v0.0.5 Summer breeze
Bug Fixes
- Fixed CI/CD Failure: Downgraded
uuid from 14.0.0 to 11.1.1 to resolve ESM/CommonJS compatibility issue that was causing test failures
Security Fixes
- CVE-2025-57282 (High): Removed
ngrok dependency due to command injection vulnerability with no patched version available
- GHSA-5c6j-r48x-rmvq (High): Fixed RCE vulnerability in
serialize-javascript via RegExp.flags and Date.prototype.toISOString()
- GHSA-qj8w-gfj5-8c6v (Moderate): Fixed CPU Exhaustion DoS in
serialize-javascript via crafted array-like objects
- GHSA-w5hq-g745-h8pq (Moderate): Fixed buffer bounds check in
uuid v3/v5/v6 when buf is provided
- Forced
serialize-javascript to ^7.0.5 via npm overrides
- Updated
uuid to 11.1.1 across all package.json files
Dependency Updates
- Bump axios from 1.10.0 to 1.16.0
- Bump nodemailer from 6.10.1 to 7.0.7
- Bump dompurify from 3.2.6 to 3.4.0
- Bump ws, engine.io and socket.io-adapter
- Bump brace-expansion
- Multiple uuid bumps in demo servers
Code Changes
- Made ngrok optional in Server.js with graceful fallback
- Commented out room_info check and supabase integration
- Adjusted default API secrets
- Modified links from hivetalk.org to vanilla.hivetalk.org
Previous Changes Since v0.0.4
- Renamed SFU to Vanilla branding
- Added HiveTalk honey links
- Added blink feature
- Updated notification content
- Adjusted UI buttons
- Added logo.png to directories
- Fixed dead endpoints
- Updated nostr.json configurations
Breaking Changes
- ngrok removed: Users who need ngrok tunneling must install it manually:
npm install ngrok
Note: ngrok has known security vulnerabilities (CVE-2025-57282)
---
**Full Changelog**: https://github.com/HiveTalk/hivetalksfu/compare/v0.0.4...v0.0.5
## Tracked CVEs
- **CVE-2025-57282**
