+1

package.json

reviewed

··· 83 83 "nuxt": "4.3.0", 84 84 "nuxt-og-image": "5.1.13", 85 85 "ofetch": "1.5.1", 86 86 + "ohash": "2.0.11", 86 87 "perfect-debounce": "2.1.0", 87 88 "sanitize-html": "2.17.0", 88 89 "semver": "7.7.3",

+3

pnpm-lock.yaml

reviewed

··· 146 146 ofetch: 147 147 specifier: 1.5.1 148 148 version: 1.5.1 149 149 + ohash: 150 150 + specifier: 2.0.11 151 151 + version: 2.0.11 149 152 perfect-debounce: 150 153 specifier: 2.1.0 151 154 version: 2.1.0

+7 -4

server/api/registry/badge/[type]/[...pkg].get.ts

reviewed

··· 1 1 import * as v from 'valibot' 2 2 + import { hash } from 'ohash' 2 3 import { createError, getRouterParam, getQuery, setHeader } from 'h3' 3 4 import { PackageRouteParamsSchema } from '#shared/schemas/package' 4 5 import { CACHE_MAX_AGE_ONE_HOUR, ERROR_NPM_FETCH_FAILED } from '#shared/utils/constants' ··· 11 12 const BUNDLEPHOBIA_API = 'https://bundlephobia.com/api/size' 12 13 const NPMS_API = 'https://api.npms.io/v2/package' 13 14 15 15 + const SafeStringSchema = v.pipe(v.string(), v.regex(/^[^<>"&]*$/, 'Invalid characters')) 16 16 + 14 17 const QUERY_SCHEMA = v.object({ 15 15 - color: v.optional(v.string()), 18 18 + color: v.optional(SafeStringSchema), 16 19 name: v.optional(v.string()), 17 17 - labelColor: v.optional(v.string()), 18 18 - label: v.optional(v.string()), 20 20 + labelColor: v.optional(SafeStringSchema), 21 21 + label: v.optional(SafeStringSchema), 19 22 }) 20 23 21 24 const COLORS = { ··· 338 341 const type = getRouterParam(event, 'type') ?? 'version' 339 342 const pkg = getRouterParam(event, 'pkg') ?? '' 340 343 const query = getQuery(event) 341 341 - return `badge:${type}:${pkg}:${JSON.stringify(query)}` 344 344 + return `badge:${type}:${pkg}:${hash(query)}` 342 345 }, 343 346 }, 344 347 )