From a4c8ded78a792ccf42707c4d5cd61b61d0f2302b Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:00:36 +1000 Subject: [PATCH 1/9] Patch vulnerable HTTP dependencies to protect proxy requests --- package-lock.json | 832 ++++++++++++++++++++++++++++------------------ package.json | 5 + 2 files changed, 518 insertions(+), 319 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5663d66..9c4f15c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -102,11 +102,13 @@ "dev": true }, "node_modules/@types/jsonwebtoken": { - "version": "9.0.6", - "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.6.tgz", - "integrity": "sha512-/5hndP5dCjloafCXns6SZyESp3Ldq7YjH3zwzwczYnjxIT0Fqzk5ROSYVGfFyczIue7IUEj8hkvLbPoLQ18vQw==", + "version": "9.0.10", + "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.10.tgz", + "integrity": "sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==", "dev": true, + "license": "MIT", "dependencies": { + "@types/ms": "*", "@types/node": "*" } }, @@ -116,6 +118,13 @@ "integrity": "sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==", "dev": true }, + "node_modules/@types/ms": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz", + "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==", + "dev": true, + "license": "MIT" + }, "node_modules/@types/node": { "version": "20.12.7", "resolved": "https://registry.npmjs.org/@types/node/-/node-20.12.7.tgz", @@ -181,6 +190,41 @@ "node": ">= 0.6" } }, + "node_modules/agent-base": { + "version": "6.0.2", + "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz", + "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==", + "license": "MIT", + "dependencies": { + "debug": "4" + }, + "engines": { + "node": ">= 6.0.0" + } + }, + "node_modules/agent-base/node_modules/debug": { + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/agent-base/node_modules/ms": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", + "license": "MIT" + }, "node_modules/array-flatten": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz", @@ -189,7 +233,8 @@ "node_modules/asynckit": { "version": "0.4.0", "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", - "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==" + "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==", + "license": "MIT" }, "node_modules/atomic-sleep": { "version": "1.0.0", @@ -200,13 +245,15 @@ } }, "node_modules/axios": { - "version": "1.6.8", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.8.tgz", - "integrity": "sha512-v/ZHtJDU39mDpyBoFVkETcd/uNdxrWRrg3bKpOKzXFA6Bvqopts6ALSMU3y6ijYxbw2B+wPrIv46egTzJXCLGQ==", + "version": "1.20.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz", + "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==", + "license": "MIT", "dependencies": { - "follow-redirects": "^1.15.6", - "form-data": "^4.0.0", - "proxy-from-env": "^1.1.0" + "follow-redirects": "^1.16.0", + "form-data": "^4.0.6", + "https-proxy-agent": "^5.0.1", + "proxy-from-env": "^2.1.0" } }, "node_modules/base64-js": { @@ -229,36 +276,29 @@ ] }, "node_modules/body-parser": { - "version": "1.20.2", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz", - "integrity": "sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6R7ajOPw0g/J1PvK4qNy7s5bA==", + "version": "1.20.8", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.8.tgz", + "integrity": "sha512-JNcyFQ64OiijEkPzUBTCe+hyPXUD/3LEldGQ6iF5LR1w00mx9o7xtDWHXBY2iItjdCFGoilOLNQbH943ut7pHA==", + "license": "MIT", "dependencies": { - "bytes": "3.1.2", + "bytes": "~3.1.2", "content-type": "~1.0.5", "debug": "2.6.9", "depd": "2.0.0", - "destroy": "1.2.0", - "http-errors": "2.0.0", - "iconv-lite": "0.4.24", - "on-finished": "2.4.1", - "qs": "6.11.0", - "raw-body": "2.5.2", + "destroy": "~1.2.0", + "http-errors": "~2.0.1", + "iconv-lite": "~0.4.24", + "on-finished": "~2.4.1", + "qs": "~6.16.0", + "raw-body": "~2.5.3", "type-is": "~1.6.18", - "unpipe": "1.0.0" + "unpipe": "~1.0.0" }, "engines": { "node": ">= 0.8", "npm": "1.2.8000 || >= 1.4.16" } }, - "node_modules/body-parser/node_modules/bytes": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", - "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", - "engines": { - "node": ">= 0.8" - } - }, "node_modules/buffer": { "version": "6.0.3", "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz", @@ -285,26 +325,39 @@ "node_modules/buffer-equal-constant-time": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz", - "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==" + "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==", + "license": "BSD-3-Clause" }, "node_modules/bytes": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.0.0.tgz", - "integrity": "sha512-pMhOfFDPiv9t5jjIXkHosWmkSyQbvsgEVNkz0ERHbuLh2T/7j4Mqqpz523Fe8MVY89KC6Sh/QfS2sM+SjgFDcw==", + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", + "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", + "license": "MIT", "engines": { "node": ">= 0.8" } }, - "node_modules/call-bind": { - "version": "1.0.7", - "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.7.tgz", - "integrity": "sha512-GHTSNSYICQ7scH7sZ+M2rFopRoLh8t2bLSW6BbgrtLsahOIB5iyAVJf9GjWK3cYTDaMj4XdBpM1cA6pIS0Kv2w==", + "node_modules/call-bind-apply-helpers": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", + "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", + "license": "MIT", "dependencies": { - "es-define-property": "^1.0.0", "es-errors": "^1.3.0", - "function-bind": "^1.1.2", - "get-intrinsic": "^1.2.4", - "set-function-length": "^1.2.1" + "function-bind": "^1.1.2" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/call-bound": { + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz", + "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "get-intrinsic": "^1.3.0" }, "engines": { "node": ">= 0.4" @@ -317,6 +370,7 @@ "version": "1.0.8", "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz", "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==", + "license": "MIT", "dependencies": { "delayed-stream": "~1.0.0" }, @@ -336,20 +390,35 @@ } }, "node_modules/compression": { - "version": "1.7.4", - "resolved": "https://registry.npmjs.org/compression/-/compression-1.7.4.tgz", - "integrity": "sha512-jaSIDzP9pZVS4ZfQ+TzvtiWhdpFhE2RDHz8QJkpX9SIpLq88VueF5jJw6t+6CUQcAoA6t+x89MLrWAqpfDE8iQ==", + "version": "1.8.2", + "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.2.tgz", + "integrity": "sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==", + "license": "MIT", "dependencies": { - "accepts": "~1.3.5", - "bytes": "3.0.0", - "compressible": "~2.0.16", + "bytes": "3.1.2", + "compressible": "~2.0.18", "debug": "2.6.9", - "on-headers": "~1.0.2", - "safe-buffer": "5.1.2", + "destroy": "1.2.0", + "negotiator": "~0.6.4", + "on-headers": "~1.1.0", + "safe-buffer": "5.2.1", "vary": "~1.1.2" }, "engines": { "node": ">= 0.8.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, + "node_modules/compression/node_modules/negotiator": { + "version": "0.6.4", + "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz", + "integrity": "sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==", + "license": "MIT", + "engines": { + "node": ">= 0.6" } }, "node_modules/content-disposition": { @@ -363,37 +432,20 @@ "node": ">= 0.6" } }, - "node_modules/content-disposition/node_modules/safe-buffer": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", - "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ] - }, "node_modules/content-type": { "version": "1.0.5", "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz", "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==", + "license": "MIT", "engines": { "node": ">= 0.6" } }, "node_modules/cookie": { - "version": "0.6.0", - "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz", - "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==", + "version": "0.7.2", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz", + "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==", + "license": "MIT", "engines": { "node": ">= 0.6" } @@ -423,26 +475,11 @@ "ms": "2.0.0" } }, - "node_modules/define-data-property": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz", - "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==", - "dependencies": { - "es-define-property": "^1.0.0", - "es-errors": "^1.3.0", - "gopd": "^1.0.1" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, "node_modules/delayed-stream": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz", "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==", + "license": "MIT", "engines": { "node": ">=0.4.0" } @@ -451,6 +488,7 @@ "version": "2.0.0", "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==", + "license": "MIT", "engines": { "node": ">= 0.8" } @@ -475,10 +513,25 @@ "url": "https://dotenvx.com" } }, + "node_modules/dunder-proto": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", + "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", + "license": "MIT", + "dependencies": { + "call-bind-apply-helpers": "^1.0.1", + "es-errors": "^1.3.0", + "gopd": "^1.2.0" + }, + "engines": { + "node": ">= 0.4" + } + }, "node_modules/ecdsa-sig-formatter": { "version": "1.0.11", "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz", "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==", + "license": "Apache-2.0", "dependencies": { "safe-buffer": "^5.0.1" } @@ -486,23 +539,23 @@ "node_modules/ee-first": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", - "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==" + "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==", + "license": "MIT" }, "node_modules/encodeurl": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz", - "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==", + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz", + "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==", + "license": "MIT", "engines": { "node": ">= 