Merge pull request #31911 from overleaf/renovate-npm-multer-vulnerability

[Core] Update dependency multer to v2.1.1 from 2.0.2 [SECURITY]

GitOrigin-RevId: 17cb0c852fe3d17dc201c62eef90455a01a40aa5

package-lock.json

@@ -35289,21 +35289,22 @@
       }
     },
     "node_modules/multer": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/multer/-/multer-2.0.2.tgz",
-      "integrity": "sha512-u7f2xaZ/UG8oLXHvtF/oWTRvT44p9ecwBBqTwgJVq0+4BW1g8OW01TyMEGWBHbyMOYVHXslaut7qEQ1meATXgw==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.1.1.tgz",
+      "integrity": "sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A==",
       "license": "MIT",
       "dependencies": {
         "append-field": "^1.0.0",
         "busboy": "^1.6.0",
         "concat-stream": "^2.0.0",
-        "mkdirp": "^0.5.6",
-        "object-assign": "^4.1.1",
-        "type-is": "^1.6.18",
-        "xtend": "^4.0.2"
+        "type-is": "^1.6.18"
       },
       "engines": {
         "node": ">= 10.16.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/multicast-dns": {
@@ -51148,7 +51149,7 @@
         "moment": "^2.29.4",
         "mongodb-legacy": "6.1.3",
         "mongoose": "8.9.5",
-        "multer": "2.0.2",
+        "multer": "2.1.1",
         "nocache": "^2.1.0",
         "node-fetch": "^2.7.0",
         "nodemailer": "^7.0.0",

patches/multer+2.0.2.patch → patches/multer+2.1.1.patch

@@ -1,8 +1,8 @@
 diff --git a/node_modules/multer/lib/make-middleware.js b/node_modules/multer/lib/make-middleware.js
-index 260dcb4..895b4b2 100644
+index ee50988..de77364 100644
 --- a/node_modules/multer/lib/make-middleware.js
 +++ b/node_modules/multer/lib/make-middleware.js
-@@ -113,7 +113,7 @@ function makeMiddleware (setup) {
+@@ -164,7 +164,7 @@ function makeMiddleware (setup) {
        if (fieldname == null) return abortWithCode('MISSING_FIELD_NAME')
  
        // don't attach to the files object, if there is no file

services/web/package.json

@@ -154,7 +154,7 @@
     "moment": "^2.29.4",
     "mongodb-legacy": "6.1.3",
     "mongoose": "8.9.5",
-    "multer": "2.0.2",
+    "multer": "2.1.1",
     "nocache": "^2.1.0",
     "node-fetch": "^2.7.0",
     "nodemailer": "^7.0.0",