[Bug]: Upgrade formidable to latest

[tunnckoCore]

Version

none

Steps to reproduce

none

Expected behavior

none

Actual behavior

none

Additional context

Lead maintainer of formidable here. We are trying to push people to upgrade.

Any particular reason why you're using v2? I don't see anything that requires that version, you're using the pretty standard API - but very deprecated and weird formidable.IncomingForm (remains from legacy). Everything except v3 is deprecated and vulnerable.

Please upgrade to latest, and prepare for v4 which is written in TypeScript and modern stack & APIs like Fetch/Request/Response/ReadableStream, and there is no buffering or writing to disk. You can try the formidable@next dist-tag and consider supporting us.

Trying to ditch people of the v1 for years, yet it has 2 million downloads and many vulnerabilities.

I'm seeing you're using it in testing, but still. At least upgrade to v3, and more standard API like formidable(options) and .parse.

Environment

any

[mxschmitt]

Hey! I tried upgrading from v2 to v3 and one thing which broke us is the change in

node-formidable/formidable@c249922#diff-3282227cdd75cb13cc5eea121780e9b7ec04986fb12be6508237eab33e0c5bd8R217

parse and writeHeader is now async which means the data listeners to the request are added later on. This broke us because we already have some 'data' listeners. Looking at #35825 with more debugging notes. Looks like formidable v4 is async as well. If the 'data' listeners would get moved before the first async call, this would fix it for us! Do you think this is a contract formidable would accept making?

[mxschmitt]

Filed node-formidable/formidable#1011