Update Composer packages

kirby/config/api/models/User.php

@@ -9,7 +9,7 @@ use Kirby\Form\Form;
 return [
 	'default' => fn () => $this->user(),
 	'fields' => [
-		'avatar'      => fn (User $user) => $user->avatar() ? $user->avatar()->crop(512) : null,
+		'avatar'      => fn (User $user) => $user->avatar()?->crop(512),
 		'blueprint'   => fn (User $user) => $user->blueprint(),
 		'content'     => fn (User $user) => Form::for($user)->values(),
 		'email'       => fn (User $user) => $user->email(),

kirby/config/api/routes/users.php

@@ -1,6 +1,8 @@
 <?php
 
+use Kirby\Exception\Exception;
 use Kirby\Filesystem\F;
+use Kirby\Toolkit\Str;
 
 /**
  * User Routes
@@ -79,10 +81,27 @@ return [
 		],
 		'method'  => 'POST',
 		'action'  => function (string $id) {
-			$this->user($id)->avatar()?->delete();
-
 			return $this->upload(
 				function ($source, $filename) use ($id) {
+					$type = F::type($filename);
+					if ($type !== 'image') {
+						throw new Exception([
+							'key'  => 'file.type.invalid',
+							'data' => compact('type')
+						]);
+					}
+
+					$mime = F::mime($source);
+					if (Str::startsWith($mime, 'image/') !== true) {
+						throw new Exception([
+							'key'  => 'file.mime.invalid',
+							'data' => compact('mime')
+						]);
+					}
+
+					// delete the old avatar
+					$this->user($id)->avatar()?->delete();
+
 					$props = [
 						'filename' => 'profile.' . F::extension($filename),
 						'template' => 'avatar',