fix: update multer

[SimenB]

About the changes

Current version pulls in vulnerable dicer.

expressjs/multer#1072 (comment)

Important files

N/A

Discussion points

N/A

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Updated
unleash-docs	⬜️ Ignored (Inspect)		Jun 1, 2022 at 8:45AM (UTC)

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	91.38%	5323/5825
🟡	Branches	79.73%	838/1051
🟢	Functions	86.19%	1229/1426
🟢	Lines	91.33%	5201/5695

Show new covered files 🐣

St.❔	File	Statements	Branches	Functions	Lines
🟢	... / anonymise.ts	100%	100%	100%	100%
🟢	... / feature-environment-response.ts	100%	100%	100%	100%
🟢	... / feature-environment-schema.ts	100%	100%	100%	100%

Show files with reduced coverage 🔻

St.❔	File	Statements	Branches	Functions	Lines
🟢	... / feature-toggle-client-store.ts	98.55% (-1.45% 🔻)	76.67%	100%	98.55% (-1.45% 🔻)
🟢	... / user-admin.ts	84.62% (-2.29% 🔻)	66.67% (-13.33% 🔻)	71.43% (-11.9% 🔻)	85.56% (-1.35% 🔻)
🟢	... / features.ts	92.31%	100%	89.47%	92.31%
🟡	... / openapi-service.ts	68.75% (-12.5% 🔻)	12.5% (-50% 🔻)	62.5% (-12.5% 🔻)	68.75% (-12.5% 🔻)

Test suite run success

887 tests passing in 125 suites.

Report generated by 🧪jest coverage report action from 814d2b8

[sonatype-lift]

Severe OSS Vulnerability:

pkg:npm/multer@1.4.5-lts.1

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components

pkg:npm/multer@1.4.5-lts.1

SEVERE Vulnerabilities (1)




[sonatype-2016-0121] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

multer - Denial of Service (DoS)

The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

CVSS Score: 6.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

(at-me in a reply with help or ignore)

---

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

[ivarconr]

still not fixed?

[SimenB]

the vulnerability is in dicer (GHSA-wm7h-9275-46v2, which is now gone from the lockfile) via old busboy. I have no idea what vulnerability this tool thinks it has warned about it. Seems it doesn't link to any CVE?

[sonatype-lift]

Severe OSS Vulnerability:

pkg:npm/multer@1.4.5-lts.1

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components

pkg:npm/multer@1.4.5-lts.1

SEVERE Vulnerabilities (1)




[sonatype-2016-0121] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

multer - Denial of Service (DoS)

The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

CVSS Score: 6.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

(at-me in a reply with help or ignore)

---

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]