From 6cf8d4d73a93240fcbf3916f5de9f5ab0ac02d72 Mon Sep 17 00:00:00 2001 From: YANG QIA <2013xile@gmail.com> Date: Wed, 17 Jun 2026 23:38:33 +0800 Subject: [PATCH] fix: upgrade vulnerable dependencies (#9822) --- packages/core/database/package.json | 2 +- packages/core/server/package.json | 2 +- .../core/server/src/plugin-manager/deps.ts | 2 +- packages/core/utils/package.json | 2 +- .../plugin-file-manager/package.json | 2 +- yarn.lock | 42 ++++++------------- 6 files changed, 18 insertions(+), 34 deletions(-) diff --git a/packages/core/database/package.json b/packages/core/database/package.json index 40a84744ef8..12088cee54c 100644 --- a/packages/core/database/package.json +++ b/packages/core/database/package.json @@ -28,7 +28,7 @@ "semver": "^7.7.1", "sequelize": "^6.26.0", "umzug": "^3.1.1", - "uuid": "^9.0.1" + "uuid": "^11.1.1" }, "devDependencies": { "@types/glob": "^7.2.0" diff --git a/packages/core/server/package.json b/packages/core/server/package.json index 3f730c335f8..d727657b44c 100644 --- a/packages/core/server/package.json +++ b/packages/core/server/package.json @@ -47,7 +47,7 @@ "koa-send": "^5.0.1", "koa-static": "^5.0.0", "lodash": "^4.17.21", - "multer": "^1.4.5-lts.2", + "multer": "^2.1.1", "nanoid": "^3.3.11", "p-queue": "^6.6.2", "redis": "^5.10.0", diff --git a/packages/core/server/src/plugin-manager/deps.ts b/packages/core/server/src/plugin-manager/deps.ts index 44755181575..4ad6a556962 100644 --- a/packages/core/server/src/plugin-manager/deps.ts +++ b/packages/core/server/src/plugin-manager/deps.ts @@ -27,7 +27,7 @@ const deps: Record = { koa: '3.x', '@koa/cors': '5.x', '@koa/router': '13.x', - multer: '1.x', + multer: '2.x', '@koa/multer': '3.x', 'koa-bodyparser': '4.x', 'koa-static': '5.x', diff --git a/packages/core/utils/package.json b/packages/core/utils/package.json index 802d5293bf5..e8722a3c2e0 100644 --- a/packages/core/utils/package.json +++ b/packages/core/utils/package.json @@ -17,7 +17,7 @@ "handlebars": "^4.7.8", "ipaddr.js": "^1.9.1", "liquidjs": "^10.23.0", - "multer": "^1.4.5-lts.2", + "multer": "^2.1.1", "object-path": "^0.11.8", "ses": "^1.14.0" }, diff --git a/packages/plugins/@nocobase/plugin-file-manager/package.json b/packages/plugins/@nocobase/plugin-file-manager/package.json index 94df1008dbd..146bb416a61 100644 --- a/packages/plugins/@nocobase/plugin-file-manager/package.json +++ b/packages/plugins/@nocobase/plugin-file-manager/package.json @@ -31,7 +31,7 @@ "mime-match": "^1.0.2", "mime-types": "^3.0.1", "mkdirp": "~0.5.4", - "multer": "^1.4.5-lts.2", + "multer": "^2.1.1", "multer-s3": "^3.0.1", "multistream": "^4.1.0", "pdfjs-dist": "^5.3.31", diff --git a/yarn.lock b/yarn.lock index b510fd14f68..94402b91979 100644 --- a/yarn.lock +++ b/yarn.lock @@ -13460,7 +13460,7 @@ bundle-require@^5.1.0: dependencies: load-tsconfig "^0.2.3" -busboy@^1.0.0: +busboy@^1.0.0, busboy@^1.6.0: version "1.6.0" resolved "https://registry.npmmirror.com/busboy/-/busboy-1.6.0.tgz#966ea36a9502e43cdb9146962523b92f531f6893" integrity sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA== @@ -25634,18 +25634,15 @@ multer-s3@^3.0.1: html-comment-regex "^1.1.2" run-parallel "^1.1.6" -multer@^1.4.5-lts.2: - version "1.4.5-lts.2" - resolved "https://registry.npmmirror.com/multer/-/multer-1.4.5-lts.2.tgz#340af065d8685dda846ec9e3d7655fcd50afba2d" - integrity sha512-VzGiVigcG9zUAoCNU+xShztrlr1auZOlurXynNvO9GiWD1/mTBbUljOKY+qMeazBqXgRnjzeEgJI/wyjJUHg9A== +multer@^2.1.1: + version "2.1.1" + resolved "https://registry.npmjs.org/multer/-/multer-2.1.1.tgz#122d819244fbdfee1efddd9147426691014385b7" + integrity sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A== dependencies: append-field "^1.0.0" - busboy "^1.0.0" - concat-stream "^1.5.2" - mkdirp "^0.5.4" - object-assign "^4.1.1" - type-is "^1.6.4" - xtend "^4.0.0" + busboy "^1.6.0" + concat-stream "^2.0.0" + type-is "^1.6.18" multimatch@5.0.0, multimatch@^5.0.0: version "5.0.0" @@ -34871,10 +34868,10 @@ uuid@^10.0.0: resolved "https://registry.npmmirror.com/uuid/-/uuid-10.0.0.tgz#5a95aa454e6e002725c79055fd42aaba30ca6294" integrity sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ== -uuid@^11.0.3, uuid@^11.0.5, uuid@^11.1.0: - version "11.1.0" - resolved "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz#9549028be1753bb934fc96e2bca09bb4105ae912" - integrity sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A== +uuid@^11.0.3, uuid@^11.0.5, uuid@^11.1.0, uuid@^11.1.1: + version "11.1.1" + resolved "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz#f6d81d2e1c65d00762e5e29b16c5d2d995e208ad" + integrity sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ== uuid@^13.0.0: version "13.0.0" @@ -34896,7 +34893,7 @@ uuid@^8.2.0, uuid@^8.3.0, uuid@^8.3.2: resolved "https://registry.npmmirror.com/uuid/-/uuid-8.3.2.tgz#80d5b5ced271bb9af6c445f21a1a04c606cefbe2" integrity sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg== -uuid@^9.0.0, uuid@^9.0.1: +uuid@^9.0.0: version "9.0.1" resolved "https://registry.npmmirror.com/uuid/-/uuid-9.0.1.tgz#e188d4c8853cc722220392c424cd637f32293f30" integrity sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA== @@ -35675,19 +35672,6 @@ xdg-basedir@^3.0.0: resolved "https://registry.npmmirror.com/xdg-basedir/-/xdg-basedir-3.0.0.tgz#496b2cc109eca8dbacfe2dc72b603c17c5870ad4" integrity sha512-1Dly4xqlulvPD3fZUQJLY+FUIeqN3N2MM3uqe4rCJftAvOjFa3jFGfctOgluGx4ahPbUCsZkmJILiP0Vi4T6lQ== -xlsx@^0.17.0: - version "0.17.5" - resolved "https://registry.npmmirror.com/xlsx/-/xlsx-0.17.5.tgz#78b788fcfc0773d126cdcd7ea069cb7527c1ce81" - integrity sha512-lXNU0TuYsvElzvtI6O7WIVb9Zar1XYw7Xb3VAx2wn8N/n0whBYrCnHMxtFyIiUU1Wjf09WzmLALDfBO5PqTb1g== - dependencies: - adler-32 "~1.2.0" - cfb "^1.1.4" - codepage "~1.15.0" - crc-32 "~1.2.0" - ssf "~0.11.2" - wmf "~1.0.1" - word "~0.3.0" - "xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz": version "0.20.3" resolved "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz#992725af0bb69fa9733590fcb8ab4a57e10b929b"