0.8" } }, "node_modules/es-define-property": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.0.tgz", - "integrity": "sha512-jxayLKShrEqqzJ0eumQbVhTYQM27CfT1T35+gCgDFoL82JLsXqTJ76zv6A0YLOgEnLUMvLzsDsGIrl8NFpT2gQ==", - "dependencies": { - "get-intrinsic": "^1.2.4" - }, + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", + "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", + "license": "MIT", "engines": { "node": ">= 0.4" } @@ -511,6 +564,34 @@ "version": "1.3.0", "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-object-atoms": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz", + "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0" + }, + "engines": { + "node": ">= 0.4" + } + }, + "node_modules/es-set-tostringtag": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz", + "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.6", + "has-tostringtag": "^1.0.2", + "hasown": "^2.0.2" + }, "engines": { "node": ">= 0.4" } @@ -518,12 +599,14 @@ "node_modules/escape-html": { "version": "1.0.3", "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz", - "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==" + "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==", + "license": "MIT" }, "node_modules/etag": { "version": "1.8.1", "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz", "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==", + "license": "MIT", "engines": { "node": ">= 0.6" } @@ -545,44 +628,49 @@ } }, "node_modules/express": { - "version": "4.19.2", - "resolved": "https://registry.npmjs.org/express/-/express-4.19.2.tgz", - "integrity": "sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==", + "version": "4.22.2", + "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz", + "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==", + "license": "MIT", "dependencies": { "accepts": "~1.3.8", "array-flatten": "1.1.1", - "body-parser": "1.20.2", - "content-disposition": "0.5.4", + "body-parser": "~1.20.5", + "content-disposition": "~0.5.4", "content-type": "~1.0.4", - "cookie": "0.6.0", - "cookie-signature": "1.0.6", + "cookie": "~0.7.1", + "cookie-signature": "~1.0.6", "debug": "2.6.9", "depd": "2.0.0", - "encodeurl": "~1.0.2", + "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "etag": "~1.8.1", - "finalhandler": "1.2.0", - "fresh": "0.5.2", - "http-errors": "2.0.0", - "merge-descriptors": "1.0.1", + "finalhandler": "~1.3.1", + "fresh": "~0.5.2", + "http-errors": "~2.0.0", + "merge-descriptors": "1.0.3", "methods": "~1.1.2", - "on-finished": "2.4.1", + "on-finished": "~2.4.1", "parseurl": "~1.3.3", - "path-to-regexp": "0.1.7", + "path-to-regexp": "~0.1.12", "proxy-addr": "~2.0.7", - "qs": "6.11.0", + "qs": "~6.15.1", "range-parser": "~1.2.1", "safe-buffer": "5.2.1", - "send": "0.18.0", - "serve-static": "1.15.0", + "send": "~0.19.0", + "serve-static": "~1.16.2", "setprototypeof": "1.2.0", - "statuses": "2.0.1", + "statuses": "~2.0.1", "type-is": "~1.6.18", "utils-merge": "1.0.1", "vary": "~1.1.2" }, "engines": { "node": ">= 0.10.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/express-rate-limit": { @@ -599,25 +687,6 @@ "express": "4 || 5 || ^5.0.0-beta.1" } }, - "node_modules/express/node_modules/safe-buffer": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", - "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ] - }, "node_modules/fast-redact": { "version": "3.5.0", "resolved": "https://registry.npmjs.org/fast-redact/-/fast-redact-3.5.0.tgz", @@ -627,16 +696,17 @@ } }, "node_modules/finalhandler": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.2.0.tgz", - "integrity": "sha512-5uXcUVftlQMFnWC9qu/svkWv3GTd2PfUhK/3PLkYNAe7FbqJMt3515HaxE6eRL74GdsriiwujiawdaB1BpEISg==", + "version": "1.3.2", + "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz", + "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==", + "license": "MIT", "dependencies": { "debug": "2.6.9", - "encodeurl": "~1.0.2", + "encodeurl": "~2.0.0", "escape-html": "~1.0.3", - "on-finished": "2.4.1", + "on-finished": "~2.4.1", "parseurl": "~1.3.3", - "statuses": "2.0.1", + "statuses": "~2.0.2", "unpipe": "~1.0.0" }, "engines": { @@ -644,15 +714,16 @@ } }, "node_modules/follow-redirects": { - "version": "1.15.6", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz", - "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==", + "version": "1.16.0", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", + "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", "funding": [ { "type": "individual", "url": "https://github.com/sponsors/RubenVerborgh" } ], + "license": "MIT", "engines": { "node": ">=4.0" }, @@ -663,13 +734,16 @@ } }, "node_modules/form-data": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz", - "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==", + "version": "4.0.6", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz", + "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==", + "license": "MIT", "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", - "mime-types": "^2.1.12" + "es-set-tostringtag": "^2.1.0", + "hasown": "^2.0.4", + "mime-types": "^2.1.35" }, "engines": { "node": ">= 6" @@ -687,6 +761,7 @@ "version": "0.5.2", "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz", "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==", + "license": "MIT", "engines": { "node": ">= 0.6" } @@ -695,20 +770,27 @@ "version": "1.1.2", "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", + "license": "MIT", "funding": { "url": "https://github.com/sponsors/ljharb" } }, "node_modules/get-intrinsic": { - "version": "1.2.4", - "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.2.4.tgz", - "integrity": "sha512-5uYhsJH8VJBTv7oslg4BznJYhDoRI6waYCxMmCdnTrcCrHA/fCFKoTFz2JKKE0HdDFUF7/oQuhzumXJK7paBRQ==", + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", + "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", + "license": "MIT", "dependencies": { + "call-bind-apply-helpers": "^1.0.2", + "es-define-property": "^1.0.1", "es-errors": "^1.3.0", + "es-object-atoms": "^1.1.1", "function-bind": "^1.1.2", - "has-proto": "^1.0.1", - "has-symbols": "^1.0.3", - "hasown": "^2.0.0" + "get-proto": "^1.0.1", + "gopd": "^1.2.0", + "has-symbols": "^1.1.0", + "hasown": "^2.0.2", + "math-intrinsics": "^1.1.0" }, "engines": { "node": ">= 0.4" @@ -717,32 +799,36 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/gopd": { + "node_modules/get-proto": { "version": "1.0.1", - "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz", - "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==", + "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", + "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", + "license": "MIT", "dependencies": { - "get-intrinsic": "^1.1.3" + "dunder-proto": "^1.0.1", + "es-object-atoms": "^1.0.0" }, - "funding": { - "url": "https://github.com/sponsors/ljharb" + "engines": { + "node": ">= 0.4" } }, - "node_modules/has-property-descriptors": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz", - "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==", - "dependencies": { - "es-define-property": "^1.0.0" + "node_modules/gopd": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", + "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", + "license": "MIT", + "engines": { + "node": ">= 0.4" }, "funding": { "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/has-proto": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.3.tgz", - "integrity": "sha512-SJ1amZAJUiZS+PhsVLf5tGydlaVB8EdFpaSO4gmiUKUOxk8qzn5AIy4ZeJUmh22znIdk/uMAUT2pl3FxzVUH+Q==", + "node_modules/has-symbols": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", + "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", + "license": "MIT", "engines": { "node": ">= 0.4" }, @@ -750,10 +836,14 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/has-symbols": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz", - "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==", + "node_modules/has-tostringtag": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz", + "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==", + "license": "MIT", + "dependencies": { + "has-symbols": "^1.0.3" + }, "engines": { "node": ">= 0.4" }, @@ -762,9 +852,10 @@ } }, "node_modules/hasown": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz", - "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==", + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz", + "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==", + "license": "MIT", "dependencies": { "function-bind": "^1.1.2" }, @@ -781,18 +872,23 @@ } }, "node_modules/http-errors": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz", - "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==", + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", + "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==", + "license": "MIT", "dependencies": { - "depd": "2.0.0", - "inherits": "2.0.4", - "setprototypeof": "1.2.0", - "statuses": "2.0.1", - "toidentifier": "1.0.1" + "depd": "~2.0.0", + "inherits": "~2.0.4", + "setprototypeof": "~1.2.0", + "statuses": "~2.0.2", + "toidentifier": "~1.0.1" }, "engines": { "node": ">= 0.8" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/http-status-codes": { @@ -800,10 +896,47 @@ "resolved": "https://registry.npmjs.org/http-status-codes/-/http-status-codes-2.3.0.tgz", "integrity": "sha512-RJ8XvFvpPM/Dmc5SV+dC4y5PCeOhT3x1Hq0NU3rjGeg5a/CqlhZ7uudknPwZFz4aeAXDcbAyaeP7GAo9lvngtA==" }, + "node_modules/https-proxy-agent": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz", + "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==", + "license": "MIT", + "dependencies": { + "agent-base": "6", + "debug": "4" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/https-proxy-agent/node_modules/debug": { + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "license": "MIT", + "dependencies": { + "ms": "^2.1.3" + }, + "engines": { + "node": ">=6.0" + }, + "peerDependenciesMeta": { + "supports-color": { + "optional": true + } + } + }, + "node_modules/https-proxy-agent/node_modules/ms": { + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", + "license": "MIT" + }, "node_modules/iconv-lite": { "version": "0.4.24", "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz", "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==", + "license": "MIT", "dependencies": { "safer-buffer": ">= 2.1.2 < 3" }, @@ -833,7 +966,8 @@ "node_modules/inherits": { "version": "2.0.4", "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", - "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==" + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", + "license": "ISC" }, "node_modules/ipaddr.js": { "version": "1.9.1", @@ -844,11 +978,12 @@ } }, "node_modules/jsonwebtoken": { - "version": "9.0.2", - "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.2.tgz", - "integrity": "sha512-PRp66vJ865SSqOlgqS8hujT5U4AOgMfhrwYIuIhfKaoSCZcirrmASQr8CX7cUg+RMih+hgznrjp99o+W4pJLHQ==", + "version": "9.0.3", + "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz", + "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==", + "license": "MIT", "dependencies": { - "jws": "^3.2.2", + "jws": "^4.0.1", "lodash.includes": "^4.3.0", "lodash.isboolean": "^3.0.3", "lodash.isinteger": "^4.0.4", @@ -867,24 +1002,27 @@ "node_modules/jsonwebtoken/node_modules/ms": { "version": "2.1.3", "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", - "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==" + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", + "license": "MIT" }, "node_modules/jwa": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/jwa/-/jwa-1.4.1.tgz", - "integrity": "sha512-qiLX/xhEEFKUAJ6FiBMbes3w9ATzyk5W7Hvzpa/SLYdxNtng+gcurvrI7TbACjIXlsJyr05/S1oUhZrc63evQA==", + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz", + "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==", + "license": "MIT", "dependencies": { - "buffer-equal-constant-time": "1.0.1", + "buffer-equal-constant-time": "^1.0.1", "ecdsa-sig-formatter": "1.0.11", "safe-buffer": "^5.0.1" } }, "node_modules/jws": { - "version": "3.2.2", - "resolved": "https://registry.npmjs.org/jws/-/jws-3.2.2.tgz", - "integrity": "sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==", + "version": "4.0.1", + "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz", + "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==", + "license": "MIT", "dependencies": { - "jwa": "^1.4.1", + "jwa": "^2.0.1", "safe-buffer": "^5.0.1" } }, @@ -897,61 +1035,71 @@ "node_modules/lodash.includes": { "version": "4.3.0", "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz", - "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==" + "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==", + "license": "MIT" }, "node_modules/lodash.isboolean": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz", - "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==" + "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==", + "license": "MIT" }, "node_modules/lodash.isinteger": { "version": "4.0.4", "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz", - "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==" + "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==", + "license": "MIT" }, "node_modules/lodash.isnumber": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz", - "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==" + "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==", + "license": "MIT" }, "node_modules/lodash.isplainobject": { "version": "4.0.6", "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz", - "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==" + "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==", + "license": "MIT" }, "node_modules/lodash.isstring": { "version": "4.0.1", "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz", - "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==" + "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==", + "license": "MIT" }, "node_modules/lodash.once": { "version": "4.1.1", "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz", - "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==" + "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==", + "license": "MIT" }, - "node_modules/lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "dependencies": { - "yallist": "^4.0.0" - }, + "node_modules/math-intrinsics": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", + "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", + "license": "MIT", "engines": { - "node": ">=10" + "node": ">= 0.4" } }, "node_modules/media-typer": { "version": "0.3.0", "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz", "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==", + "license": "MIT", "engines": { "node": ">= 0.6" } }, "node_modules/merge-descriptors": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz", - "integrity": "sha512-cCi6g3/Zr1iqQi6ySbseM1Xvooa98N0w31jzUYrXPX2xqObmFGHJ0tQ5u74H3mVh7wLouTseZyYIq39g8cNp1w==" + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz", + "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==", + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } }, "node_modules/methods": { "version": "1.1.2", @@ -965,6 +1113,7 @@ "version": "1.6.0", "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz", "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==", + "license": "MIT", "bin": { "mime": "cli.js" }, @@ -1013,9 +1162,13 @@ } }, "node_modules/object-inspect": { - "version": "1.13.1", - "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.1.tgz", - "integrity": "sha512-5qoj1RUiKOMsCCNLV1CBiPYE10sziTsnmNxkAI/rZhiD63CF7IqdFGC/XzjWjpSgLf0LxXX3bDFIh0E18f6UhQ==", + "version": "1.13.4", + "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz", + "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==", + "license": "MIT", + "engines": { + "node": ">= 0.4" + }, "funding": { "url": "https://github.com/sponsors/ljharb" } @@ -1032,6 +1185,7 @@ "version": "2.4.1", "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", + "license": "MIT", "dependencies": { "ee-first": "1.1.1" }, @@ -1040,9 +1194,10 @@ } }, "node_modules/on-headers": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz", - "integrity": "sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA==", + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz", + "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==", + "license": "MIT", "engines": { "node": ">= 0.8" } @@ -1072,14 +1227,16 @@ "version": "1.3.3", "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz", "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==", + "license": "MIT", "engines": { "node": ">= 0.8" } }, "node_modules/path-to-regexp": { - "version": "0.1.7", - "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz", - "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ==" + "version": "0.1.13", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz", + "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==", + "license": "MIT" }, "node_modules/pino": { "version": "8.20.0", @@ -1157,16 +1314,22 @@ } }, "node_modules/proxy-from-env": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz", - "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==" + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz", + "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==", + "license": "MIT", + "engines": { + "node": ">=10" + } }, "node_modules/qs": { - "version": "6.11.0", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.11.0.tgz", - "integrity": "sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==", + "version": "6.16.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", + "license": "BSD-3-Clause", "dependencies": { - "side-channel": "^1.0.4" + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" }, "engines": { "node": ">=0.6" @@ -1184,32 +1347,26 @@ "version": "1.2.1", "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz", "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==", + "license": "MIT", "engines": { "node": ">= 0.6" } }, "node_modules/raw-body": { - "version": "2.5.2", - "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz", - "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==", + "version": "2.5.3", + "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz", + "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==", + "license": "MIT", "dependencies": { - "bytes": "3.1.2", - "http-errors": "2.0.0", - "iconv-lite": "0.4.24", - "unpipe": "1.0.0" + "bytes": "~3.1.2", + "http-errors": "~2.0.1", + "iconv-lite": "~0.4.24", + "unpipe": "~1.0.0" }, "engines": { "node": ">= 0.8" } }, - "node_modules/raw-body/node_modules/bytes": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", - "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==", - "engines": { - "node": ">= 0.8" - } - }, "node_modules/readable-stream": { "version": "4.5.2", "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.5.2.tgz", @@ -1234,9 +1391,24 @@ } }, "node_modules/safe-buffer": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz", - "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==" + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", + "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/feross" + }, + { + "type": "patreon", + "url": "https://www.patreon.com/feross" + }, + { + "type": "consulting", + "url": "https://feross.org/support" + } + ], + "license": "MIT" }, "node_modules/safe-stable-stringify": { "version": "2.4.3", @@ -1249,15 +1421,14 @@ "node_modules/safer-buffer": { "version": "2.1.2", "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", - "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==" + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", + "license": "MIT" }, "node_modules/semver": { - "version": "7.6.0", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.0.tgz", - "integrity": "sha512-EnwXhrlwXMk9gKu5/flx5sv/an57AkRplG3hTK68W7FRDN+k+OWBj65M7719OkA82XLBxrcX0KSHj+X5COhOVg==", - "dependencies": { - "lru-cache": "^6.0.0" - }, + "version": "7.8.5", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", + "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", + "license": "ISC", "bin": { "semver": "bin/semver.js" }, @@ -1266,23 +1437,24 @@ } }, "node_modules/send": { - "version": "0.18.0", - "resolved": "https://registry.npmjs.org/send/-/send-0.18.0.tgz", - "integrity": "sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==", + "version": "0.19.2", + "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz", + "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==", + "license": "MIT", "dependencies": { "debug": "2.6.9", "depd": "2.0.0", "destroy": "1.2.0", - "encodeurl": "~1.0.2", + "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "etag": "~1.8.1", - "fresh": "0.5.2", - "http-errors": "2.0.0", + "fresh": "~0.5.2", + "http-errors": "~2.0.1", "mime": "1.6.0", "ms": "2.1.3", - "on-finished": "2.4.1", + "on-finished": "~2.4.1", "range-parser": "~1.2.1", - "statuses": "2.0.1" + "statuses": "~2.0.2" }, "engines": { "node": ">= 0.8.0" @@ -1291,52 +1463,94 @@ "node_modules/send/node_modules/ms": { "version": "2.1.3", "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", - "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==" + "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", + "license": "MIT" }, "node_modules/serve-static": { - "version": "1.15.0", - "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.15.0.tgz", - "integrity": "sha512-XGuRDNjXUijsUL0vl6nSD7cwURuzEgglbOaFuZM9g3kwDXOWVTck0jLzjPzGD+TazWbboZYu52/9/XPdUgne9g==", + "version": "1.16.3", + "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz", + "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==", + "license": "MIT", "dependencies": { - "encodeurl": "~1.0.2", + "encodeurl": "~2.0.0", "escape-html": "~1.0.3", "parseurl": "~1.3.3", - "send": "0.18.0" + "send": "~0.19.1" }, "engines": { "node": ">= 0.8.0" } }, - "node_modules/set-function-length": { - "version": "1.2.2", - "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz", - "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==", + "node_modules/setprototypeof": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", + "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==", + "license": "ISC" + }, + "node_modules/side-channel": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz", + "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==", + "license": "MIT", "dependencies": { - "define-data-property": "^1.1.4", "es-errors": "^1.3.0", - "function-bind": "^1.1.2", - "get-intrinsic": "^1.2.4", - "gopd": "^1.0.1", - "has-property-descriptors": "^1.0.2" + "object-inspect": "^1.13.4", + "side-channel-list": "^1.0.1", + "side-channel-map": "^1.0.1", + "side-channel-weakmap": "^1.0.2" }, "engines": { "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/setprototypeof": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", - "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==" + "node_modules/side-channel-list": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz", + "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==", + "license": "MIT", + "dependencies": { + "es-errors": "^1.3.0", + "object-inspect": "^1.13.4" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } }, - "node_modules/side-channel": { - "version": "1.0.6", - "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.6.tgz", - "integrity": "sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==", + "node_modules/side-channel-map": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz", + "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==", + "license": "MIT", "dependencies": { - "call-bind": "^1.0.7", + "call-bound": "^1.0.2", "es-errors": "^1.3.0", - "get-intrinsic": "^1.2.4", - "object-inspect": "^1.13.1" + "get-intrinsic": "^1.2.5", + "object-inspect": "^1.13.3" + }, + "engines": { + "node": ">= 0.4" + }, + "funding": { + "url": "https://github.com/sponsors/ljharb" + } + }, + "node_modules/side-channel-weakmap": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz", + "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==", + "license": "MIT", + "dependencies": { + "call-bound": "^1.0.2", + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.5", + "object-inspect": "^1.13.3", + "side-channel-map": "^1.0.1" }, "engines": { "node": ">= 0.4" @@ -1362,9 +1576,10 @@ } }, "node_modules/statuses": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz", - "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==", + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz", + "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==", + "license": "MIT", "engines": { "node": ">= 0.8" } @@ -1377,25 +1592,6 @@ "safe-buffer": "~5.2.0" } }, - "node_modules/string_decoder/node_modules/safe-buffer": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", - "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ] - }, "node_modules/thread-stream": { "version": "2.4.1", "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-2.4.1.tgz", @@ -1408,6 +1604,7 @@ "version": "1.0.1", "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz", "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==", + "license": "MIT", "engines": { "node": ">=0.6" } @@ -1416,6 +1613,7 @@ "version": "1.6.18", "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz", "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==", + "license": "MIT", "dependencies": { "media-typer": "0.3.0", "mime-types": "~2.1.24" @@ -1448,6 +1646,7 @@ "version": "1.0.0", "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz", "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==", + "license": "MIT", "engines": { "node": ">= 0.8" } @@ -1467,11 +1666,6 @@ "engines": { "node": ">= 0.8" } - }, - "node_modules/yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" } } } diff --git a/package.json b/package.json index eb190ac..067053f 100644 --- a/package.json +++ b/package.json @@ -42,5 +42,10 @@ "@types/node": "^20.11.24", "prettier": "^3.2.5", "typescript": "^5.9.3" + }, + "overrides": { + "express": { + "qs": "^6.16.0" + } } } From 4765d2bd9405f7817a892f7574bb65b157556877 Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:00:59 +1000 Subject: [PATCH 2/9] Reject malformed queries before provider execution --- src/ai/ai.controller.ts | 8 +++++-- tests/AIController.test.ts | 47 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+), 2 deletions(-) create mode 100644 tests/AIController.test.ts diff --git a/src/ai/ai.controller.ts b/src/ai/ai.controller.ts index f74430e..f32602a 100644 --- a/src/ai/ai.controller.ts +++ b/src/ai/ai.controller.ts @@ -12,8 +12,12 @@ import { pickAIProvider } from './ai.service.ts'; import { logger } from '../logger/index.ts'; export const query = async (req: Request, res: Response): Promise => { - const { query, systemInfo }: AIQueryRequest = req.body; - const trimmedQuery = query?.trim(); + const { systemInfo }: AIQueryRequest = req.body ?? {}; + const query: unknown = req.body?.query; + if (typeof query !== 'string') { + return res.status(StatusCodes.BAD_REQUEST).send('Query must be a string'); + } + const trimmedQuery = query.trim(); if (!trimmedQuery?.length) { return res.status(StatusCodes.BAD_REQUEST).send('Missing query in the payload'); diff --git a/tests/AIController.test.ts b/tests/AIController.test.ts new file mode 100644 index 0000000..69999f6 --- /dev/null +++ b/tests/AIController.test.ts @@ -0,0 +1,47 @@ +import assert from 'node:assert/strict'; +import test from 'node:test'; +import type { Request, Response } from 'express'; +import { query } from '../src/ai/ai.controller.ts'; + +function response() { + const result = { status: 0, body: undefined as unknown }; + const res = { + status(code: number) { + result.status = code; + return this; + }, + send(body: unknown) { + result.body = body; + return this; + }, + json(body: unknown) { + result.body = body; + return this; + }, + } as unknown as Response; + return { result, res }; +} + +test('malformed queries return 400 instead of rejecting the Express handler', async () => { + for (const body of [ + undefined, + null, + {}, + { query: 42 }, + { query: true }, + { query: [] }, + { query: {} }, + { query: '' }, + { query: ' ' }, + ]) { + const { result, res } = response(); + await query({ body } as Request, res); + assert.equal(result.status, 400); + } +}); + +test('oversized queries return 413 before provider selection', async () => { + const { result, res } = response(); + await query({ body: { query: 'a'.repeat(12_001) } } as Request, res); + assert.equal(result.status, 413); +}); From adfb2242b964f8ae3e1f1ebd14e1475cb8346a7f Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:01:00 +1000 Subject: [PATCH 3/9] Validate license resources using their JSON API envelope --- src/middlewares/licensing.middleware.ts | 5 +-- src/user/license.service.ts | 18 +++++----- tests/LicenseService.test.ts | 44 +++++++++++++++++++++++++ 3 files changed, 56 insertions(+), 11 deletions(-) create mode 100644 tests/LicenseService.test.ts diff --git a/src/middlewares/licensing.middleware.ts b/src/middlewares/licensing.middleware.ts index 8a2533c..be718a5 100644 --- a/src/middlewares/licensing.middleware.ts +++ b/src/middlewares/licensing.middleware.ts @@ -26,8 +26,9 @@ export const licensingMiddleware = async (req: Request, res: Response, next: Nex } // License Id and License Key are both receive from License header separated by a colon - const [licenseIdHeader, licenseKeyHeader] = licenseHeader.split(':'); - if (!licenseIdHeader?.length || !licenseKeyHeader?.length) { + const parts = licenseHeader.split(':'); + const [licenseIdHeader, licenseKeyHeader] = parts; + if (parts.length !