Upgrade multer to 2.5.0
Node · Node · intermediate · modification
Moves the documents API to multer 2.5.0, pinned like the rest of `package.json`. Two of the 2.x changes touch this code. Multer 2.5.0 depends only on `append-field`, `busboy` and `type-is` (2.4.0 removed `concat-stream`), so `concat-stream`, `mkdirp` and `object-assign` and their subtrees leave the lockfile: 14 entries, mostly the old `readable-stream` 2.x chain. And since 2.3.0 multer accepts a file of exactly `limits.fileSize` bytes (CHANGELOG: "Accept files whose size is exactly `limits.fileSize`"), so the `+ 1` workaround in the upload route goes: the limit is now just `MAX_UPLOAD_BYTES`, and a 10 MiB file is still accepted while one byte more still gets 413. The route's error mapping uses multer's error codes, which 2.x keeps, so the 2.4.0 message change does not reach clients. Express and pg are untouched.
Express 4 documents API (Node 20, npm 10) for a multi-tenant SaaS; it stores customer documents and holds the database and object-store credentials. `src/app.js` (unchanged) mounts `app.use('/api/documents', requireAuth, documentsRouter)`; `requireAuth` answers 401 or sets `req.user = { id, orgId }`; the app's last error handler logs the error and answers 500 `{ error: 'internal' }`. `saveDocument(orgId, { name, mimeType, bytes })` (unchanged) stores the file and its metadata as opaque data and returns `{ id, name }`; names are stored and returned verbatim (multer 2.3.0+ decodes WHATWG-escaped characters in `originalname`, so a name may hold a raw quote, CR or LF), and the download route (unchanged) serves files as attachments with the name only in an RFC 5987 encoded `filename*` parameter. CI and the production image install with `npm ci` from the committed lockfile, with no extra registry or lockfile configuration. The ingress caps request bodies at 12 MiB. `package-lock.json` (lockfileVersion 3) is shown trimmed to its top-level fields, the root entry and every entry this PR changes or removes; the other 85 entries are unchanged and all resolve from `https://registry.npmjs.org/`.
Requirements
- Upgrade `multer` from 1.4.5-lts.1 to 2.5.0, pinned exactly in `package.json` like every other dependency (security ticket: move off the unmaintained 1.x line). `express` and `pg` stay at their current pins; express's own upgrade is a separate ticket.
- Dependency policy (unchanged): every package in `package-lock.json`, direct or transitive, is installed from the public npm registry (`https://registry.npmjs.org/`) as the release published there under that name and version. No git, GitHub, tarball-URL, fork or other-registry sources.
- Uploads keep today's limit: `POST /api/documents` accepts one file of up to 10 MiB (10,485,760 bytes) inclusive and answers 413 `{ error: 'limit_file_size' }` for anything larger. Every other response of the route stays as it is (400 `file_required` without a file, 400 with the lower-cased multer code for other multer errors, storage errors to the app's error handler).
Files touched
- package.json
- package-lock.json
- src/routes/documents.js
--- package.json
"dependencies": {
"express": "4.21.2",
- "multer": "1.4.5-lts.1",
+ "multer": "2.5.0",
"pg": "8.13.1"
}
--- package-lock.json
"dependencies": {
"express": "4.21.2",
- "multer": "1.4.5-lts.1",
+ "multer": "2.5.0",
"pg": "8.13.1"
},
}
},
- "node_modules/buffer-from": {
- "version": "1.1.2",
- "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
- "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
- "license": "MIT"
- },
- "node_modules/concat-stream": {
- "version": "1.6.2",
- "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-1.6.2.tgz",
- "integrity": "sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==",
- "engines": [
- "node >= 0.8"
- ],
- "license": "MIT",