From de08cd2796a48325b272d45868d8c003abd692c0 Mon Sep 17 00:00:00 2001
From: svemagie <869694+svemagie@users.noreply.github.com>
Date: Thu, 9 Apr 2026 15:37:39 +0200
Subject: [PATCH] chore: bump @indiekit peer deps to beta.27, fix duplicate
 validate keys in rate limiters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- @indiekit/endpoint-micropub, @indiekit/error, @indiekit/frontend: ^1.0.0-beta.25 → ^1.0.0-beta.27
- express-rate-limit: stays at ^7.5.1 (v8 has breaking changes to standardHeaders boolean and validate.trustProxy API)
- Remove duplicate validate: { trustProxy: false } keys in apiLimiter, authLimiter, appRegistrationLimiter

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 lib/mastodon/router.js | 3 ---
 package.json           | 6 +++---
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/lib/mastodon/router.js b/lib/mastodon/router.js
index fde5a17..3cc596d 100644
--- a/lib/mastodon/router.js
+++ b/lib/mastodon/router.js
@@ -35,7 +35,6 @@ const apiLimiter = rateLimit({
   legacyHeaders: false,
   validate: { trustProxy: false }, // behind nginx reverse proxy; trust proxy is intentional
   message: { error: "Too many requests, please try again later" },
-  validate: { trustProxy: false },
 });
 
 const authLimiter = rateLimit({
@@ -45,7 +44,6 @@ const authLimiter = rateLimit({
   legacyHeaders: false,
   validate: { trustProxy: false },
   message: { error: "Too many authentication attempts" },
-  validate: { trustProxy: false },
 });
 
 const appRegistrationLimiter = rateLimit({
@@ -55,7 +53,6 @@ const appRegistrationLimiter = rateLimit({
   legacyHeaders: false,
   validate: { trustProxy: false },
   message: { error: "Too many app registrations" },
-  validate: { trustProxy: false },
 });
 
 /**
diff --git a/package.json b/package.json
index c19df88..89553c6 100644
--- a/package.json
+++ b/package.json
@@ -49,9 +49,9 @@
     "unfurl.js": "^6.4.0"
   },
   "peerDependencies": {
-    "@indiekit/endpoint-micropub": "^1.0.0-beta.25",
-    "@indiekit/error": "^1.0.0-beta.25",
-    "@indiekit/frontend": "^1.0.0-beta.25"
+    "@indiekit/endpoint-micropub": "^1.0.0-beta.27",
+    "@indiekit/error": "^1.0.0-beta.27",
+    "@indiekit/frontend": "^1.0.0-beta.27"
   },
   "publishConfig": {
     "access": "public"