@flopay/node 1.13.1 → 1.13.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -0
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -10,6 +10,12 @@ pnpm add @flopay/node
|
|
|
10
10
|
|
|
11
11
|
`stripe` and `@flopay/shared` install automatically as dependencies. Use it only from trusted server code: the constructor takes a Stripe secret key, which must never reach a browser.
|
|
12
12
|
|
|
13
|
+
### Node.js version
|
|
14
|
+
|
|
15
|
+
Run `@flopay/node` on a Node.js release patched for CVE-2026-111497 ("Node2Shell"), an out-of-bounds write in the Brotli decoder of Node.js itself. The Node.js security release of 21 October 2026 fixed it in 22.23.4, 24.22.1 and 26.12.1, so run 22.23.4+ on 22.x, 24.22.1+ on 24.x, or 26.12.1+ on 26.x.
|
|
16
|
+
|
|
17
|
+
20.x (end of life) and 25.x get no fix: move off them to a patched 22.x, 24.x or 26.x release. The supported range, Node.js 20.19+, 22.13+ and 24+, still includes both lines, so nothing in the package stops you running on them.
|
|
18
|
+
|
|
13
19
|
## Usage
|
|
14
20
|
|
|
15
21
|
### Initialize
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@flopay/node",
|
|
3
|
-
"version": "1.13.
|
|
3
|
+
"version": "1.13.2",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"sideEffects": false,
|
|
6
6
|
"publishConfig": {
|
|
@@ -27,12 +27,12 @@
|
|
|
27
27
|
],
|
|
28
28
|
"dependencies": {
|
|
29
29
|
"stripe": "^22.6.2",
|
|
30
|
-
"@flopay/shared": "1.13.
|
|
30
|
+
"@flopay/shared": "1.13.2"
|
|
31
31
|
},
|
|
32
32
|
"devDependencies": {
|
|
33
33
|
"tsup": "^8.3.0",
|
|
34
34
|
"typescript": "^6.0.3",
|
|
35
|
-
"vitest": "4.1.
|
|
35
|
+
"vitest": "4.1.12"
|
|
36
36
|
},
|
|
37
37
|
"scripts": {
|
|
38
38
|
"build": "tsup",
|