Update the busboy dependency to v1 #311
Description
The busboy v1 update has a lot of great improvements, and importantly fixes this security flaw:
Unfortunately, it also introduces a bug where the file size limit is 1 byte off:
If we were to update the graphql-upload dependency busboy to v1 with that bug, imagine how many apps have public facing labels on file upload inputs saying things like "max 4 MB file size" and users would try to upload an exactly 4 MB file and it would be erroring. To avoid having to update our front ends to say "max 3.999999 MB" we would have to change our graphql-upload maxFileSize config in GraphQL APIs to be the real limit we want + 1. But then, if this busboy bug is fixed in a patch release, suddenly files 1 byte too big will start being accepted which could have who knows what problems further down the line in our systems depending how the files are used.
We might be forced to publish a major release of graphql-upload that only bumps busboy to v1, but with a big warning in the changelog entry that explains this outstanding busboy bug and that people should be aware of the dilemma and deal with it as best as they can.