Audit fixes: account tests, dependencies and security hardening

[tyl-droid]

Audit fixes: stale account tests, dependency advisories, upload limit and strict JWT subjects

Hi — I reviewed the current main branch at bc12bb07d4055bf5d85943b67f7379d8ab440c22 as part of a preservation-readiness audit and reproduced a few concrete issues.

I prepared and validated three small commits locally:

1. Account test drift
   • Updates the account integration suite for the new default of three username changes.
   • Exercises all three successful changes and verifies the fourth is refused.
2. Dependency security updates
   • hono: 4.12.27 → 4.13.5
   • wrangler: 4.105.0 → 4.128.0
   • @scalar/api-reference: 1.63.0 → 1.67.0
   • Regenerated pnpm-lock.yaml.
   • pnpm audit --prod --audit-level=moderate changed from 12 advisories (3 high, 8 moderate, 1 low) to no known vulnerabilities.
3. Narrow security hardening
   • Adds RECFLARE_MAX_UPLOAD_BYTES with a safe 64 MiB default.
   • Returns HTTP 413 before writing an oversized parsed file to R2.
   • Documents the setting and adds an integration test.
   • Makes JWT sub parsing reject partial/non-canonical values such as 42junk, decimals, signed/zero-padded values and unsafe integers, instead of accepting parseInt's prefix.

Validation:

• 31/31 test files passed
• 1,264/1,264 tests passed
• Storage typecheck passed
• Storage lint passed
• Full lint completed with the same existing warnings
• Production dependency audit: 0 known vulnerabilities

One limitation remains: multipart parsing occurs before the per-file size check, so this prevents R2 storage abuse but does not fully eliminate request-body memory pressure. A follow-up should enforce an edge/request-body ceiling or introduce streaming multipart handling.

I can provide the three generated Git patches/commits for application. I have not deployed anything or changed upstream code.

[djdevin]

Looks good, thanks!

[tyl-droid]

Thanks again for reviewing and merging this contribution. I’m also interested in helping OrangeVR as a Volunteer Moderator or Community Team member, drawing on my community-safety work through CWN. I’m not requesting developer or repository access and will continue contributing through the normal pull-request process. Is there an appropriate application or contact channel for community roles?

[tyl-droid]

Hi! A quick heads-up about my future RecFlare contributions: I’m planning to organise my work into development batches rather than approaching each change individually.

A batch may contain approximately 10–15 candidate fixes, tests, documentation improvements, or issue implementations. Each change will still have its own focused branch and pull request so it can be reviewed, tested, merged, or rejected independently.

I don’t want to overwhelm the maintainers or flood the repository with notifications, so which submission approach would you prefer?

• Release the complete batch together
• Submit smaller waves of around 2–4 pull requests
• Create a tracking issue first and let maintainers select priorities

Every pull request will identify its public-source base revision, include relevant tests and documentation, and avoid making claims about the production deployment because public GitHub updates may be delayed.

I’m happy to follow whichever workflow is easiest for the RecFlare team.

[tyl-droid]

Hey Devin! Thanks again for merging PRs #54 and #56. I’m interested in becoming more involved with RecFlare and would like to apply for either the Moderation Team or Community Team. Are applications currently open? If so, could you tell me where to apply and which team you think would best suit my experience? I’m happy to provide more information about my moderation, community-safety, and development work if needed.