Fix high/critical Dependabot vulnerabilities in client and server

client/package.json

@@ -49,5 +49,21 @@
     "vite": "^6.3.6",
     "vite-plugin-vuetify": "^2.1.1",
     "vue-tsc": "^2.2.10"
+  },
+  "resolutions": {
+    "axios": "^1.16.0",
+    "brace-expansion": "^2.1.2",
+    "flatted": "^3.4.2",
+    "form-data": "^4.0.6",
+    "immutable": "^5.1.8",
+    "js-yaml": "^4.3.0",
+    "lodash": "^4.18.0",
+    "lodash-es": "^4.18.0",
+    "minimatch": "^9.0.7",
+    "postcss": "^8.5.12",
+    "rollup": "^4.59.0",
+    "socket.io-parser": "^4.2.6",
+    "vite": "^6.4.3",
+    "ws": "^8.21.0"
   }
 }

server/package.json

@@ -57,6 +57,7 @@
     "bitbucket": "^2.12.0",
     "cross-fetch": "^4.1.0",
     "dotenv": "^16.4.7",
+    "form-data": "^2.5.4",
     "git-url-parse": "^16.0.0",
     "gitea-js": "^1.23.0",
     "helmet": "^8.0.0",
@@ -111,7 +112,8 @@
   },
   "resolutions": {
     "**/request/form-data": "^2.5.4",
-    "handlebars": "^4.7.9"
+    "handlebars": "^4.7.9",
+    "tar": "^7.5.19"
   },
   "jest": {
     "moduleFileExtensions": [

server/src/auth/auth.module.ts

@@ -35,7 +35,8 @@ if (ConfigService.getGithubEnabled()) {
         process.env.JWT_SECRET ||
         'DO NOT USE THIS VALUE. INSTEAD, CREATE A COMPLEX SECRET AND KEEP IT SAFE OUTSIDE OF THE SOURCE CODE.',
       signOptions: {
-        expiresIn: process.env.JWT_EXPIRESIN || '36000s',
+        // env value is a string; jsonwebtoken's expiresIn type is number | ms.StringValue
+        expiresIn: (process.env.JWT_EXPIRESIN || '36000s') as any,
       },
     }),
   ],

server/src/auth/auth.service.ts

@@ -156,7 +156,8 @@ export class AuthService {
       secret:
         process.env.JWT_SECRET ||
         'DO NOT USE THIS VALUE. INSTEAD, CREATE A COMPLEX SECRET AND KEEP IT SAFE OUTSIDE OF THE SOURCE CODE.',
-      expiresIn: process.env.JWT_EXPIRESIN || '36000s',
+      // env value is a string; jsonwebtoken's expiresIn type is number | ms.StringValue
+      expiresIn: (process.env.JWT_EXPIRESIN || '36000s') as any,
     });
     return token;
   }

server/src/users/users.service.ts

@@ -437,7 +437,8 @@ export class UsersService {
     if (response.status !== 200) {
       throw new Error(`Failed to fetch image from URL: ${imageUrl}`);
     }
-    const mimetype = response.headers['content-type'] || 'image/jpeg'; // Default to jpeg if not specified
+    // axios types content-type as a union (string | number | string[] | AxiosHeaders); coerce to string
+    const mimetype = String(response.headers['content-type'] || 'image/jpeg'); // Default to jpeg if not specified
     if (!mimetype.startsWith('image/')) {
       throw new Error(`Invalid image MIME type: ${mimetype}`);
     }