Dependency Updates and Bug Fixes

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skysend/cli",
-  "version": "2.11.2",
+  "version": "2.11.3",
   "private": true,
   "type": "module",
   "bin": {
@@ -14,12 +14,12 @@
   },
   "dependencies": {
     "@skysend/server": "workspace:*",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "drizzle-orm": "^0.45.2"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^25.7.0",
-    "tsx": "^4.22.0"
+    "@types/node": "^26.0.0",
+    "tsx": "^4.22.4"
   }
 }

apps/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skysend/client",
-  "version": "2.11.2",
+  "version": "2.11.3",
   "private": true,
   "type": "module",
   "bin": {
@@ -23,19 +23,19 @@
   },
   "dependencies": {
     "@skysend/crypto": "workspace:*",
-    "commander": "^14.0.3",
-    "fflate": "^0.8.2",
+    "commander": "^15.0.0",
+    "fflate": "^0.8.3",
     "hash-wasm": "^4.12.0",
-    "ink": "^7.0.3",
+    "ink": "^7.1.0",
     "qrcode": "^1.5.4",
-    "react": "^19.2.6",
+    "react": "^19.2.7",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^25.7.0",
+    "@types/node": "^26.0.0",
     "@types/qrcode": "^1.5.6",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.17",
     "react-devtools-core": "file:stubs/react-devtools-core",
-    "tsx": "^4.22.0"
+    "tsx": "^4.22.4"
   }
 }

apps/client/src/version.ts

@@ -1,2 +1,2 @@
 // Auto-synced by scripts/sync-version.sh - do not edit manually
-export const APP_VERSION = "2.11.2";
+export const APP_VERSION = "2.11.3";

apps/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skysend/server",
-  "version": "2.11.2",
+  "version": "2.11.3",
   "private": true,
   "type": "module",
   "exports": {
@@ -37,23 +37,23 @@
     "db:studio": "drizzle-kit studio"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1046.0",
-    "@aws-sdk/lib-storage": "^3.1046.0",
-    "@aws-sdk/s3-request-presigner": "^3.1046.0",
-    "@hono/node-server": "^2.0.2",
+    "@aws-sdk/client-s3": "^3.1073.0",
+    "@aws-sdk/lib-storage": "^3.1073.0",
+    "@aws-sdk/s3-request-presigner": "^3.1073.0",
+    "@hono/node-server": "^2.0.5",
     "@hono/node-ws": "^1.3.1",
     "@skysend/crypto": "workspace:*",
-    "better-sqlite3": "^12.10.0",
+    "better-sqlite3": "^12.11.1",
     "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.18",
+    "hono": "^4.12.26",
     "jose": "^6.2.3",
     "openid-client": "^6.8.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^25.7.0",
+    "@types/node": "^26.0.0",
     "drizzle-kit": "^0.31.10",
-    "tsx": "^4.22.0"
+    "tsx": "^4.22.4"
   }
 }

apps/server/src/index.ts

@@ -412,9 +412,20 @@ const server = serve(
 //   large file uploads over slow connections can legitimately take many hours.
 //   The reverse proxy (Nginx/Caddy/Traefik) should handle overall connection timeouts.
 // - timeout: 0 (disabled) - socket inactivity handled by Node.js keep-alive defaults.
+// - keepAliveTimeout: 120s. Node's default is only 5s, which is shorter than the
+//   backend idle-connection timeout of every common reverse proxy (Traefik defaults
+//   to 90s). When Node closes a pooled keep-alive connection first, the proxy still
+//   believes it is usable and sends the next request into the closing socket, which
+//   surfaces as an intermittent 500/502 for whichever asset lands on the dead
+//   connection - only via the proxy, never on direct access, and only cured by
+//   recreating the proxy's connection pool. Keeping Node's timeout longer than the
+//   proxy's ensures the proxy always controls connection lifecycle. Since Node 18
+//   headersTimeout counts only from the start of an active request, so it stays an
+//   effective Slowloris defense even though it is now shorter than keepAliveTimeout.
 const nodeServer = server as unknown as import("node:http").Server;
 nodeServer.headersTimeout = 60_000;
 nodeServer.requestTimeout = 0;
+nodeServer.keepAliveTimeout = 120_000;
 
 // Attach the WebSocket adapter so /api/upload/ws can accept upgrade requests.
 if (config.FILE_UPLOAD_WS && config.ENABLED_SERVICES.includes("file")) {

