Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/Http/Requests/UserRequest.php`:
- Line 31: The image validation in UserRequest currently only accepts JPG, but
the profile UI uploads the cropped avatar as image.png, so the request is
rejected. Update the image rule in UserRequest to match the filename/format sent
from UserTabProfile, or adjust the client upload naming so the validator and
upload flow stay consistent. Keep the existing size, dimension, and Antivirus
checks intact while fixing the extension/type mismatch.

In `@config/bigbluebutton.php`:
- Around line 7-16: The allowed file MIME list in the bigbluebutton config is
preserving whitespace from the BBB_ALLOWED_FILE_MIMES env value, so tokens like
" docx" can leak into both validation and the upload hint text. Update the
allowedFileMimes parsing in the config to trim each comma-separated token before
filtering/uniquing, and keep the fallback behavior unchanged so
allowed_file_mimes always contains clean extension strings.

---

Outside diff comments:
In `@resources/js/components/SettingsFileSelector.vue`:
- Around line 108-110: The `fileError` prop in `SettingsFileSelector.vue` can be
null by default, but `frontendFileError` still reads `props.fileError.length`,
causing a first-render crash. Update the `fileError` prop definition to use an
array-based default (and matching type) or add a null guard inside
`frontendFileError` before accessing `length`, so the computed logic in
`frontendFileError` and related file-error handling works safely when no backend
errors are present.

---

Nitpick comments:
In `@app/Http/Requests/StoreRoomFileRequest.php`:
- Around line 13-14: StoreRoomFileRequest::rules() is missing an explicit return
type, so update the rules method signature to declare it returns an array. Keep
the existing validation rule contents unchanged and ensure the method
declaration in StoreRoomFileRequest matches the PHP typing guideline.

In `@resources/js/composables/useFormErrors.js`:
- Around line 48-54: The JSDoc for fieldError in useFormErrors.js still
describes HTML/v-html output even though the method now returns a string array,
so update the remaining comments in that block to match the array contract. Keep
the `@return` {string[]} description aligned with the implementation and FormError
usage, and remove or rewrite any text that implies the helper returns HTML or is
meant for v-html.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@resources/js/components/LoginTabLocal.vue`:
- Around line 104-111: The watcher on props.errors in LoginTabLocal.vue
currently only updates formErrors after a change, so the initial error state is
missed on mount. Update the watch call that uses toRaw(newErrors) and
formErrors.set(...) to run immediately by adding immediate: true, so existing
props.errors are applied as soon as the component initializes.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/Rules/Image.php`:
- Around line 13-14: The Image::default() validation rule currently permits SVG
uploads without the required sanitization and isolation safeguards. Remove svg
from the types and extensions lists in Image::default(), and remove the
corresponding SVG choices from matching upload UI options; do not add SVG
support unless it is separately sanitized and served from an isolated origin
with safe response headers.

In `@tests/Backend/Feature/api/v1/Room/RoomStreamingTest.php`:
- Line 59: Update the MIME-mismatch fixtures at
tests/Backend/Feature/api/v1/Room/RoomStreamingTest.php:59 and
tests/Backend/Feature/api/v1/StreamingTest.php:35 to use a supported image
extension such as .jpg while overriding the generated file’s MIME type to
image/tiff; preserve the existing image dimensions and test intent.

   * @param {string} field Name of field to get the error message for.
   * @param {bool} [wildcard=false] Flag that indicates whether all errors that starting with the field name should be checked.
   * @return {string[]} Empty array if there is no error for the passed field otherwise an array of strings with the messages for the passed field.

          $t("app.file.allowed_formats", {
            formats: settingsStore.getSetting("bbb.file_mimes").join(", "),
          })

            size: fileHelpers.fileSize(
              settingsStore.getSetting("bbb.max_filesize") * 1_000_000,
            ),