v1.2.3 - fix(security): patch CVE-2026-39244 - adm-zip DoS via crafted archive
🔒 Security
- adm-zip ^0.5.16 -> ^0.6.0 (lock: 0.5.17 -> 0.6.0; shipped images carried 0.5.18 - all in the vulnerable <0.6.0 range)
- CVE-2026-39244 (CVSS 7.5 High, DoS): a crafted ZIP declaring an inflated uncompressed size forces an unbounded Buffer.alloc during extraction, OOM-crashing the Node process - directly relevant here because CBZ archives arrive from untrusted sources (downloads, watched folders) by design
- Engine unaffected (Rust zip crate); web container only
🧪 Compatibility (verified before shipping)
- 0.6.0's three breaking changes (extractEntryTo path handling, extraction utimes, Node<14) all land on API Omnibus never calls; our surface (getEntries/getEntry/getData/addFile/writeZip) is untouched core
- Bonus fixes we inherit: valid data-descriptor archives no longer wrongly rejected; getEntry hardened against proto name injection (we pass request-supplied page names into it)
- Zero runtime dependencies in 0.6.0 - no new supply-chain surface
✅ Verification
- Dry-run first: 0.6.0 installed --no-save, full vitest 388/388 on dev incl. real-archive round-trips, then reverted
- On main: tsc clean; vitest 376/376; next build OK
- npm audit: adm-zip high clears with this bump; remaining pre-existing advisories (form-data, nodemailer, undici, next-auth chain) tracked separately for a dev dependency-refresh pass - deliberately NOT bundled into this stable hotfix