fix(deps): update dependency multer to v2 [security]#655
fix(deps): update dependency multer to v2 [security]#655renovate-bot wants to merge 1 commit intoGoogleCloudPlatform:mainfrom
Conversation
|
/gcbrun |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request upgrades the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the multer dependency to version 2.1.0 to address security vulnerabilities. While this is a necessary update, it's a major version bump that introduces breaking API changes. The current implementation of file uploads using multer in bookshelf/lib/images.js is not compatible with multer v2 and will cause the application to fail. I've added a comment on package.json with more details. The PR needs to be amended to include the required code changes for multer v2 compatibility before it can be merged.
bookshelf/package.json
Outdated
| "body-parser": "^1.18.3", | ||
| "express": "^4.16.4", | ||
| "multer": "^1.4.1", | ||
| "multer": "^2.1.0", |
There was a problem hiding this comment.
Updating multer to v2 is a major version change that introduces breaking API changes. The current usage of multer in bookshelf/lib/images.js will break the application after this update.
Specifically, the storage configuration in bookshelf/lib/images.js on line 77 (storage: Multer.MemoryStorage) is invalid for multer v2. It needs to be updated to use the new API. For multer v2, this should be storage: Multer.memoryStorage().
This pull request must be updated to include the necessary code changes in bookshelf/lib/images.js to ensure the application remains functional.
renovate-bot
force-pushed
the
renovate/npm-multer-vulnerability
branch
from
f298036 to
b9642c1
Compare
|
/gcbrun |
renovate-bot
force-pushed
the
renovate/npm-multer-vulnerability
branch
from
b9642c1 to
3dd1715
Compare
|
/gcbrun |
renovate-bot
force-pushed
the
renovate/npm-multer-vulnerability
branch
from
3dd1715 to
1facea1
Compare
|
/gcbrun |
3 participants
This PR contains the following updates:
^1.4.1→^2.1.1GitHub Vulnerability Alerts
CVE-2026-3304
Impact
A vulnerability in Multer versions < 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion.
Patches
Users should upgrade to
2.1.0Workarounds
None
CVE-2026-2359
Impact
A vulnerability in Multer versions < 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion.
Patches
Users should upgrade to
2.1.0Workarounds
None
CVE-2026-3520
Impact
A vulnerability in Multer versions < 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.
Patches
Users should upgrade to
2.1.1Workarounds
None
Resources
Release Notes
expressjs/multer (multer)
v2.1.1Compare Source
v2.1.0Compare Source
defParamCharsetoption for UTF-8 filename support (#1210)v2.0.2Compare Source
v2.0.1Compare Source
v2.0.0Compare Source
v1.4.4Compare Source
v1.4.3Compare Source
v1.4.2Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.