question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Update the `busboy` dependency to v1

See original GitHub issue

The busboy v1 update has a lot of great improvements, and importantly fixes this security flaw:

https://github.com/advisories/GHSA-wm7h-9275-46v2

Unfortunately, it also introduces a bug where the file size limit is 1 byte off:

https://github.com/mscdex/busboy/issues/297

If we were to update the graphql-upload dependency busboy to v1 with that bug, imagine how many apps have public facing labels on file upload inputs saying things like “max 4 MB file size” and users would try to upload an exactly 4 MB file and it would be erroring. To avoid having to update our front ends to say “max 3.999999 MB” we would have to change our graphql-upload maxFileSize config in GraphQL APIs to be the real limit we want + 1. But then, if this busboy bug is fixed in a patch release, suddenly files 1 byte too big will start being accepted which could have who knows what problems further down the line in our systems depending how the files are used.

We might be forced to publish a major release of graphql-upload that only bumps busboy to v1, but with a big warning in the changelog entry that explains this outstanding busboy bug and that people should be aware of the dilemma and deal with it as best as they can.

Issue Analytics

  • State:closed
  • Created a year ago
  • Reactions:1
  • Comments:14 (10 by maintainers)

github_iconTop GitHub Comments

3reactions
jaydensericcommented, May 28, 2022

This work has been published in v15.0.0! Please test this update in your projects and hopefully we didn’t introduce any new bugs in the rush 🙏

1reaction
jaydensericcommented, May 27, 2022

ETA within the hour. I’m about to push a commit up.

Read more comments on GitHub >

github_iconTop Results From Across the Web

busboy - npm
A node.js module for parsing incoming HTML form data. Changes (breaking or otherwise) in v1.0.0 can be found here. Requirements.
Read more >
await-busboy-latest - npm Package Health Analysis - Snyk
We found that await-busboy-latest demonstrates a positive version release cadence with at least one new version released in the past 12 months.
Read more >
Error while installing multer packages using npm
you can update multer to 1.4.5 as the latest version with npm i ... busboy@1.0.0 ... This is due to vulnerability in dicer...
Read more >
@types/busboy NPM | npm.io
@types/busboy v1.5.0 ... This package contains type definitions for busboy ... Last updated: Tue, 22 Mar 2022 05:31:42 GMT; Dependencies: @types/node ...
Read more >
Node.js microagent release notes - Sqreen
2.0.1 - 30 June 2022¶. Fixed vulnerable busboy dependency ... Remove dependency to node-pre-gyp; Update IAST rule handling ... 1.9.1¶. Login v1.5 ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found