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skysend/web",
-  "version": "2.11.2",
+  "version": "2.11.3",
   "private": true,
   "type": "module",
   "scripts": {
@@ -12,50 +12,50 @@
     "typecheck": "tsc -b --noEmit"
   },
   "dependencies": {
-    "@radix-ui/react-dialog": "^1.1.15",
-    "@radix-ui/react-dropdown-menu": "^2.1.16",
-    "@radix-ui/react-label": "^2.1.8",
-    "@radix-ui/react-progress": "^1.1.8",
-    "@radix-ui/react-scroll-area": "^1.2.10",
-    "@radix-ui/react-select": "^2.2.6",
-    "@radix-ui/react-slot": "^1.2.4",
-    "@radix-ui/react-switch": "^1.2.6",
-    "@radix-ui/react-toast": "^1.2.15",
-    "@radix-ui/react-tooltip": "^1.2.8",
+    "@radix-ui/react-dialog": "^1.1.17",
+    "@radix-ui/react-dropdown-menu": "^2.1.18",
+    "@radix-ui/react-label": "^2.1.10",
+    "@radix-ui/react-progress": "^1.1.10",
+    "@radix-ui/react-scroll-area": "^1.2.12",
+    "@radix-ui/react-select": "^2.3.1",
+    "@radix-ui/react-slot": "^1.3.0",
+    "@radix-ui/react-switch": "^1.3.1",
+    "@radix-ui/react-toast": "^1.2.17",
+    "@radix-ui/react-tooltip": "^1.2.10",
     "@skysend/crypto": "workspace:*",
-    "@tailwindcss/typography": "^0.5.19",
+    "@tailwindcss/typography": "^0.5.20",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "dompurify": "^3.4.3",
-    "fflate": "^0.8.2",
+    "dompurify": "^3.4.11",
+    "fflate": "^0.8.3",
     "flag-icons": "^7.5.0",
     "hash-wasm": "^4.12.0",
     "highlight.js": "^11.11.1",
-    "i18next": "^26.1.0",
+    "i18next": "^26.3.1",
     "i18next-browser-languagedetector": "^8.2.1",
-    "idb-keyval": "^6.2.2",
-    "lucide-react": "^1.16.0",
+    "idb-keyval": "^6.2.5",
+    "lucide-react": "^1.21.0",
     "qrcode.react": "^4.2.0",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
-    "react-i18next": "^17.0.7",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
+    "react-i18next": "^17.0.8",
     "react-markdown": "^10.1.0",
-    "react-router-dom": "^7.15.1",
+    "react-router-dom": "^7.18.0",
     "rehype-sanitize": "^6.0.0",
     "remark-gfm": "^4.0.1",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tailwindcss/vite": "^4.3.0",
+    "@tailwindcss/vite": "^4.3.1",
     "@testing-library/react": "^16.3.2",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.1",
+    "@vitejs/plugin-react": "^6.0.2",
     "autoprefixer": "^10.5.0",
     "jsdom": "^29.1.1",
-    "tailwindcss": "^4.3.0",
-    "vite": "^8.0.13"
+    "tailwindcss": "^4.3.1",
+    "vite": "^8.0.16"
   }
 }

docs/changelog.md

@@ -2,6 +2,34 @@
 
 All notable changes to SkySend are documented here.
 
