Skip to content

feat: port upstream security fixes#30

Merged
ostridm merged 1 commit intomasterfrom
feat/backport-upstream-security-fixes
Feb 23, 2026
Merged

feat: port upstream security fixes#30
ostridm merged 1 commit intomasterfrom
feat/backport-upstream-security-fixes

Conversation

@ostridm
Copy link

@ostridm ostridm commented Feb 23, 2026

All security-relevant commits from upstream/main (expressjs/multer) were reviewed:

Commit Description Action
e081d48 fix(cve): bump busboy to fix CVE-2022-24434 Already mitigated — fork replaced busboy with @fastify/busboy entirely
35a3272 Fixes #1233 — handle missing field names Ported
37241f8 Fix out-of-band error event from busboy Ported
2c8505f drain stream / improve error handling / v2.0.0 Partially ported — drain and req error listener already present in fork; removeAllListeners timing fix ported
adfeaf6 improve error handling (v2.0.1/2.0.2) Not applicable — targets make-middleware.js which does not exist in fork (middleware was fully rewritten)

@ostridm ostridm self-assigned this Feb 23, 2026
@ostridm ostridm added the Type: enhancement New feature or request. label Feb 23, 2026
@ostridm ostridm enabled auto-merge (squash) February 23, 2026 12:49
@ostridm ostridm merged commit 5855308 into master Feb 23, 2026
2 checks passed
@ostridm ostridm deleted the feat/backport-upstream-security-fixes branch February 23, 2026 12:50
@github-actions
Copy link

🎉 This PR is included in version 3.3.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Type: enhancement New feature or request.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants