fix: update dependencies and fix compatibility issues

- Update security audit documentation to recommend bun audit instead of npm audit
- Update dependencies to latest versions (Zod 4.x, Express 5.x, and others)
- Fix Zod 4.x breaking changes:
  - Replace error.errors with error.issues in auth route
  - Update z.record() API to require key and value schemas
  - Update uuid validation to use z.uuid() for direct UUID validation
- Fix Express 5.x compatibility issues:
  - Add type assertion for passport.initialize() middleware
  - Replace app.get('*') with app.use() for 404 handler
- Run security audit and fix vulnerabilities (reduced from 10 to 2 moderate issues)

Author: Rabithua

doc/develop/SECURITY-AUDIT.md

@@ -517,7 +517,7 @@ username: z
 
 ---
 
-### 3.4 缺少安全响应头
+### 3.4 缺少安全响应头（可以忽略）
 
 **问题描述**:
 没有设置重要的安全响应头，如：
@@ -539,9 +539,12 @@ username: z
 
 **建议**:
 
-1. 定期运行 `npm audit` 检查依赖漏洞
-2. 使用 `npm audit fix` 修复已知漏洞
-3. 考虑使用 Snyk 或 Dependabot 进行持续监控
+1. 定期运行 `bun audit` 检查依赖漏洞（Bun 内置安全审计功能，推荐使用）
+2. 使用 `bun update` 更新所有依赖到最新兼容版本，或使用 `bun update --latest` 更新到最新版本（包括破坏性更新）
+3. 考虑使用 Snyk 或 Dependabot 进行持续监控和自动更新
+4. 定期检查依赖包的更新日志和安全公告
+
+**注意**: 由于项目使用 `bun.lock` 作为锁文件，`npm audit` 无法直接使用（需要 `package-lock.json`）。建议统一使用 `bun audit` 进行安全审计。
 
 ### 4.2 环境变量管理
 

server/bun.lock

@@ -21,40 +21,40 @@
   "author": "rabithua",
   "license": "ISC",
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.484.0",
-    "@aws-sdk/s3-request-presigner": "^3.484.0",
-    "@prisma/client": "^6.10.1",
-    "@types/cors": "^2.8.17",
-    "@types/express": "^4.17.21",
-    "@types/formidable": "^3.4.5",
-    "@types/node": "^20.9.1",
-    "@types/passport": "^1.0.16",
+    "@aws-sdk/client-s3": "^3.932.0",
+    "@aws-sdk/s3-request-presigner": "^3.932.0",
+    "@prisma/client": "^6.19.0",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.5",
+    "@types/formidable": "^3.4.6",
+    "@types/node": "^24.10.1",
+    "@types/passport": "^1.0.17",
     "@types/passport-local": "^1.0.38",
-    "@types/web-push": "^3.6.3",
-    "aws-sdk": "^2.1528.0",
-    "body-parser": "^1.20.2",
+    "@types/web-push": "^3.6.4",
+    "aws-sdk": "^2.1692.0",
+    "body-parser": "^2.2.0",
     "cors": "^2.8.5",
-    "eslint": "^8.56.0",
-    "express": "^4.18.2",
-    "feed": "^5.0.1",
-    "formidable": "^3.5.1",
-    "jose": "^6.0.11",
-    "moment": "^2.29.4",
+    "eslint": "^9.39.1",
+    "express": "^5.1.0",
+    "feed": "^5.1.0",
+    "formidable": "^3.5.4",
+    "jose": "^6.1.1",
+    "moment": "^2.30.1",
     "passport": "^0.7.0",
     "passport-local": "^1.0.0",
-    "rate-limiter-flexible": "^4.0.1",
-    "sharp": "^0.32.6",
-    "web-push": "^3.6.6",
-    "zod": "^3.23.8"
+    "rate-limiter-flexible": "^8.2.1",
+    "sharp": "^0.34.5",
+    "web-push": "^3.6.7",
+    "zod": "^4.1.12"
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^2.6.3",
-    "axios": "^1.7.7",
-    "dotenv": "^16.5.0",
-    "nodemon": "^3.0.1",
-    "prettier": "^3.5.3",
-    "prisma": "^6.10.1",
+    "@antfu/eslint-config": "^6.2.0",
+    "axios": "^1.13.2",
+    "dotenv": "^17.2.3",
+    "nodemon": "^3.1.11",
+    "prettier": "^3.6.2",
+    "prisma": "^6.19.0",
     "ts-node": "^10.9.2",
-    "typescript": "^5.3.0"
+    "typescript": "^5.9.3"
   }
 }

server/package.json

@@ -84,7 +84,7 @@ authRouter.put(
 
     const zodData = passwordChangeZod.safeParse(req.body);
     if (zodData.success === false) {
-      throw new Error(zodData.error.errors[0].message);
+      throw new Error(zodData.error.issues[0].message);
     }
 
     const updatedUser = await changeUserPassword(oldpassword, newpassword, user.id);

server/route/v2/auth.ts

@@ -32,7 +32,7 @@ app.use(injectDynamicUrls);
 app.use(rateLimiterMiddleware);
 
 // Initialize Passport
-app.use(passport.initialize());
+app.use(passport.initialize() as unknown as express.RequestHandler);
 
 // body parser
 app.use(
@@ -115,7 +115,8 @@ app.use('/v2/api', routerV2); // RESTful API
 // Global error handler (must be after all routes)
 app.use(errorHandler);
 
-app.get('*', (req, res) => {
+// 404 handler - Express 5.x requires explicit path pattern
+app.use((req, res) => {
   res.status(404).send({
     code: 1,
     message: 'Api not found!',

server/server.ts

@@ -82,10 +82,10 @@ export const SearchKeywordZod = z.object({
 // 反应相关验证
 export const ReactionCreateZod = z.object({
   type: z.string().min(1, '反应类型不能为空').max(50, '反应类型不能超过 50 个字符'), // emoji 通常很短，但留一些余量
-  roteid: z.string().uuid('无效的笔记 ID'),
+  roteid: z.uuid('无效的笔记 ID'),
   visitorId: z.string().max(200, '访客 ID 不能超过 200 个字符').optional(),
-  visitorInfo: z.record(z.any()).optional(),
-  metadata: z.record(z.any()).optional(),
+  visitorInfo: z.record(z.string(), z.any()).optional(),
+  metadata: z.record(z.string(), z.any()).optional(),
 });
 
