Repository navigation
chore(deps): bump multer, body-parser, fast-uri, and qs in demos/extractor - #1093
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟢 Approval recommended
No blocking issues were identified in the scoped dependency updates, and the reported installation and security scan validations passed.
No open issues 🎉
1 file not reviewed
demos/extractor/package-lock.json: Generated file
What changed in this PR
Updates the extractor demo’s dependencies to address nine reported security advisories without changing application code.
Changes:
- Pins
multerto 2.5.0 in the manifest and lockfile. - Updates
body-parser,fast-uri, andqsto patched versions. - Refreshes Express and supporting dependencies so Express can share the patched
qsversion.
| File | Description |
|---|---|
demos/extractor/package.json |
Updates the direct multer pin to 2.5.0. |
demos/extractor/package-lock.json |
Records updated dependency versions, integrity hashes, and dependency requirements. |
Review effort: Balanced
ericcurtin
left a comment
ericcurtin
left a comment
There was a problem hiding this comment.
LGTM. Lockfile hashes verified against npm, npm ci clean, npm audit 0 vulns, multer upload and size limit smoke-tested.
|
Merged, thanks! model-runner is being deprecated in favour of https://github.com/llmmanorg/llmman, so please open future PRs and issues there. Follow-ons: |
Bump
multerto 2.5.0 indemos/extractorand refresh three transitive dependencies in the lockfile to address GHSA-q7qp-rjg7-q26m, GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-4mjr-xmp4-gh2g, and GHSA-x5fp-wj9c-mxmx.Evidence:
demos/extractor/package.jsonpinnedmulter@2.4.0; the lockfile resolvedbody-parser1.20.5,fast-uri3.1.8,qs6.15.2osv-scannerreported the nine IDs above for this directory before the updateChanges:
multer2.4.0 -> 2.5.0 (direct pin)body-parser1.20.5 -> 1.20.9fast-uri3.1.8 -> 3.1.9qs6.15.2 -> 6.16.0expressresolves to 4.22.3 within the existing^4.18.2range so itsqsdependency (~6.15.1in 4.22.2,~6.16.0in 4.22.3) dedupes to the patched 6.16.0 instead of nesting a vulnerable 6.15.3Validation:
npm installindemos/extractorcompletesosv-scannerreports zero advisories fordemos/extractorafter the update (all nine IDs gone, none added)Scope: dependency manifest and lockfile update only.