fix(bridge): patch stagelinq file-type CVE (#34/#35) via magic-number shim

[thewrz]

Why

Dependabot alerts #34 and #35 (file-type ASF parser DoS) have been open since May 2026. They were deferred because:

• bridge/ and bridge-app/ pull file-type@16.5.4 transitively via stagelinq@3.0.4
• stagelinq is CJS and calls FileType.fromBuffer(albumArt) in node_modules/stagelinq/dist/network/NetworkDevice.js
• Patched file-type@21.3.1+ is ESM-only and renames the API (fromBuffer → fileTypeFromBuffer), so a resolution override alone breaks stagelinq at runtime

Investigation result (2026-08-01): stagelinq@3.3.1 is the latest release (latest on npm, confirmed via npm view stagelinq versions). It still declares file-type: ^16.5.3 — the upstream library is unpatched. Path 2 (version bump) is not actionable; this PR takes Path 3 (patch-package shim).

What

bridge/patches/stagelinq+3.0.4.patch and bridge-app/patches/stagelinq+3.0.4.patch

Replaces both FileType.fromBuffer() calls in node_modules/stagelinq/dist/network/NetworkDevice.js with a synchronous 16-byte magic-number sniff:

Format	Magic bytes
JPEG	FF D8 FF
PNG	89 50 4E 47
GIF	47 49 46 38
WebP	52 49 46 46 … 57 45 42 50 (bytes 0–3 + 8–11)

Returns { ext, mime } matching the original FileType shape (only .ext is consumed by the caller).

The require("file-type") import is removed from the patched file, so file-type is never loaded at runtime — eliminating the CVE attack surface. The package remains on disk as a stagelinq npm dep but is inert.

Other changes:

• patch-package@^8.0.1 added as devDependency in both bridge/ and bridge-app/
• "postinstall": "patch-package" wired in both package.json scripts
• Both package-lock.json files updated (npm install --package-lock-only)

Dependency tree note: Removing file-type from the resolved tree entirely would require either an ESM-compatible stagelinq release or a local npm stub. Since the runtime call is gone, the on-disk presence is inert and a stub is deferred until stagelinq upgrades.

Testing

• bridge/: npx vitest run — 351 passed, 1 pre-existing failure (serato-plugin › rescans after 5 consecutive read errors, timing flake confirmed present on main before this branch)
• npx tsc --noEmit clean on bridge/
• bridge-app/: install + test suite (Electron; skip in CI, verify locally)
• Manual verification: install bridge/ and confirm patch-package applies the patch cleanly; exercise album art path in a live StageLinQ session
• CI green

🤖 Co-authored by Claude. Closes #34, Closes #35

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9c71d67a-5656-4627-85d5-6f07d4dd9280

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}