- Add buffer length check before timingSafeEqual to prevent RangeError on missing/malformed X-Hub-Signature-256 headers - Switch Dockerfile from pnpm to npm with package-lock.json (pnpm lockfile lives at monorepo root, not in the package directory)