fix: Node low-severity security hardening bundle (timing oracle, sharp DoS, dependabot, deps, audit)#3876

Merged

PierreBrisorgueil merged 7 commits into

fix/node-hardening-bundle

Jun 15, 2026

Commits on Jun 15, 2026

fix(auth): equalise login timing on unknown-user path (account enumeration)
PierreBrisorgueil
committed
fix(uploads): rate-limit the public sharp image route (cpu-exhaustion dos)
PierreBrisorgueil
committed
ci(dependabot): restrict auto-merge to patch updates only
PierreBrisorgueil
committed
chore(deps): move test/dev tooling to devDependencies
PierreBrisorgueil
committed
chore(deps): npm audit fix — clear all advisories, document dos-class residual reasoning
PierreBrisorgueil
committed
test(auth): assert dummy-hash argument shape in anti-enumeration timing test
PierreBrisorgueil
committed
docs(uploads): add @param and @returns to uploads route registrar (JSDoc compliance)
PierreBrisorgueil
committed