== 2 || !licenseIdHeader?.length || !licenseKeyHeader?.length) { return res.status(StatusCodes.UNAUTHORIZED).send(errorMessage); } diff --git a/src/user/license.service.ts b/src/user/license.service.ts index 421bf28..d5756e5 100644 --- a/src/user/license.service.ts +++ b/src/user/license.service.ts @@ -12,22 +12,22 @@ import { LicenseStatus } from './license.type.ts'; const apiUrl = 'https://api.lemonsqueezy.com/v1/license-keys/'; export const isUserLicenseKeyValid = async (licenseId: string, licenseKey: string): Promise => { - // make request to Lemonsqueezy licensing and retrieve back if license was found or not + if (!/^\d+$/.test(licenseId) || !licenseKey.length) { + return false; + } + try { - const { - data: { - attributes: { key: userLicenseKey }, - status, - }, - } = await axios.get(apiUrl + licenseId, { + const response = await axios.get(apiUrl + licenseId, { + timeout: 5000, headers: { Authorization: `Bearer ${config.lemonSqueezyApiKey}`, Accept: 'application/vnd.api+json', 'Content-Type': 'application/vnd.api+json', }, }); - - return status === LicenseStatus.ACTIVE && userLicenseKey === licenseKey; + // Lemon Squeezy wraps the resource inside the response body's `data` member. + const attributes = response.data?.data?.attributes; + return attributes?.status === LicenseStatus.ACTIVE && attributes?.key === licenseKey; } catch (e: any) { axiosError(e, 'LemonSqueezy Error:'); diff --git a/tests/LicenseService.test.ts b/tests/LicenseService.test.ts new file mode 100644 index 0000000..88ab0b9 --- /dev/null +++ b/tests/LicenseService.test.ts @@ -0,0 +1,44 @@ +import assert from 'node:assert/strict'; +import test from 'node:test'; +import axios from 'axios'; +import { isUserLicenseKeyValid } from '../src/user/license.service.ts'; + +function licenseResponse(status: string, key = 'fixture-license-key') { + return { data: { data: { type: 'license-keys', id: '7', attributes: { key, status } } } }; +} + +test('active licenses are read from the JSON:API resource attributes', async (t) => { + t.mock.method(axios, 'get', async (url: string, options: any) => { + assert.equal(url, 'https://api.lemonsqueezy.com/v1/license-keys/7'); + assert.ok(options.timeout > 0); + return licenseResponse('active'); + }); + assert.equal(await isUserLicenseKeyValid('7', 'fixture-license-key'), true); +}); + +test('wrong keys and non-active licenses are rejected', async (t) => { + for (const status of ['inactive', 'expired', 'disabled']) { + const mock = t.mock.method(axios, 'get', async () => licenseResponse(status)); + assert.equal(await isUserLicenseKeyValid('7', 'fixture-license-key'), false); + mock.mock.restore(); + } + t.mock.method(axios, 'get', async () => licenseResponse('active', 'different-key')); + assert.equal(await isUserLicenseKeyValid('7', 'fixture-license-key'), false); +}); + +test('malformed license ids do not make an upstream request', async (t) => { + let calls = 0; + t.mock.method(axios, 'get', async () => { + calls += 1; + return licenseResponse('active'); + }); + for (const id of ['', '../users', '7/other', '7?include=order', '1.5']) { + assert.equal(await isUserLicenseKeyValid(id, 'fixture-license-key'), false); + } + assert.equal(calls, 0); +}); + +test('malformed upstream responses fail closed', async (t) => { + t.mock.method(axios, 'get', async () => ({ data: {} })); + assert.equal(await isUserLicenseKeyValid('7', 'fixture-license-key'), false); +}); From 679d28b98258b70a52d22cc350ba5b5e082f1af7 Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:01:00 +1000 Subject: [PATCH 4/9] Retire JWT issuance that proxy authentication never accepts --- .env.dist | 1 - .env.railway.example | 1 - package-lock.json | 138 ----------------------------- package.json | 2 - src/config/config-variables.ts | 2 - src/main.routes.ts | 19 +--- src/middlewares/auth.middleware.ts | 4 +- 7 files changed, 6 insertions(+), 161 deletions(-) diff --git a/.env.dist b/.env.dist index 5d7e17b..925c243 100644 --- a/.env.dist +++ b/.env.dist @@ -7,7 +7,6 @@ RATE_LIMIT_MAX=100 # Token and Secret JWT_SECRET="" BROWSER_EXTENSION_SECRET="" -JWT_TOKEN_EXPIRY_TIME="3h" ## Mistral AI diff --git a/.env.railway.example b/.env.railway.example index aec25c4..7cd56cd 100644 --- a/.env.railway.example +++ b/.env.railway.example @@ -11,7 +11,6 @@ JWT_SECRET= # Optional secondary token for browser-extension or internal clients. BROWSER_EXTENSION_SECRET= -JWT_TOKEN_EXPIRY_TIME=3h # Default production provider. OPENAI_API_ENABLED=true diff --git a/package-lock.json b/package-lock.json index 9c4f15c..4c33f53 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,6 @@ "express-rate-limit": "^7.2.0", "helmet": "^7.1.0", "http-status-codes": "^2.3.0", - "jsonwebtoken": "^9.0.2", "llama-api-client": "^0.3.0", "openai": "^6.36.0", "pino": "^8.19.0" @@ -25,7 +24,6 @@ "@types/compression": "^1.7.5", "@types/cors": "^2.8.17", "@types/express": "^4.17.21", - "@types/jsonwebtoken": "^9.0.6", "@types/node": "^20.11.24", "prettier": "^3.2.5", "typescript": "^5.9.3" @@ -101,30 +99,12 @@ "integrity": "sha512-D0CFMMtydbJAegzOyHjtiKPLlvnm3iTZyZRSZoLq2mRhDdmLfIWOCYPfQJ4cu2erKghU++QvjcUjp/5h7hESpA==", "dev": true }, - "node_modules/@types/jsonwebtoken": { - "version": "9.0.10", - "resolved": "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-9.0.10.tgz", - "integrity": "sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@types/ms": "*", - "@types/node": "*" - } - }, "node_modules/@types/mime": { "version": "1.3.5", "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz", "integrity": "sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==", "dev": true }, - "node_modules/@types/ms": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz", - "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==", - "dev": true, - "license": "MIT" - }, "node_modules/@types/node": { "version": "20.12.7", "resolved": "https://registry.npmjs.org/@types/node/-/node-20.12.7.tgz", @@ -322,12 +302,6 @@ "ieee754": "^1.2.1" } }, - "node_modules/buffer-equal-constant-time": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz", - "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==", - "license": "BSD-3-Clause" - }, "node_modules/bytes": { "version": "3.1.2", "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz", @@ -527,15 +501,6 @@ "node": ">= 0.4" } }, - "node_modules/ecdsa-sig-formatter": { - "version": "1.0.11", - "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz", - "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==", - "license": "Apache-2.0", - "dependencies": { - "safe-buffer": "^5.0.1" - } - }, "node_modules/ee-first": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", @@ -977,103 +942,12 @@ "node": ">= 0.10" } }, - "node_modules/jsonwebtoken": { - "version": "9.0.3", - "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz", - "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==", - "license": "MIT", - "dependencies": { - "jws": "^4.0.1", - "lodash.includes": "^4.3.0", - "lodash.isboolean": "^3.0.3", - "lodash.isinteger": "^4.0.4", - "lodash.isnumber": "^3.0.3", - "lodash.isplainobject": "^4.0.6", - "lodash.isstring": "^4.0.1", - "lodash.once": "^4.0.0", - "ms": "^2.1.1", - "semver": "^7.5.4" - }, - "engines": { - "node": ">=12", - "npm": ">=6" - } - }, - "node_modules/jsonwebtoken/node_modules/ms": { - "version": "2.1.3", - "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", - "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", - "license": "MIT" - }, - "node_modules/jwa": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz", - "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==", - "license": "MIT", - "dependencies": { - "buffer-equal-constant-time": "^1.0.1", - "ecdsa-sig-formatter": "1.0.11", - "safe-buffer": "^5.0.1" - } - }, - "node_modules/jws": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz", - "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==", - "license": "MIT", - "dependencies": { - "jwa": "^2.0.1", - "safe-buffer": "^5.0.1" - } - }, "node_modules/llama-api-client": { "version": "0.3.0", "resolved": "https://registry.npmjs.org/llama-api-client/-/llama-api-client-0.3.0.tgz", "integrity": "sha512-/P2X9Tvw69Ruhe+CP7GFFoY8LUBT+YrRAC/FUgKF09G+JLlHzk3or5xhBE8/Sl+fFOAn6ROzGu730XX49ngkWA==", "license": "MIT" }, - "node_modules/lodash.includes": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz", - "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==", - "license": "MIT" - }, - "node_modules/lodash.isboolean": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz", - "integrity": "sha512-Bz5mupy2SVbPHURB98VAcw+aHh4vRV5IPNhILUCsOzRmsTmSQ17jIuqopAentWoehktxGd9e/hbIXq980/1QJg==", - "license": "MIT" - }, - "node_modules/lodash.isinteger": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/lodash.isinteger/-/lodash.isinteger-4.0.4.tgz", - "integrity": "sha512-DBwtEWN2caHQ9/imiNeEA5ys1JoRtRfY3d7V9wkqtbycnAmTvRRmbHKDV4a0EYc678/dia0jrte4tjYwVBaZUA==", - "license": "MIT" - }, - "node_modules/lodash.isnumber": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/lodash.isnumber/-/lodash.isnumber-3.0.3.tgz", - "integrity": "sha512-QYqzpfwO3/CWf3XP+Z+tkQsfaLL/EnUlXWVkIk5FUPc4sBdTehEqZONuyRt2P67PXAk+NXmTBcc97zw9t1FQrw==", - "license": "MIT" - }, - "node_modules/lodash.isplainobject": { - "version": "4.0.6", - "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz", - "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==", - "license": "MIT" - }, - "node_modules/lodash.isstring": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/lodash.isstring/-/lodash.isstring-4.0.1.tgz", - "integrity": "sha512-0wJxfxH1wgO3GrbuP+dTTk7op+6L41QCXbGINEmD+ny/G/eCqGzxyCsh7159S+mgDDcoarnBw6PC1PS5+wUGgw==", - "license": "MIT" - }, - "node_modules/lodash.once": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/lodash.once/-/lodash.once-4.1.1.tgz", - "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==", - "license": "MIT" - }, "node_modules/math-intrinsics": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", @@ -1424,18 +1298,6 @@ "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", "license": "MIT" }, - "node_modules/semver": { - "version": "7.8.5", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", - "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", - "license": "ISC", - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, "node_modules/send": { "version": "0.19.2", "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz", diff --git a/package.json b/package.json index 067053f..658f376 100644 --- a/package.json +++ b/package.json @@ -29,7 +29,6 @@ "express-rate-limit": "^7.2.0", "helmet": "^7.1.0", "http-status-codes": "^2.3.0", - "jsonwebtoken": "^9.0.2", "llama-api-client": "^0.3.0", "openai": "^6.36.0", "pino": "^8.19.0" @@ -38,7 +37,6 @@ "@types/compression": "^1.7.5", "@types/cors": "^2.8.17", "@types/express": "^4.17.21", - "@types/jsonwebtoken": "^9.0.6", "@types/node": "^20.11.24", "prettier": "^3.2.5", "typescript": "^5.9.3" diff --git a/src/config/config-variables.ts b/src/config/config-variables.ts index 3fb88b3..4b758ff 100644 --- a/src/config/config-variables.ts +++ b/src/config/config-variables.ts @@ -17,7 +17,6 @@ interface ConfigProps { rateLimitMax: number; jwtToken: string; browserExtensionSecret: string; - jwtTokenExpiryTime: string; // Mistral AI mistralAiApiEnabled: boolean; @@ -80,7 +79,6 @@ const config: ConfigProps = { rateLimitMax: parseNumber(readEnv('RATE_LIMIT_MAX'), 100), jwtToken: readEnv('JWT_SECRET'), browserExtensionSecret: readEnv('BROWSER_EXTENSION_SECRET'), - jwtTokenExpiryTime: readEnv('JWT_TOKEN_EXPIRY_TIME') || '3h', mistralAiApiEnabled: parseBoolean(readEnv('MISTRAL_AI_API_ENABLED'), false), mistralAiApiKey: readEnv('MISTRAL_AI_API_KEY'), diff --git a/src/main.routes.ts b/src/main.routes.ts index efe1701..dcfb2a5 100644 --- a/src/main.routes.ts +++ b/src/main.routes.ts @@ -5,7 +5,6 @@ import express from 'express'; import type { Request, Response } from 'express'; -import jwt from 'jsonwebtoken'; import packageJson from '../package.json' with { type: 'json' }; import { config, messages } from './config/index.ts'; import { StatusCodes } from 'http-status-codes'; @@ -17,20 +16,10 @@ router.get('/', (req: Request, res: Response) => { res.send(messages.downloadApp); }); -router.post('/token-generator', (req: Request, res: Response) => { - // Authentication logic here... - - const token = jwt.sign( - { - /* user data */ - }, - config.jwtToken, - { - expiresIn: config.jwtTokenExpiryTime, - } - ); - - res.status(StatusCodes.OK).json({ token }); +router.post('/token-generator', (_req: Request, res: Response) => { + res + .status(StatusCodes.GONE) + .json({ message: 'Token generation is not supported. Configure a trusted client bearer token.' }); }); router.get('/health', (req: Request, res: Response) => { diff --git a/src/middlewares/auth.middleware.ts b/src/middlewares/auth.middleware.ts index 95c3123..3d8f750 100644 --- a/src/middlewares/auth.middleware.ts +++ b/src/middlewares/auth.middleware.ts @@ -34,8 +34,8 @@ export const authMiddleware = (req: Request, res: Response, next: NextFunction) throw new Error('Invalid token'); } - // The macOS app uses a shared bearer token so Railway deployments can rotate - // one secret without forcing end-user credential handling in the client. + // This optional proxy accepts configured opaque bearer tokens, not signed JWTs. + // Current native SucceedAI apps use on-device models and do not call this server. next(); } catch (e: unknown) { return res.status(StatusCodes.UNAUTHORIZED).send('Invalid token.'); From c89f9ff99f94ef262e04c911dadf4ab98e247d85 Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:01:00 +1000 Subject: [PATCH 5/9] Keep private request data out of provider logs --- src/ai/ai.controller.ts | 10 +++------- src/ai/api-providers/LlamaAIAdapter.ts | 2 +- src/ai/api-providers/OpenAIAdapter.ts | 2 +- src/logger/axios-error.helper.ts | 3 ++- tests/AIController.test.ts | 23 +++++++++++++++++++++++ tests/Logging.test.ts | 18 ++++++++++++++++++ 6 files changed, 48 insertions(+), 10 deletions(-) create mode 100644 tests/Logging.test.ts diff --git a/src/ai/ai.controller.ts b/src/ai/ai.controller.ts index f32602a..c698422 100644 --- a/src/ai/ai.controller.ts +++ b/src/ai/ai.controller.ts @@ -6,13 +6,12 @@ import type { Request, Response } from 'express'; import { StatusCodes } from 'http-status-codes'; -import type { AIQueryRequest, BodyResponse } from './request.type.ts'; +import type { BodyResponse } from './request.type.ts'; import type { AIProvidable } from './api-providers/index.ts'; import { pickAIProvider } from './ai.service.ts'; import { logger } from '../logger/index.ts'; export const query = async (req: Request, res: Response): Promise => { - const { systemInfo }: AIQueryRequest = req.body ?? {}; const query: unknown = req.body?.query; if (typeof query !== 'string') { return res.status(StatusCodes.BAD_REQUEST).send('Query must be a string'); @@ -29,10 +28,7 @@ export const query = async (req: Request, res: Response): Promise => { try { const aiProvider: AIProvidable = pickAIProvider(); - logger.info( - { systemInfo, provider: aiProvider.getProviderName(), model: aiProvider.getModel() }, - 'AI query request' - ); + logger.info({ provider: aiProvider.getProviderName(), model: aiProvider.getModel() }, 'AI query request'); const queryResult: string = await aiProvider.query(trimmedQuery); const model = aiProvider.getModel(); @@ -43,7 +39,7 @@ export const query = async (req: Request, res: Response): Promise => { res.status(StatusCodes.OK).json(body); } catch (error) { - logger.error('Error:', error); + logger.error('AI query failed'); res.status(StatusCodes.INTERNAL_SERVER_ERROR).json({ message: 'Error processing request' }); } }; diff --git a/src/ai/api-providers/LlamaAIAdapter.ts b/src/ai/api-providers/LlamaAIAdapter.ts index f32c101..8bc10c3 100644 --- a/src/ai/api-providers/LlamaAIAdapter.ts +++ b/src/ai/api-providers/LlamaAIAdapter.ts @@ -36,7 +36,7 @@ export class LlamaAIAdapter implements AIProvidable { return (typeof content === 'string' ? content : content?.text || '').trim(); } catch (error: unknown) { - logger.error({ error }, 'LlamaAIAdapter error'); + logger.error('LlamaAIAdapter request failed'); throw new Error('Error processing AI query'); } } diff --git a/src/ai/api-providers/OpenAIAdapter.ts b/src/ai/api-providers/OpenAIAdapter.ts index 7f26852..67c1687 100644 --- a/src/ai/api-providers/OpenAIAdapter.ts +++ b/src/ai/api-providers/OpenAIAdapter.ts @@ -37,7 +37,7 @@ export class OpenAIAdapter implements AIProvidable { return response.output_text?.trim() || this.extractOutputText(response).trim(); } catch (error: any) { - logger.error('Error in OpenAiAdapter:', error); + logger.error('OpenAIAdapter request failed'); throw new Error('Error processing AI query'); } } diff --git a/src/logger/axios-error.helper.ts b/src/logger/axios-error.helper.ts index 4c19c13..b443d66 100644 --- a/src/logger/axios-error.helper.ts +++ b/src/logger/axios-error.helper.ts @@ -8,5 +8,6 @@ import type { AxiosError } from 'axios'; import { logger } from './index.ts'; export const axiosError = (error: any | AxiosError, customDescription: string = ''): void => { - logger.error(`Error ${customDescription}`, axios.isAxiosError(error) ? error.response?.data?.message : error.message); + const status = axios.isAxiosError(error) ? error.response?.status : undefined; + logger.error({ status }, customDescription || 'Upstream request failed'); }; diff --git a/tests/AIController.test.ts b/tests/AIController.test.ts index 69999f6..3aecdf7 100644 --- a/tests/AIController.test.ts +++ b/tests/AIController.test.ts @@ -2,6 +2,9 @@ import assert from 'node:assert/strict'; import test from 'node:test'; import type { Request, Response } from 'express'; import { query } from '../src/ai/ai.controller.ts'; +import { config } from '../src/config/index.ts'; +import { OpenAIAdapter } from '../src/ai/api-providers/OpenAIAdapter.ts'; +import { logger } from '../src/logger/index.ts'; function response() { const result = { status: 0, body: undefined as unknown }; @@ -45,3 +48,23 @@ test('oversized queries return 413 before provider selection', async () => { await query({ body: { query: 'a'.repeat(12_001) } } as Request, res); assert.equal(result.status, 413); }); + +test('valid queries use the provider without logging client metadata', async (t) => { + const previous = { ...config }; + t.after(() => Object.assign(config, previous)); + Object.assign(config, { openAiApiEnabled: true, openAiApiKey: 'test-provider-key', openAiModel: 'test-model' }); + const logs: unknown[] = []; + t.mock.method(logger, 