chore(deps): bump @fastify/multipart from 9.4.0 to 10.1.0 - #1264
chore(deps): bump @fastify/multipart from 9.4.0 to 10.1.0#1264dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Coverage Report for CI Build 30253243187Coverage decreased (-0.005%) to 80.302%Details
Uncovered ChangesNo uncovered changes found. Coverage Regressions1 previously-covered line in 1 file lost coverage.
Coverage Stats
💛 - Coveralls |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine dependency bump with no source code changes required.
Extended reasoning...
Overview
This PR bumps @fastify/multipart from 9.4.0 to 10.1.0 (a major version jump upstream from 9.x to 10.x), touching only package.json and package-lock.json. No application source files were modified, which indicates the type surface used by this codebase (MultipartFile, MultipartValue, MultipartFields, the fastifyMultipart plugin registration options) remained compatible across the major bump — a real breaking API change would have caused a TypeScript compile failure in one of the several call sites (src/http/routes/s3/index.ts, src/http/routes/object/createObject.ts, updateObject.ts, uploadSignedObject.ts, src/http/plugins/signature-v4.ts, src/http/routes/s3/commands/put-object.ts).
Security risks
None introduced by this change itself. @fastify/multipart is used for parsing file uploads (object create/update, signed uploads, S3 multipart), so it is a security-relevant dependency in general, but the upstream release notes for 10.0.0/10.1.0 show only chores, doc fixes, dependency bumps (fastify-plugin 5→6), and one unrelated feature (saveRequestFiles return values) plus a fix for a part-iteration edge case — nothing indicating a regression in validation, limits enforcement, or size checks.
Level of scrutiny
Low-to-moderate. This is a mechanical dependency bump with a minimal diff confined to lockfile/manifest, consistent with the many other dependabot PRs already merged into this repo. The fact that no source changes were needed to accommodate the major version is a good signal of API compatibility.
Other factors
The bug-hunting system found no issues. There are no prior reviews or comments on this PR to reconcile. Given the change is isolated to dependency metadata and follows an established, frequently-merged pattern in this repo (see recent commit history of similar chore(deps) bumps), this does not require a large-scale design decision or touch CODEOWNER-sensitive logic.
69f9dd2 to
510ac26
Compare
Bumps [@fastify/multipart](https://github.com/fastify/fastify-multipart) from 9.4.0 to 10.1.0. - [Release notes](https://github.com/fastify/fastify-multipart/releases) - [Commits](fastify/fastify-multipart@v9.4.0...v10.1.0) --- updated-dependencies: - dependency-name: "@fastify/multipart" dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
510ac26 to
28b1bff
Compare
1 participant
Bumps @fastify/multipart from 9.4.0 to 10.1.0.
Release notes
Sourced from @fastify/multipart's releases.
Commits
0a8ab66Bumped v10.1.0a9d53e5fix: update module version9b3bf89fix: do not end parts() iteration while busboy still holds undelivered parts ...45023e0chore: bump@types/nodein the dev-dependencies-typescript group (#629)77b563edocs: fix broken linksd7475dachore: bump@fastify/swagger-uifrom 5.2.6 to 6.0.0 (#626)ed56b6fchore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group (#625)f79f996chore: update depedabot setting60e1b5cchore: use lf eol (#619)cddccd4refactor(types): migrate from tsd to tstyche (#617)