+## v2.11.3 - Dependency Updates and Bug Fixes
+*Released: June 21, 2026*
+
+### 🐛 Bug Fixes
+
+- **server**: Fixed intermittent 500/502 errors for static assets behind a reverse proxy (e.g. Traefik) after a deployment by keeping server connections alive longer than the proxy's idle timeout, so the proxy no longer reuses a closed connection.
+
+### 🔒 Security
+
+- **server**: Updated hono to 4.12.26 to patch CORS credential reflection, IP restriction bypass, cookie injection, JWT scheme bypass, path traversal in `serve-static`, and AWS Lambda body-limit bypass (GHSA-88fw-hqm2-52qc, GHSA-xrhx-7g5j-rcj5, GHSA-3hrh-pfw6-9m5x, GHSA-f577-qrjj-4474, GHSA-2gcr-mfcq-wcc3, GHSA-wwfh-h76j-fc44, GHSA-rv63-4mwf-qqc2, GHSA-j6c9-x7qj-28xf, GHSA-wgpf-jwqj-8h8p).
+- **web**: Updated vite to 8.0.16 to fix `server.fs.deny` bypass and NTLMv2 hash disclosure on Windows (GHSA-fx2h-pf6j-xcff).
+- **web**: Updated dompurify to 3.4.11 to fix multiple XSS and attribute-pollution vulnerabilities (GHSA-hpcv-96wg-7vj8, GHSA-r47g-fvhr-h676, GHSA-rp9w-3fw7-7cwq, GHSA-76mc-f452-cxcm, GHSA-gvmj-g25r-r7wr, GHSA-vxr8-fq34-vvx9, GHSA-cmwh-pvxp-8882).
+- **infra**: Added pnpm overrides for `ws` (`>=8.21.0`), `miniflare>undici` (`>=7.28.0`), `tsx>esbuild` and `wrangler>esbuild` (`>=0.28.1`), `@babel/core` (`>=7.29.6`), and updated the `vitepress>vite` override to `>=6.4.3 <7` to address transitive advisories in dev dependencies (GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx, GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj, GHSA-vxpw-j846-p89q, GHSA-pr7r-676h-xcf6, GHSA-p88m-4jfj-68fv, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m, GHSA-g7r4-m6w7-qqqr, GHSA-4x5r-pxfx-6jf8, GHSA-fx2h-pf6j-xcff).
+- **server**: Updated `@hono/node-server` to 2.0.5 to patch a serve-static middleware path-prefix bypass on Windows.
+
+### 🔧 CI/CD
+
+- **infra**: Bumped patch-level dependencies across the monorepo (radix-ui components, react, react-i18next, idb-keyval, tailwindcss, vue, vitest, tsx, prettier, and related type definitions). Updated i18next to 26.3.1 to satisfy the updated react-i18next peer requirement.
+- **infra**: Bumped minor-level dependencies across the monorepo (AWS SDK v3, react-router-dom, radix-ui react-select/slot/switch, lucide-react, better-sqlite3, ink, eslint, typescript-eslint, wrangler, @cloudflare/workers-types).
+- **infra**: Updated commander to v15, @types/node to v26, @tailwindcss/typography to 0.5.20, and fflate to 0.8.3.
+
+### 🐳 Docker
+
+- **Image**: `skyfay/skysend:v2.11.3`
+- **Also tagged as**: `latest`, `v2`
+- **Platforms**: linux/amd64, linux/arm64
+
+
 ## v2.11.2 - Cache-Control Fiexes & View Count Bug Fix
 *Released: June 5, 2026*
 

docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skysend/docs",
-  "version": "2.11.2",
+  "version": "2.11.3",
   "private": true,
   "scripts": {
     "dev": "vitepress dev",
@@ -10,6 +10,6 @@
   },
   "devDependencies": {
     "vitepress": "^1.6.4",
-    "vue": "^3.5.34"
+    "vue": "^3.5.38"
   }
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "skysend",
-  "version": "2.11.2",
+  "version": "2.11.3",
   "private": true,
   "type": "module",
   "description": "Minimalist, end-to-end encrypted, self-hostable file sharing service",
@@ -38,20 +38,25 @@
       "fast-xml-parser": ">=5.7.2",
       "postcss": ">=8.5.10",
       "@esbuild-kit/core-utils>esbuild": ">=0.25.0",
-      "vitepress>vite": "~6.4.2"
+      "vitepress>vite": ">=6.4.3 <7",
+      "ws": ">=8.21.0",
+      "miniflare>undici": ">=7.28.0",
+      "tsx>esbuild": ">=0.28.1",
+      "wrangler>esbuild": ">=0.28.1",
+      "@babel/core": ">=7.29.6"
     }
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@vitest/coverage-v8": "^4.1.6",
-    "eslint": "^10.3.0",
+    "@vitest/coverage-v8": "^4.1.9",
+    "eslint": "^10.5.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-react-hooks": "^7.1.1",
     "globals": "^17.6.0",
-    "prettier": "^3.8.3",
-    "tsx": "^4.22.0",
+    "prettier": "^3.8.4",
+    "tsx": "^4.22.4",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.3",
-    "vitest": "^4.1.6"
+    "typescript-eslint": "^8.61.1",
+    "vitest": "^4.1.9"
   }
 }

packages/crypto/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skysend/crypto",
-  "version": "2.11.2",
+  "version": "2.11.3",
   "private": true,
   "type": "module",
   "exports": {