From 984131f785706742385281c8b6a91918f4f30751 Mon Sep 17 00:00:00 2001 From: Timo Sand Date: Fri, 8 Aug 2025 15:24:01 +0300 Subject: [PATCH 1/2] Upgrade express-openapi-validator to 5.5.8 Signed-off-by: Timo Sand --- packages/backend-openapi-utils/package.json | 2 +- yarn.lock | 71 ++++++++++----------- 2 files changed, 36 insertions(+), 37 deletions(-) diff --git a/packages/backend-openapi-utils/package.json b/packages/backend-openapi-utils/package.json index 1f44279b3e..d5703f364d 100644 --- a/packages/backend-openapi-utils/package.json +++ b/packages/backend-openapi-utils/package.json @@ -53,7 +53,7 @@ "@types/express-serve-static-core": "^4.17.5", "ajv": "^8.16.0", "express": "^4.17.1", - "express-openapi-validator": "^5.0.4", + "express-openapi-validator": "^5.5.8", "express-promise-router": "^4.1.0", "get-port": "^5.1.1", "json-schema-to-ts": "^3.0.0", diff --git a/yarn.lock b/yarn.lock index b897f6e81f..787f53b955 100644 --- a/yarn.lock +++ b/yarn.lock @@ -203,7 +203,7 @@ __metadata: languageName: node linkType: hard -"@apidevtools/json-schema-ref-parser@npm:^11.0.0, @apidevtools/json-schema-ref-parser@npm:^11.7.0": +"@apidevtools/json-schema-ref-parser@npm:^11.0.0": version: 11.9.3 resolution: "@apidevtools/json-schema-ref-parser@npm:11.9.3" dependencies: @@ -214,6 +214,16 @@ __metadata: languageName: node linkType: hard +"@apidevtools/json-schema-ref-parser@npm:^14.0.3": + version: 14.1.1 + resolution: "@apidevtools/json-schema-ref-parser@npm:14.1.1" + dependencies: + "@types/json-schema": "npm:^7.0.15" + js-yaml: "npm:^4.1.0" + checksum: 10/c4332faf164c19764838e33cd8a7ef7c233ecaf3348e7c4470ef92d0c8c1c7ec2dbb1ce535d569bba52a4b1ef104d3f747da11f7a0f0bafdaee11b54ec826b49 + languageName: node + linkType: hard + "@apidevtools/openapi-schemas@npm:^2.1.0": version: 2.1.0 resolution: "@apidevtools/openapi-schemas@npm:2.1.0" @@ -3672,7 +3682,7 @@ __metadata: "@types/express-serve-static-core": "npm:^4.17.5" ajv: "npm:^8.16.0" express: "npm:^4.17.1" - express-openapi-validator: "npm:^5.0.4" + express-openapi-validator: "npm:^5.5.8" express-promise-router: "npm:^4.1.0" get-port: "npm:^5.1.1" json-schema-to-ts: "npm:^3.0.0" @@ -26566,7 +26576,7 @@ __metadata: languageName: node linkType: hard -"busboy@npm:^1.0.0, busboy@npm:^1.6.0": +"busboy@npm:^1.6.0": version: 1.6.0 resolution: "busboy@npm:1.6.0" dependencies: @@ -27771,18 +27781,6 @@ __metadata: languageName: node linkType: hard -"concat-stream@npm:^1.5.2": - version: 1.6.2 - resolution: "concat-stream@npm:1.6.2" - dependencies: - buffer-from: "npm:^1.0.0" - inherits: "npm:^2.0.3" - readable-stream: "npm:^2.2.2" - typedarray: "npm:^0.0.6" - checksum: 10/71db903c84fc073ca35a274074e8d26c4330713d299f8623e993c448c1f6bf8b967806dd1d1a7b0f8add6f15ab1af7435df21fe79b4fe7efd78420c89e054e28 - languageName: node - linkType: hard - "concat-stream@npm:^2.0.0": version: 2.0.0 resolution: "concat-stream@npm:2.0.0" @@ -31507,26 +31505,27 @@ __metadata: languageName: node linkType: hard -"express-openapi-validator@npm:^5.0.4": - version: 5.3.9 - resolution: "express-openapi-validator@npm:5.3.9" +"express-openapi-validator@npm:^5.5.8": + version: 5.5.8 + resolution: "express-openapi-validator@npm:5.5.8" dependencies: - "@apidevtools/json-schema-ref-parser": "npm:^11.7.0" + "@apidevtools/json-schema-ref-parser": "npm:^14.0.3" "@types/multer": "npm:^1.4.12" ajv: "npm:^8.17.1" ajv-draft-04: "npm:^1.0.0" - ajv-formats: "npm:^2.1.1" + ajv-formats: "npm:^3.0.1" content-type: "npm:^1.0.5" json-schema-traverse: "npm:^1.0.0" lodash.clonedeep: "npm:^4.5.0" lodash.get: "npm:^4.4.2" media-typer: "npm:^1.1.0" - multer: "npm:^1.4.5-lts.1" + multer: "npm:^2.0.2" ono: "npm:^7.1.3" - path-to-regexp: "npm:^8.1.0" + path-to-regexp: "npm:^8.2.0" + qs: "npm:^6.14.0" peerDependencies: express: "*" - checksum: 10/520e489c6ea10dbead42a6be4f56e3ba28fa9e6c1a24a70df6cde8e5378ed061a7d5b547922493185f04e418c53e40f9585ea84cd549458d10dd5f022e4d389d + checksum: 10/0396d4fd253fcd61725b632adcd805ac4ced940c34907775bedce39701d3b884e7a60357fa29c59d282407381c1fdcecceae6d0011684103e7ffe104038cb661 languageName: node linkType: hard @@ -39793,7 +39792,7 @@ __metadata: languageName: node linkType: hard -"mkdirp@npm:^0.5.1, mkdirp@npm:^0.5.4, mkdirp@npm:^0.5.5": +"mkdirp@npm:^0.5.1, mkdirp@npm:^0.5.5, mkdirp@npm:^0.5.6": version: 0.5.6 resolution: "mkdirp@npm:0.5.6" dependencies: @@ -40085,18 +40084,18 @@ __metadata: languageName: node linkType: hard -"multer@npm:^1.4.5-lts.1": - version: 1.4.5-lts.1 - resolution: "multer@npm:1.4.5-lts.1" +"multer@npm:^2.0.2": + version: 2.0.2 + resolution: "multer@npm:2.0.2" dependencies: append-field: "npm:^1.0.0" - busboy: "npm:^1.0.0" - concat-stream: "npm:^1.5.2" - mkdirp: "npm:^0.5.4" + busboy: "npm:^1.6.0" + concat-stream: "npm:^2.0.0" + mkdirp: "npm:^0.5.6" object-assign: "npm:^4.1.1" - type-is: "npm:^1.6.4" - xtend: "npm:^4.0.0" - checksum: 10/957c09956f3b7f79d8586cac5e2a50e9a5c3011eb841667b5e4590c5f31d9464f5b46aecd399c83e183a15b88b019cccf0e4fa5620db40bf16b9e3af7fab3ac6 + type-is: "npm:^1.6.18" + xtend: "npm:^4.0.2" + checksum: 10/4bdcb07138cf72f93adc08a0dc27c058faab9f6721067a58f394fa546d73d11b7f100cdd66e733d649d184f9d1b402065f6888b31ec427409f056ee92c4367a6 languageName: node linkType: hard @@ -42178,7 +42177,7 @@ __metadata: languageName: node linkType: hard -"path-to-regexp@npm:8.2.0, path-to-regexp@npm:^8.0.0, path-to-regexp@npm:^8.1.0": +"path-to-regexp@npm:8.2.0, path-to-regexp@npm:^8.0.0, path-to-regexp@npm:^8.1.0, path-to-regexp@npm:^8.2.0": version: 8.2.0 resolution: "path-to-regexp@npm:8.2.0" checksum: 10/23378276a172b8ba5f5fb824475d1818ca5ccee7bbdb4674701616470f23a14e536c1db11da9c9e6d82b82c556a817bbf4eee6e41b9ed20090ef9427cbb38e13 @@ -44849,7 +44848,7 @@ __metadata: languageName: node linkType: hard -"readable-stream@npm:^2.0.0, readable-stream@npm:^2.0.1, readable-stream@npm:^2.0.2, readable-stream@npm:^2.0.5, readable-stream@npm:^2.2.2, readable-stream@npm:^2.3.3, readable-stream@npm:^2.3.5, readable-stream@npm:^2.3.8, readable-stream@npm:~2.3.6": +"readable-stream@npm:^2.0.0, readable-stream@npm:^2.0.1, readable-stream@npm:^2.0.2, readable-stream@npm:^2.0.5, readable-stream@npm:^2.3.3, readable-stream@npm:^2.3.5, readable-stream@npm:^2.3.8, readable-stream@npm:~2.3.6": version: 2.3.8 resolution: "readable-stream@npm:2.3.8" dependencies: @@ -49180,7 +49179,7 @@ __metadata: languageName: node linkType: hard -"type-is@npm:^1.6.16, type-is@npm:^1.6.18, type-is@npm:^1.6.4, type-is@npm:~1.6.18": +"type-is@npm:^1.6.16, type-is@npm:^1.6.18, type-is@npm:~1.6.18": version: 1.6.18 resolution: "type-is@npm:1.6.18" dependencies: From 376035253953fb6040cb237bb1d1263eed0c3dcd Mon Sep 17 00:00:00 2001 From: Timo Sand Date: Fri, 8 Aug 2025 15:34:45 +0300 Subject: [PATCH 2/2] Add changeset Signed-off-by: Timo Sand --- .changeset/brave-pumas-attack.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/brave-pumas-attack.md diff --git a/.changeset/brave-pumas-attack.md b/.changeset/brave-pumas-attack.md new file mode 100644 index 0000000000..b08e3e5ff3 --- /dev/null +++ b/.changeset/brave-pumas-attack.md @@ -0,0 +1,5 @@ +--- +'@backstage/backend-openapi-utils': patch +--- + +Update `express-openapi-validator` to 5.5.8 to fix security vulnerability in transitive dependency `multer`