Skip to content

[Fix] Dependabot security issue: Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content #880

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sbarrio merged 1 commit into from
May 20, 2025
Merged

[Fix] Dependabot security issue: Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content #880

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@
"axios": "1.8.2",
"nanoid": "3.3.8",
"send": "0.19.0",
"serve-static": "1.16.0"
"serve-static": "1.16.0",
"formidable": "3.5.3"
}
}
41 changes: 21 additions & 20 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3338,6 +3338,13 @@ __metadata:
languageName: node
linkType: hard

"@noble/hashes@npm:^1.1.5":
version: 1.8.0
resolution: "@noble/hashes@npm:1.8.0"
checksum: c94e98b941963676feaba62475b1ccfa8341e3f572adbb3b684ee38b658df44100187fa0ef4220da580b13f8d27e87d5492623c8a02ecc61f23fb9960c7918f5
languageName: node
linkType: hard

"@nodelib/fs.scandir@npm:2.1.5":
version: 2.1.5
resolution: "@nodelib/fs.scandir@npm:2.1.5"
Expand Down Expand Up @@ -3885,6 +3892,15 @@ __metadata:
languageName: node
linkType: hard

"@paralleldrive/cuid2@npm:^2.2.2":
version: 2.2.2
resolution: "@paralleldrive/cuid2@npm:2.2.2"
dependencies:
"@noble/hashes": ^1.1.5
checksum: f7f6ac70e0268ec2c72e555719240d5c2c9a859ce541ac1c637eed3f3ee971b42881d299dedafbded53e7365b9e98176c5a31c442c1112f7e9e7306f2fd0ecbb
languageName: node
linkType: hard

"@pkgjs/parseargs@npm:^0.11.0":
version: 0.11.0
resolution: "@pkgjs/parseargs@npm:0.11.0"
Expand Down Expand Up @@ -10251,22 +10267,14 @@ __metadata:
languageName: node
linkType: hard

"formidable@npm:^1.2.1":
version: 1.2.6
resolution: "formidable@npm:1.2.6"
checksum: 2b68ed07ba88302b9c63f8eda94f19a460cef6017bfda48348f09f41d2a36660c9353137991618e0e4c3db115b41e4b8f6fa63bc973b7a7c91dec66acdd02a56
languageName: node
linkType: hard

"formidable@npm:^2.1.2":
version: 2.1.2
resolution: "formidable@npm:2.1.2"
"formidable@npm:3.5.3":
version: 3.5.3
resolution: "formidable@npm:3.5.3"
dependencies:
"@paralleldrive/cuid2": ^2.2.2
dezalgo: ^1.0.4
hexoid: ^1.0.0
once: ^1.4.0
qs: ^6.11.0
checksum: 81c8e5d89f5eb873e992893468f0de22c01678ca3d315db62be0560f9de1c77d4faefc9b1f4575098eb2263b3c81ba1024833a9fc3206297ddbac88a4f69b7a8
checksum: 501635c40d27285272959aca51f75ec0f1f7eeb9651c3865302033975a239f2dde8034720e2d2ef88579883bb38ef84b34c6d7f2ec397996ba4c713813051a4f
languageName: node
linkType: hard

Expand Down Expand Up @@ -11017,13 +11025,6 @@ __metadata:
languageName: node
linkType: hard

"hexoid@npm:^1.0.0":
version: 1.0.0
resolution: "hexoid@npm:1.0.0"
checksum: 27a148ca76a2358287f40445870116baaff4a0ed0acc99900bf167f0f708ffd82e044ff55e9949c71963852b580fc024146d3ac6d5d76b508b78d927fa48ae2d
languageName: node
linkType: hard

"hoist-non-react-statics@npm:3.x.x, hoist-non-react-statics@npm:^3.0.0, hoist-non-react-statics@npm:^3.3.0, hoist-non-react-statics@npm:^3.3.2":
version: 3.3.2
resolution: "hoist-non-react-statics@npm:3.3.2"
Expand Down
Loading