e42853a046
Proxmox ships with a self-signed cert by default, which Node's fetch rejected outright; route Proxmox requests through an undici Agent with rejectUnauthorized disabled so real Proxmox hosts can be connected. Also bump @fastify/jwt to v10, which pulls in a patched fast-jwt and resolves the critical advisories (crit-header bypass, algorithm confusion, cache collision, ReDoS, empty-HMAC-secret auth bypass) that npm audit flagged on the old v9/fast-jwt<=6.2.3 pairing. Verified auth still works end-to-end (setup, valid token, rejected bad token) after the upgrade; npm audit now reports 0 vulnerabilities. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BbJV5nm8KPVH1oNJYKpnoF
32 lines
766 B
JSON
32 lines
766 B
JSON
{
|
|
"name": "archnest-backend",
|
|
"private": true,
|
|
"version": "0.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "tsx watch src/server.ts",
|
|
"build": "tsc -b",
|
|
"start": "node dist/server.js"
|
|
},
|
|
"dependencies": {
|
|
"@aws-sdk/client-ec2": "^3.1072.0",
|
|
"@aws-sdk/client-sts": "^3.1072.0",
|
|
"@fastify/cors": "^10.0.1",
|
|
"@fastify/jwt": "^10.1.0",
|
|
"@types/ssh2": "^1.15.5",
|
|
"bcryptjs": "^2.4.3",
|
|
"better-sqlite3": "^11.8.1",
|
|
"dotenv": "^16.6.1",
|
|
"fastify": "^5.2.1",
|
|
"ssh2": "^1.17.0",
|
|
"undici": "^8.5.0",
|
|
"zod": "^3.24.1"
|
|
},
|
|
"devDependencies": {
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"@types/better-sqlite3": "^7.6.12",
|
|
"@types/node": "^22.10.5",
|
|
"tsx": "^4.19.2",
|
|
"typescript": "^5.7.3"
|
|
}
|
|
}
|