Repository navigation
fix: Bump @fastify/busboy from 3.0.0 to 3.2.3 - #629
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title starts with the required fix: prefix and uses a capitalized first word. It clearly describes the dependency security update. |
| Description check | |
The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the security issue, the lock-file-only approach, affected dependency versions, and why no tasks app… |
| Linked Issues check | |
Issue #623 requests an update of @fastify/busboy from 3.0.0 to 3.2.3. The whole-PR diff updates both package-lock.json dependency representations to 3.2.3 and updates the resolved URL and integrity ha… |
| Out of Scope Changes check | |
The whole-PR diff contains only the requested package-lock.json update for @fastify/busboy. The added MIT license field is dependency metadata that accompanies the lock-file update. No unrelated sourc… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Security Check | |
The pull request changes only package-lock.json. It replaces @fastify/busboy 3.0.0 with 3.2.3 in both lockfile sections and updates the matching registry URL and integrity hash. The resolved version r… |
| Engage In Review Feedback | |
No review feedback comments or actionable findings were supplied. Therefore, there was no feedback that required discussion, implementation, or reviewer agreement. |
Full details: Description check
-
Explanation
The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the security issue, the lock-file-only approach, affected dependency versions, and why no tasks apply.
Full details: Linked Issues check
-
Explanation
Issue
#623requests an update of@fastify/busboyfrom 3.0.0 to 3.2.3. The whole-PR diff updates both package-lock.json dependency representations to 3.2.3 and updates the resolved URL and integrity hash. No additional coding or test requirement appears in the issue.
Full details: Out of Scope Changes check
-
Explanation
The whole-PR diff contains only the requested package-lock.json update for
@fastify/busboy. The added MIT license field is dependency metadata that accompanies the lock-file update. No unrelated source, test, or configuration changes are present.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: Security Check
-
Explanation
The pull request changes only package-lock.json. It replaces
@fastify/busboy3.0.0 with 3.2.3 in both lockfile sections and updates the matching registry URL and integrity hash. The resolved version remains within firebase-admin 13.9.0's ^3.0.0 range. No application code, scripts, permissions, or new dependency sources changed. The supplied advisory context identifies 3.2.1 and 3.2.2 as the fixed versions, so 3.2.3 does not introduce the described vulnerabilities.
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #629 +/- ##
=======================================
Coverage 99.18% 99.18%
=======================================
Files 11 11
Lines 1841 1841
=======================================
Hits 1826 1826
Misses 15 15 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
## [8.5.7](8.5.6...8.5.7) (2026-10-17) ### Bug Fixes * Bump @fastify/busboy from 3.0.0 to 3.2.3 ([#629](#629)) ([2dd1986](2dd1986))
|
🎉 This change has been released in version 8.5.7 |
2 participants
Pull Request
Issue
Closes #623
The transitive dependency
@fastify/busboy3.0.0 is affected by two Dependabot security alerts:>= 1.0.0, < 3.2.1): Denial of service via a prototype-named multipart part header< 3.2.2): CRLF injection via the multipartContent-DispositionfilenameandnameparametersThey are fixed in 3.2.1 and 3.2.2 respectively.
@fastify/busboyis required as^3.0.0byfirebase-admin13.9.0. It is not a development dependency, so it is part of the production dependency tree.Approach
Lock-file-only update via
npm update @fastify/busboy. This resolves 3.2.3, the latest release, which is within the^3.0.0range offirebase-admin.The lock file changes are limited to
@fastify/busboy3.0.0 → 3.2.3. The package has no dependencies of its own and declares noenginesfield.Changes
taptonode:test(chore: migrate from tap to node:test and c8 fastify/busboy#168)Content-Dispositionparameters are parsed in compliance with RFC 2183/7578 (fix: enforce RFC 2183/7578 compliance for quoted Content-Disposition parameters fastify/busboy#194); compatibility fix for Node.js 24 (Fix Node.js 24 fastify/busboy#193); built-in modules are loaded with thenode:prefix (perf: usenode:prefix to bypass require.cache call for builtins fastify/busboy#186)lib/main.jstoindex.jsand the type definitions totypes/index.d.ts(refactor(types): migrate from tsd to tstyche and standardize entry points fastify/busboy#210); added thelimitevent to theBusboyFileStreamtypings (fix: add 'limit' event to BusboyFileStream typings fastify/busboy#191)nameorfilenamecontains a bare line break are skippedSee the GitHub releases of
@fastify/busboy.Breaking Changes
None. All are minor and patch releases within the
^3.0.0range offirebase-admin. The entry point move in 3.2.1 does not affectfirebase-admin, which requires the package root (require('@fastify/busboy')). The stricterContent-Dispositionhandling only applies to the busboy form-data parser, whichfirebase-admindoes not use.Code Changes Required
None — the upgrade is a drop-in replacement. This adapter imports only
firebase-admin/appandfirebase-admin/messaging.firebase-adminuses only the low-levelDicermultipart parser of@fastify/busboy, which it loads lazily inutils/api-request.jswhen a Google API response has amultipart/*content type; FCM send responses are JSON. It reads only the part bodies, not the part headers.Dicer.jsandPartStream.jsare unchanged between 3.0.0 and 3.2.3.The adapter's tests stub
sendEachForMulticast, so CI does not exercise@fastify/busboy; the assessment above is based on thefirebase-admin13.9.0 source.Tasks
No tasks apply; this PR only updates the lock file.
Summary by CodeRabbit