Update the `busboy` dependency to v1
See original GitHub issueThe busboy
v1 update has a lot of great improvements, and importantly fixes this security flaw:
https://github.com/advisories/GHSA-wm7h-9275-46v2
Unfortunately, it also introduces a bug where the file size limit is 1 byte off:
https://github.com/mscdex/busboy/issues/297
If we were to update the graphql-upload
dependency busboy
to v1 with that bug, imagine how many apps have public facing labels on file upload inputs saying things like “max 4 MB file size” and users would try to upload an exactly 4 MB file and it would be erroring. To avoid having to update our front ends to say “max 3.999999 MB” we would have to change our graphql-upload
maxFileSize
config in GraphQL APIs to be the real limit we want + 1. But then, if this busboy
bug is fixed in a patch release, suddenly files 1 byte too big will start being accepted which could have who knows what problems further down the line in our systems depending how the files are used.
We might be forced to publish a major release of graphql-upload
that only bumps busboy
to v1, but with a big warning in the changelog entry that explains this outstanding busboy
bug and that people should be aware of the dilemma and deal with it as best as they can.
Issue Analytics
- State:
- Created a year ago
- Reactions:1
- Comments:14 (10 by maintainers)
This work has been published in v15.0.0! Please test this update in your projects and hopefully we didn’t introduce any new bugs in the rush 🙏
ETA within the hour. I’m about to push a commit up.