Skip to content

Bump vulnerable dependencies#15

Open
danwald wants to merge 1 commit intomasterfrom
fix/dependabot-vulns
Open

Bump vulnerable dependencies#15
danwald wants to merge 1 commit intomasterfrom
fix/dependabot-vulns

Conversation

@danwald
Copy link
Copy Markdown
Owner

@danwald danwald commented Mar 16, 2026

Summary

Fixes open Dependabot alerts:

  • multer ^1.4.2 → ^2.1.1 (high — multiple CVEs including DoS and path traversal)
  • pm2 ^5.1.0 → ^6.0.0 (low)
  • Regenerated package-lock.json via npm install

Test plan

  • Verify app starts with node app.js
  • Verify file upload functionality still works with multer v2

🤖 Generated with Claude Code

- multer ^1.4.2 → ^2.1.1 (high)
- pm2 ^5.1.0 → ^6.0.0 (low)
- Regenerate package-lock.json

Fixes open Dependabot alerts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant