Lucie GermainandClaude Opus 4.8 cc741ec2f1 [Security upgrade] bump multer 2.1.1 -> 2.2.0 (web + clsi) (#34916) ...

GHSA-72gw-mp4g-v24j / CVE-2026-5079 — DoS via deeply nested field names,
patched in 2.2.0. multer is a direct dep of web and clsi (file uploads).

- bump multer to 2.2.0 in services/web and services/clsi
- re-target the Overleaf local patch (attach files with no filename as
  'undefined' instead of skipping) from 2.1.1 to 2.2.0, kept as a scoped
  root resolution to match the repo's patch convention

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 0d10137b521ebaacee71fc41adba32c4530a4041

2026-09-17 11:19:49 +00:00

..

chat

Merge pull request #33361 from overleaf/copilot/remove-direct-use-of-body-parser

2026-09-17 11:14:46 +00:00

clsi

[Security upgrade] bump multer 2.1.1 -> 2.2.0 (web + clsi) (#34916)

2026-09-17 11:19:49 +00:00

docstore

Merge pull request #33361 from overleaf/copilot/remove-direct-use-of-body-parser

2026-09-17 11:14:46 +00:00

document-updater

Merge pull request #33361 from overleaf/copilot/remove-direct-use-of-body-parser

2026-09-17 11:14:46 +00:00

filestore

Merge pull request #33361 from overleaf/copilot/remove-direct-use-of-body-parser

2026-09-17 11:14:46 +00:00

git-bridge

Revert "[git-bridge] Setup ArtifactRegistry for maven central proxy (#35167)" (#35178)

2026-09-17 11:17:19 +00:00

history-v1

[Node 24.17.0][Core packages] Bump yauzl to ^3.4.0 in history-v1 and web for Node 24.17 (#35093)

2026-09-17 11:19:46 +00:00

notifications

Merge pull request #33361 from overleaf/copilot/remove-direct-use-of-body-parser

2026-09-17 11:14:46 +00:00

project-history

Merge pull request #33361 from overleaf/copilot/remove-direct-use-of-body-parser

2026-09-17 11:14:46 +00:00

real-time

[Security upgrade] bump socket.io-client fork to ws@^8.21.0 (#35060)

2026-09-17 11:15:42 +00:00

web

[Security upgrade] bump multer 2.1.1 -> 2.2.0 (web + clsi) (#34916)

2026-09-17 11:19:49 +00:00