'info', (...args: unknown[]) => logs.push(args)); + t.mock.method(OpenAIAdapter.prototype, 'query', async (text: string) => { + assert.equal(text, 'Improve this'); + return 'Improved text'; + }); + const { result, res } = response(); + await query( + { body: { query: ' Improve this ', systemInfo: { privateNote: 'private-client-marker' } } } as Request, + res + ); + assert.equal(result.status, 200); + assert.deepEqual(result.body, { content: 'Improved text', model: 'test-model', provider: 'openai' }); + assert.ok(!JSON.stringify(logs).includes('private-client-marker')); +}); diff --git a/tests/Logging.test.ts b/tests/Logging.test.ts new file mode 100644 index 0000000..3972214 --- /dev/null +++ b/tests/Logging.test.ts @@ -0,0 +1,18 @@ +import assert from 'node:assert/strict'; +import test from 'node:test'; +import { AxiosError } from 'axios'; +import { axiosError } from '../src/logger/axios-error.helper.ts'; +import { logger } from '../src/logger/index.ts'; + +test('provider failures log status without response bodies, credentials or error messages', (t) => { + const calls: unknown[] = []; + t.mock.method(logger, 'error', (...args: unknown[]) => calls.push(args)); + const error = new AxiosError('private-prompt-marker'); + Object.assign(error, { + response: { status: 502, data: { message: 'private-response-marker' } }, + config: { headers: { Authorization: 'private-credential-marker' } }, + }); + axiosError(error, 'Upstream failed'); + assert.deepEqual(calls, [[{ status: 502 }, 'Upstream failed']]); + assert.ok(!JSON.stringify(calls).includes('private-')); +}); From 15dca3475134ada3ae6f60823acf8baab57598bd Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:01:00 +1000 Subject: [PATCH 6/9] Bound Axios generation requests to avoid indefinite waits --- src/ai/api-providers/ClaudeAIAdapter.ts | 1 + src/ai/api-providers/MistralAIAdapter.ts | 1 + 2 files changed, 2 insertions(+) diff --git a/src/ai/api-providers/ClaudeAIAdapter.ts b/src/ai/api-providers/ClaudeAIAdapter.ts index 9aa9615..5304d79 100644 --- a/src/ai/api-providers/ClaudeAIAdapter.ts +++ b/src/ai/api-providers/ClaudeAIAdapter.ts @@ -26,6 +26,7 @@ export class ClaudeAIAdapter implements AIProvidable { try { const { data } = await axios.post(this.chatCompletionUrl, payload, { + timeout: 45_000, headers: { 'x-api-key': `${this.apiKey}`, 'anthropic-version': '2023-06-01', diff --git a/src/ai/api-providers/MistralAIAdapter.ts b/src/ai/api-providers/MistralAIAdapter.ts index ef893ef..515985f 100644 --- a/src/ai/api-providers/MistralAIAdapter.ts +++ b/src/ai/api-providers/MistralAIAdapter.ts @@ -40,6 +40,7 @@ export class MistralAIAdapter implements AIProvidable { ], }, } = await axios.post(this.chatCompletionUrl, payload, { + timeout: 45_000, headers, }); From 4637b715e60743f62d3b33f26c0f0451ea29fcec Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:01:00 +1000 Subject: [PATCH 7/9] Enforce HTTP boundaries with explicit proxy trust --- .env.dist | 3 + .env.railway.example | 7 +- src/app.ts | 55 ++++++++++++++ src/config/config-variables.ts | 2 + src/server.ts | 43 +---------- tests/HttpBoundary.test.ts | 130 +++++++++++++++++++++++++++++++++ 6 files changed, 198 insertions(+), 42 deletions(-) create mode 100644 src/app.ts create mode 100644 tests/HttpBoundary.test.ts diff --git a/.env.dist b/.env.dist index 925c243..d4e200a 100644 --- a/.env.dist +++ b/.env.dist @@ -40,3 +40,6 @@ LLAMA_TIMEOUT_MS=45000 # Lemonsqueezy LICENSE_CHECK_ENABLED=false LEMON_SQUEEZY_API_KEY="" + +# Leave 0 for direct access; set the exact trusted reverse-proxy hop count when deployed. +TRUST_PROXY_HOPS=0 diff --git a/.env.railway.example b/.env.railway.example index 7cd56cd..d8bd21d 100644 --- a/.env.railway.example +++ b/.env.railway.example @@ -6,7 +6,7 @@ REQUEST_BODY_LIMIT=64kb RATE_LIMIT_WINDOW_MS=900000 RATE_LIMIT_MAX=100 -# Must match Succeed AI/Config.swift apiKey in the signed macOS build. +# Shared opaque token for trusted clients of this optional proxy. JWT_SECRET= # Optional secondary token for browser-extension or internal clients. @@ -34,6 +34,9 @@ LLAMA_MODEL= LLAMA_MAX_COMPLETION_TOKENS=1200 LLAMA_TIMEOUT_MS=45000 -# Enable only after Lemon Squeezy license keys are available in the macOS app. +# Enable only for clients that send a verified Lemon Squeezy license header. LICENSE_CHECK_ENABLED=false LEMON_SQUEEZY_API_KEY= + +# Leave 0 for direct access; set the exact trusted reverse-proxy hop count when deployed. +TRUST_PROXY_HOPS=0 diff --git a/src/app.ts b/src/app.ts new file mode 100644 index 0000000..43acde9 --- /dev/null +++ b/src/app.ts @@ -0,0 +1,55 @@ +/** + * @copyright (c) Pierre-Henry Soria + * @license MIT + */ + +import express from 'express'; +import type { Express, Request, Response, NextFunction } from 'express'; +import compression from 'compression'; +import cors from 'cors'; +import rateLimit from 'express-rate-limit'; +import helmet from 'helmet'; + +import { router as mainRoutes } from './main.routes.ts'; +import { router as aiRoutes } from './ai/index.ts'; +import { authMiddleware } from './middlewares/auth.middleware.ts'; +import { config, messages } from './config/index.ts'; + +export const createApp = (): Express => { + const app: Express = express(); + + // Set rate limiter - very important to prevent abuse + const rateLimiter = rateLimit({ + windowMs: config.rateLimitWindowMs, + max: config.rateLimitMax, + }); + + app.set('trust proxy', config.trustProxyHops); + app.use(compression()); + + // Apply the rate limiting middleware to every route + // Further info about rate limiting https://en.wikipedia.org/wiki/Rate_limiting + app.use(rateLimiter); + + // Parse incoming JSON requests and add it in `req.body`. + app.use(express.json({ limit: config.requestBodyLimit })); + + app.use(helmet()); + app.use(cors()); + + app.get('/', (req: Request, res: Response) => { + res.send(messages.downloadApp); + }); + + app.use('/v1', mainRoutes); + app.use('/v1/ai', authMiddleware, aiRoutes); + + app.use((error: { status?: number }, _req: Request, res: Response, _next: NextFunction) => { + const status = error.status === 413 ? 413 : error.status === 400 ? 400 : 500; + res.status(status).json({ + message: + status === 413 ? 'Request body is too large' : status === 400 ? 'Invalid JSON payload' : 'Request failed', + }); + }); + return app; +}; diff --git a/src/config/config-variables.ts b/src/config/config-variables.ts index 4b758ff..39f3871 100644 --- a/src/config/config-variables.ts +++ b/src/config/config-variables.ts @@ -17,6 +17,7 @@ interface ConfigProps { rateLimitMax: number; jwtToken: string; browserExtensionSecret: string; + trustProxyHops: number; // Mistral AI mistralAiApiEnabled: boolean; @@ -79,6 +80,7 @@ const config: ConfigProps = { rateLimitMax: parseNumber(readEnv('RATE_LIMIT_MAX'), 100), jwtToken: readEnv('JWT_SECRET'), browserExtensionSecret: readEnv('BROWSER_EXTENSION_SECRET'), + trustProxyHops: Math.max(0, parseNumber(readEnv('TRUST_PROXY_HOPS'), 0)), mistralAiApiEnabled: parseBoolean(readEnv('MISTRAL_AI_API_ENABLED'), false), mistralAiApiKey: readEnv('MISTRAL_AI_API_KEY'), diff --git a/src/server.ts b/src/server.ts index 4cda772..e782333 100644 --- a/src/server.ts +++ b/src/server.ts @@ -3,47 +3,10 @@ * @license MIT */ -import express from 'express'; -import type { Express, Request, Response } from 'express'; -import compression from 'compression'; -import cors from 'cors'; -import rateLimit from 'express-rate-limit'; -import helmet from 'helmet'; - -import { router as mainRoutes } from './main.routes.ts'; -import { router as aiRoutes } from './ai/index.ts'; -import { authMiddleware } from './middlewares/auth.middleware.ts'; -import { config, messages } from './config/index.ts'; +import { createApp } from './app.ts'; +import { config } from './config/index.ts'; import { logger } from './logger/index.ts'; -const app: Express = express(); - -// Set rate limiter - very important to prevent abuse -const rateLimiter = rateLimit({ - windowMs: config.rateLimitWindowMs, - max: config.rateLimitMax, -}); - -app.set('trust proxy', 1); -app.use(compression()); - -// Apply the rate limiting middleware to API calls only -// Further info about rate limiting https://en.wikipedia.org/wiki/Rate_limiting -app.use(rateLimiter); - -// Parse incoming JSON requests and add it in `req.body`. -app.use(express.json({ limit: config.requestBodyLimit })); - -app.use(helmet()); -app.use(cors()); - -app.get('/', (req: Request, res: Response) => { - res.send(messages.downloadApp); -}); - -app.use('/v1', mainRoutes); -app.use('/v1/ai', authMiddleware, aiRoutes); - -app.listen(config.port, () => { +createApp().listen(config.port, () => { logger.info(`Server is running on port ${config.port}`); }); diff --git a/tests/HttpBoundary.test.ts b/tests/HttpBoundary.test.ts new file mode 100644 index 0000000..f64dabc --- /dev/null +++ b/tests/HttpBoundary.test.ts @@ -0,0 +1,130 @@ +import assert from 'node:assert/strict'; +import axios from 'axios'; +import { once } from 'node:events'; +import test from 'node:test'; +import type { AddressInfo } from 'node:net'; + +import { createApp } from '../src/app.ts'; +import { config } from '../src/config/index.ts'; +import { OpenAIAdapter } from '../src/ai/api-providers/OpenAIAdapter.ts'; + +// Node 20 type declarations do not export their callback context directly. +type TestContext = Parameters[0]>>[0]; + +async function startServer(t: TestContext, overrides: Partial = {}) { + const previous = { ...config }; + t.after(() => Object.assign(config, previous)); + Object.assign(config, { + jwtToken: 'fixture-bearer-token', + browserExtensionSecret: '', + openAiApiEnabled: true, + openAiApiKey: 'fixture-provider-key', + openAiModel: 'fixture-model', + licenseCheckEnabled: false, + trustProxyHops: 0, + rateLimitMax: 100, + ...overrides, + }); + t.mock.method(OpenAIAdapter.prototype, 'query', async () => 'Offline fixture result'); + const server = createApp().listen(0, '127.0.0.1'); + await once(server, 'listening'); + t.after(async () => { + server.closeAllConnections(); + await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve()))); + }); + return `http://127.0.0.1:${(server.address() as AddressInfo).port}`; +} + +test('the actual HTTP query route authenticates before returning a fixture prediction', async (t) => { + const base = await startServer(t); + const payload = { + method: 'POST', + body: JSON.stringify({ query: 'Improve this' }), + headers: { 'Content-Type': 'application/json' }, + }; + const denied = await fetch(`${base}/v1/ai/query`, payload); + assert.equal(denied.status, 401); + await denied.text(); + const allowed = await fetch(`${base}/v1/ai/query`, { + ...payload, + headers: { ...payload.headers, Authorization: 'Bearer fixture-bearer-token' }, + }); + assert.equal(allowed.status, 200); + assert.deepEqual(await allowed.json(), { + content: 'Offline fixture result', + model: 'fixture-model', + provider: 'openai', + }); +}); + +test('unconfigured authentication fails closed while health remains available', async (t) => { + const base = await startServer(t, { jwtToken: '', browserExtensionSecret: '' }); + const response = await fetch(`${base}/v1/ai/query`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: '{}', + }); + assert.equal(response.status, 503); + await response.text(); + const health = await fetch(`${base}/v1/health`); + assert.equal(health.status, 200); + await health.json(); +}); + +test('invalid JSON and body size errors return generic JSON without payload contents', async (t) => { + const base = await startServer(t); + for (const [body, status] of [ + ['{"private-marker":', 400], + [JSON.stringify({ query: 'a'.repeat(70_000) }), 413], + ] as const) { + const response = await fetch(`${base}/v1/ai/query`, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body, + }); + assert.equal(response.status, status); + const text = await response.text(); + assert.doesNotThrow(() => JSON.parse(text)); + assert.ok(!text.includes('private-marker')); + assert.ok(!text.includes('stack')); + } +}); + +test('legacy token minting is explicitly unavailable', async (t) => { + const base = await startServer(t); + const response = await fetch(`${base}/v1/token-generator`, { method: 'POST' }); + assert.equal(response.status, 410); + assert.equal('token' in (await response.json()), false); +}); + +test('spoofed forwarded addresses cannot bypass a direct-access rate limit', async (t) => { + const base = await startServer(t, { rateLimitMax: 2 }); + for (let index = 0; index < 3; index++) { + const response = await fetch(`${base}/v1/health`, { headers: { 'X-Forwarded-For': `192.0.2.${index + 1}` } }); + assert.equal(response.status, index < 2 ? 200 : 429); + await response.text(); + } +}); + +test('enabled licensing accepts only an exact active license header', async (t) => { + const base = await startServer(t, { licenseCheckEnabled: true, lemonSqueezyApiKey: 'fixture-license-api-key' }); + let calls = 0; + t.mock.method(axios, 'get', async () => { + calls += 1; + return { data: { data: { attributes: { status: 'active', key: 'fixture-license-key' } } } }; + }); + for (const [license, status] of [ + ['', 401], + ['7:fixture-license-key:extra', 401], + ['7:fixture-license-key', 200], + ] as const) { + const response = await fetch(`${base}/v1/ai/query`, { + method: 'POST', + headers: { 'Content-Type': 'application/json', Authorization: 'Bearer fixture-bearer-token', License: license }, + body: JSON.stringify({ query: 'Improve this' }), + }); + assert.equal(response.status, status); + await response.text(); + } + assert.equal(calls, 1); +}); From 7d2e37ea5ea7fe0b5cee8ad7b42e64d7736f6cba Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:01:01 +1000 Subject: [PATCH 8/9] Ignore local environment variants to prevent credential commits --- .gitignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitignore b/.gitignore index 6c1cf25..17a94b4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,9 @@ # Distribution dist .env +.env.* +!.env.dist +!.env.railway.example # Package manager node_modules From da2121c26b5503cd2e5b819c163002ea1e9ec82d Mon Sep 17 00:00:00 2001 From: Pierre-Henry Soria Date: Sun, 13 Sep 2026 00:01:01 +1000 Subject: [PATCH 9/9] Document the optional proxy contract for current clients --- readme.md | 53 +++++++++++++++++++++++++++++++++++------------------ 1 file changed, 35 insertions(+), 18 deletions(-) diff --git a/readme.md b/readme.md index 14d4ed2..01eb974 100644 --- a/readme.md +++ b/readme.md @@ -1,8 +1,8 @@ # AI Proxy Server for Secure Client Applications -**SucceedAI Proxy API** securely connects the **SucceedAI macOS app** to **AI provider APIs** while keeping **private API keys** off the client. +**SucceedAI Proxy API** is the historical, optional server for trusted clients that call external AI providers. Provider API keys stay on the server. Current SucceedAI Mac, iPhone and iPad apps use Appleโ€™s on-device model and do not call this proxy. -Supported providers ๐Ÿš€ +Included provider adapters ๐Ÿš€ - **OpenAI** (default) - **Meta Llama** @@ -16,13 +16,13 @@ Provider and security settings are documented in `.env.dist`. Requires Node.js 22.18 or newer. 1. Copy `.env.dist` to `.env` and add your credentials. -2. Run `npm install`. +2. Run `npm ci`. 3. Run `npm run dev` to start the server in watch mode. ### Other Commands - `npm start`: start the server normally. -- `npm run prod`: start in production mode. +- `npm run prod`: alias for `npm start`; set `NODE_ENV=production` in the deployment environment. - `npm run build`: validate the TypeScript build. - `npm run typecheck`: check TypeScript without running the server. - `npm test`: run the tests. @@ -37,24 +37,41 @@ Railway uses the included `railway.json` configuration: - Health check: `/v1/health` - Restart policy: `ON_FAILURE` -Recommended setup: +Configure credentials through your deployment environment's secret settings, using `.env.railway.example` as the variable checklist. Never put provider keys in clients or Git. Set `NODE_ENV=production` when deploying. -```bash -railway variables set NODE_ENV=production -railway variables set JWT_SECRET= -railway variables set OPENAI_API_KEY= -railway variables set OPENAI_MODEL=gpt-5.2 -railway up -``` +`TRUST_PROXY_HOPS` defaults to `0` for direct access. Behind a reverse proxy, set it only to the verified number of trusted hops on every route to this server. Do not blindly trust client-supplied forwarding headers. Incorrect proxy settings can defeat IP-based rate limiting. + +## Request contract + +Send `POST /v1/ai/query` with `Authorization: Bearer ` and a JSON body such as `{"query":"Make this sentence clearer"}`. Queries must be nonempty strings of at most 12,000 characters. The default whole-body limit is 64 KB. A successful response includes `content`, `provider` and `model`. + +- Missing or invalid authentication returns 401; unconfigured authentication returns 503. +- Invalid query types or malformed JSON return 400, and oversized input returns 413. +- Provider failures return a generic 500 response. Provider health, credentials and model availability require separate live verification. +- `/v1/health` is a lightweight configuration/liveness check; it does not call providers or prove they can generate a result. +- `/v1/token-generator` returns 410. It formerly issued JWTs that the actual authentication middleware never accepted. + +## Security and licensing -Use `.env.railway.example` as the deployment checklist. Do not commit `.env`. +`JWT_SECRET` is a historical variable name for an **opaque shared bearer token**, not a JWT signing secret. `BROWSER_EXTENSION_SECRET` may supply a second accepted token. At least one nonempty token is required to use AI routes. A token embedded in a distributed client is extractable; this mechanism is not per-user authentication or a complete public-service access model. + +License checks are optional and disabled by default. When enabled, configure `LEMON_SQUEEZY_API_KEY` and send exactly `License: :`. The existing policy accepts only an `active` key matching the retrieved resource. It does not activate licenses or establish product-specific entitlements. Response parsing follows [Lemon Squeezy's retrieve-license-key contract](https://docs.lemonsqueezy.com/api/license-keys/retrieve-license-key). + +Logs omit prompts, client-supplied system information, credentials and upstream response bodies. Provider error logs contain generic events or HTTP status. Axios-based generation requests are bounded to 45 seconds, and license requests to 5 seconds; OpenAI and Llama retain their configured timeout values. + +## Validation + +```sh +npm ci +npm run build +npm test +npm run prettier:check +npm audit +``` -## Security +Tests use synthetic fixtures, in-memory provider mocks and temporary localhost HTTP servers. They do not call AI or licensing services. The `express` โ†’ `qs` override selects the patched 6.16 line because Express 4.22.2 pins the vulnerable 6.15 line; revisit it when Express updates its dependency range. -- `JWT_SECRET` must not be empty in Railway. -- `OPENAI_API_KEY` must exist only in Railway or local `.env`. -- License checks are optional and disabled by default. -- When enabled, requests must include `License: :`. +This audit changes source only. It does not deploy Railway, rotate credentials, enable billing or restore a backend dependency in the native apps. ## Author