chore(deps): resolve high-severity multer and undici advisories #125

New Issue

2026-10-24T13:53:19+03:00

codex-bot commented

2026-10-24 13:53:19 +03:00

Context

npm audit reports high-severity advisories affecting Multer (DoS after request teardown) and undici (EventSource memory DoS, SRI bypass, content-encoding DoS).

Acceptance Criteria

Update the vulnerable transitive dependencies to patched versions without forcing a breaking NestJS major/minor downgrade or upgrade.
Keep package.json and package-lock.json consistent.
npm audit no longer reports these advisories; document any remaining vulnerabilities.
Run the repository dependency/security and relevant validation checks.

Scope

Dependency overrides and lockfile in backend only.

## Context `npm audit` reports high-severity advisories affecting Multer (DoS after request teardown) and undici (EventSource memory DoS, SRI bypass, content-encoding DoS). ## Acceptance Criteria - Update the vulnerable transitive dependencies to patched versions without forcing a breaking NestJS major/minor downgrade or upgrade. - Keep package.json and package-lock.json consistent. - `npm audit` no longer reports these advisories; document any remaining vulnerabilities. - Run the repository dependency/security and relevant validation checks. ## Scope Dependency overrides and lockfile in backend only.

codex-bot commented

2026-10-24 13:57:38 +03:00

Implemented in branch chore/125-multer-undici-security.

Multer 2.5.0 and undici 7.30.1 overrides resolve the reported high-severity advisories without a NestJS major upgrade or undici 8.
Updated transitive body-parser, fast-uri, and ip-address overrides to clear the existing audit findings as well.
npm audit: 0 vulnerabilities.

Checks: prisma generate, npm run lint:check, npm run typecheck:app, npm run typecheck:test, npm test -- --runInBand, npm run test:lint all pass.

Scope: package.json and package-lock.json only.

Implemented in branch `chore/125-multer-undici-security`. - Multer 2.5.0 and undici 7.30.1 overrides resolve the reported high-severity advisories without a NestJS major upgrade or undici 8. - Updated transitive body-parser, fast-uri, and ip-address overrides to clear the existing audit findings as well. - `npm audit`: 0 vulnerabilities. Checks: `prisma generate`, `npm run lint:check`, `npm run typecheck:app`, `npm run typecheck:test`, `npm test -- --runInBand`, `npm run test:lint` all pass. Scope: `package.json` and `package-lock.json` only.

codex-bot commented

2026-10-24 14:34:03 +03:00

CI unblock for feature PR #121 was handled by preserving its change as a linear commit on current develop in PR #126, since original #121 had a merge commit that commitlint rejected. Old PR #121 is closed as superseded; waiting on #126 required checks before merging.

ksv741 referenced this issue from a commit

2026-10-24 14:36:16 +03:00

chore(deps): fix high severity audit findings (#125)

codex-bot commented

2026-10-24 15:06:43 +03:00

Dependency-audit fixes and the structured-error-logging feature were merged via linearized PR #126 after resolving commitlint and e2e CI failures. Required commits/security/verify checks all passed on the final PR revision.

codex-bot commented

2026-10-28 11:48:42 +03:00

Verified on develop @ 2325b63: multer@2.5.0 and undici@7.30.1 resolved via overrides; npm audit --omit=dev → 0 vulnerabilities. Remaining: 6 low (deepmerge GHSA-gcqx-w48m-w2h4 via jest-config, dev-only; no non-breaking fix upstream). AC met — closing.

Verified on `develop` @ 2325b63: multer@2.5.0 and undici@7.30.1 resolved via overrides; `npm audit --omit=dev` → 0 vulnerabilities. Remaining: 6 low (deepmerge GHSA-gcqx-w48m-w2h4 via jest-config, dev-only; no non-breaking fix upstream). AC met — closing.

codex-bot closed this issue

2026-10-28 11:48:43 +03:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: WealthLedger/backend#125