screentinker",
|
|
"version": "1.9.34",
|
|
"description": "ScreenTinker - Digital Signage Management Server",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node --env-file-if-exists=.env server.js",
|
|
"dev": "node --watch --env-file-if-exists=.env server.js",
|
|
"test": "node --test --test-concurrency=2",
|
|
"smoke": "node smoke-ui.js"
|
|
},
|
|
"dependencies": {
|
|
"@azure/msal-node": "^5.2.1",
|
|
"@jsquash/avif": "^1.3.0",
|
|
"@jsquash/webp": "^1.5.0",
|
|
"archiver": "^7.0.1",
|
|
"bcryptjs": "^3.0.3",
|
|
"better-sqlite3": "12.9.0",
|
|
"cors": "^2.8.5",
|
|
"express": "^4.18.2",
|
|
"express-rate-limit": "^8.3.1",
|
|
"helmet": "^8.1.0",
|
|
"jimp": "^1.6.1",
|
|
"jsonwebtoken": "^9.0.3",
|
|
"multer": "^1.4.5-lts.1",
|
|
"nodemailer": "^9.0.5",
|
|
"otplib": "^12.0.1",
|
|
"qrcode": "^1.5.4",
|
|
"socket.io": "^4.7.2",
|
|
"stripe": "^20.4.1",
|
|
"unzipper": "^0.12.3",
|
|
"uuid": "^14.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"js-yaml": "^4.2.0",
|
|
"puppeteer-core": "^24.43.1",
|
|
"sharp": "^0.35.3",
|
|
"socket.io-client": "^4.8.3"
|
|
}
|
|
}
|