 // 附件文件名验证

server/utils/zod.ts

@@ -14,90 +14,90 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@dr.pogodin/react-helmet": "^3.0.2",
-    "@radix-ui/react-avatar": "^1.1.10",
-    "@radix-ui/react-checkbox": "^1.3.2",
-    "@radix-ui/react-dialog": "^1.1.14",
-    "@radix-ui/react-dropdown-menu": "^2.1.15",
-    "@radix-ui/react-label": "^2.1.7",
-    "@radix-ui/react-popover": "^1.1.14",
-    "@radix-ui/react-scroll-area": "^1.2.9",
-    "@radix-ui/react-select": "^2.2.5",
-    "@radix-ui/react-slot": "^1.2.3",
-    "@radix-ui/react-switch": "^1.2.5",
+    "@dr.pogodin/react-helmet": "^3.0.4",
+    "@radix-ui/react-avatar": "^1.1.11",
+    "@radix-ui/react-checkbox": "^1.3.3",
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-label": "^2.1.8",
+    "@radix-ui/react-popover": "^1.1.15",
+    "@radix-ui/react-scroll-area": "^1.2.10",
+    "@radix-ui/react-select": "^2.2.6",
+    "@radix-ui/react-slot": "^1.2.4",
+    "@radix-ui/react-switch": "^1.2.6",
     "@radix-ui/react-tabs": "^1.1.13",
-    "@radix-ui/react-toggle": "^1.1.9",
-    "@radix-ui/react-toggle-group": "^1.1.10",
-    "@radix-ui/react-tooltip": "^1.2.7",
+    "@radix-ui/react-toggle": "^1.1.10",
+    "@radix-ui/react-toggle-group": "^1.1.11",
+    "@radix-ui/react-tooltip": "^1.2.8",
     "@tailwindcss/aspect-ratio": "^0.4.2",
-    "@tailwindcss/typography": "^0.5.16",
-    "@tailwindcss/vite": "^4.1.7",
+    "@tailwindcss/typography": "^0.5.19",
+    "@tailwindcss/vite": "^4.1.17",
     "@types/file-saver": "^2.0.7",
-    "@types/lodash": "^4.17.17",
+    "@types/lodash": "^4.17.20",
     "@types/react-avatar-editor": "^13.0.4",
-    "@zumer/snapdom": "^1.7.1",
-    "axios": "^1.9.0",
+    "@zumer/snapdom": "^1.9.14",
+    "axios": "^1.13.2",
     "browser-image-compression": "^2.0.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "file-saver": "^2.0.5",
-    "i18next": "^25.2.0",
-    "isbot": "^5.1.27",
-    "jotai": "^2.12.4",
+    "i18next": "^25.6.2",
+    "isbot": "^5.1.32",
+    "jotai": "^2.15.1",
     "jwt-decode": "^4.0.0",
-    "linkify-react": "^4.3.1",
-    "linkifyjs": "^4.3.1",
+    "linkify-react": "^4.3.2",
+    "linkifyjs": "^4.3.2",
     "lodash": "^4.17.21",
-    "lucide-react": "^0.511.0",
+    "lucide-react": "^0.553.0",
     "mobile-detect": "^1.4.5",
     "moment": "^2.30.1",
-    "motion": "^12.15.0",
+    "motion": "^12.23.24",
     "next-themes": "^0.4.6",
-    "radix-ui": "^1.4.2",
-    "react": "^19.1.0",
-    "react-dom": "^19.1.0",
-    "react-easy-crop": "^5.4.2",
-    "react-i18next": "^15.5.3",
-    "react-intersection-observer": "^9.16.0",
+    "radix-ui": "^1.4.3",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-easy-crop": "^5.5.3",
+    "react-i18next": "^16.3.3",
+    "react-intersection-observer": "^10.0.0",
     "react-photo-view": "^1.2.7",
-    "react-qr-code": "^2.0.17",
-    "react-router": "^7.5.3",
-    "react-router-dom": "^7.6.0",
+    "react-qr-code": "^2.0.18",
+    "react-router": "^7.9.6",
+    "react-router-dom": "^7.9.6",
     "react-use-measure": "^2.1.7",
-    "sonner": "^2.0.5",
-    "swr": "^2.3.3",
-    "tailwind-merge": "^3.3.0",
-    "tailwindcss": "^4.1.7",
+    "sonner": "^2.0.7",
+    "swr": "^2.3.6",
+    "tailwind-merge": "^3.4.0",
+    "tailwindcss": "^4.1.17",
     "vaul": "^1.1.2",
-    "zod": "^3.25.28"
+    "zod": "^4.1.12"
   },
   "devDependencies": {
-    "@eslint/js": "^9.25.0",
-    "@types/node": "^22.15.21",
-    "@types/react": "^19.1.2",
-    "@types/react-dom": "^19.1.2",
-    "@typescript-eslint/eslint-plugin": "^8.32.1",
-    "@typescript-eslint/parser": "^8.32.1",
-    "@vitejs/plugin-react-swc": "^3.9.0",
-    "cross-env": "^7.0.3",
-    "dotenv": "^16.5.0",
-    "eslint": "^9.25.0",
-    "eslint-config-prettier": "^10.1.5",
-    "eslint-plugin-prettier": "^5.4.0",
+    "@eslint/js": "^9.39.1",
+    "@types/node": "^24.10.1",
+    "@types/react": "^19.2.5",
+    "@types/react-dom": "^19.2.3",
+    "@typescript-eslint/eslint-plugin": "^8.46.4",
+    "@typescript-eslint/parser": "^8.46.4",
+    "@vitejs/plugin-react-swc": "^4.2.2",
+    "cross-env": "^10.1.0",
+    "dotenv": "^17.2.3",
+    "eslint": "^9.39.1",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.4",
     "eslint-plugin-react": "^7.37.5",
-    "eslint-plugin-react-hooks": "^5.2.0",
-    "eslint-plugin-react-refresh": "^0.4.19",
-    "eslint-plugin-react-you-might-not-need-an-effect": "^0.0.39",
-    "eslint-plugin-tailwindcss": "^3.18.0",
-    "globals": "^16.0.0",
-    "prettier": "^3.5.3",
-    "prettier-plugin-tailwindcss": "^0.6.11",
-    "tw-animate-css": "^1.3.0",
-    "typescript": "~5.8.3",
-    "typescript-eslint": "^8.30.1",
-    "vite": "^6.3.5",
-    "vite-plugin-pwa": "^1.0.3",
+    "eslint-plugin-react-hooks": "^7.0.1",
+    "eslint-plugin-react-refresh": "^0.4.24",
+    "eslint-plugin-react-you-might-not-need-an-effect": "^0.7.0",
+    "eslint-plugin-tailwindcss": "^3.18.2",
+    "globals": "^16.5.0",
+    "prettier": "^3.6.2",
+    "prettier-plugin-tailwindcss": "^0.7.1",
+    "tw-animate-css": "^1.4.0",
+    "typescript": "~5.9.3",
+    "typescript-eslint": "^8.46.4",
+    "vite": "^7.2.2",
+    "vite-plugin-pwa": "^1.1.0",
     "vite-tsconfig-paths": "^5.1.4",
     "workbox-window": "^7.3.0"
   }