fix: update upload and websocket dependencies

[CoderLuii]

What changed

• update ws to 8.21.1, multer to 2.2.0, DOMPurify to 3.4.12, and Express to 4.22.2
• refresh Express's compatible path-to-regexp resolution to 0.1.13
• set Multer's fieldNestingDepth to 0 for image, attachment, voice, and file-tree uploads
• add a regression test that sends a nested multipart field and verifies Multer rejects it with LIMIT_FIELD_NESTING

Why

The previous lock still matched current advisories for WebSocket fragment exhaustion, nested and aborted multipart uploads, DOMPurify configuration bypasses, and path-to-regexp ReDoS. The relevant reports include GHSA-96hv-2xvq-fx4p, GHSA-72gw-mp4g-v24j, GHSA-3p4h-7m6x-2hcm, GHSA-cmwh-pvxp-8882, and GHSA-37ch-88jc-xwx2.

HolyClaude currently carries the same dependency correction in its vendored CloudCLI 1.36.3 build. This applies the fix to current CloudCLI 1.37.0 so downstream images do not need to keep patching these dependencies.

The lockfile audit total drops from 51 to 45. ws, multer, dompurify, and path-to-regexp no longer appear in the audit findings. The remaining findings are unrelated to this change.

Verification

• npm ci
• npm ls dompurify express multer ws path-to-regexp --all
• npx tsx --tsconfig server/tsconfig.json --test server/shared/tests/multipart-upload-limits.test.ts
• npm run typecheck
• npm run lint (0 errors; existing warnings remain)
• npm run build
• full server suite in the Node 26.5.0 Bookworm container with TSX_TSCONFIG_PATH=server/tsconfig.json npm test
• git diff --check

Summary by CodeRabbit

• New Features

  • Added consistent protection against nested multipart form fields across image, attachment, file, and audio uploads.
  • Upload requests using nested field structures are now rejected with a clear validation error.

• Bug Fixes

  • Improved consistency of multipart upload validation across supported upload flows.

• Chores

  • Updated several runtime dependencies, including Express, Multer, DOMPurIFY, and WebSocket support.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change defines a shared multipart field nesting limit, applies it to three upload areas, updates related dependencies and ESLint boundaries, and adds an integration test for rejecting nested fields.

Changes

Multipart upload validation

Layer / File(s)	Summary
Shared limit contract and dependency alignment server/shared/multipart-upload-limits.ts, eslint.config.js, package.json	Defines FLAT_MULTIPART_FIELD_NESTING_DEPTH as 0, classifies the shared module, and updates runtime dependency ranges.
Upload handler enforcement and validation server/modules/assets/assets.routes.ts, server/modules/file-tree/file-tree.module.ts, server/modules/voice/voice.module.ts, server/shared/tests/multipart-upload-limits.test.ts	Applies the shared Multer limit to upload middleware and verifies nested fields return HTTP 422 with LIMIT_FIELD_NESTING.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Multer
  participant Express
  Client->>Multer: Submit multipart field nested[value]
  Multer->>Multer: Apply fieldNestingDepth = 0
  Multer-->>Express: Return LIMIT_FIELD_NESTING
  Express-->>Client: Respond HTTP 422

Loading

Suggested reviewers: blackmammoth

Poem

I’m a rabbit with uploads flat,
No nested fields beneath my hat.
Multer guards the meadow gate,
Tests confirm the error state.
Hop, hop—clean fields arrive!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches a real part of the change by calling out upload and websocket dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

server/shared/tests/multipart-upload-limits.test.ts (1)

10-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Exercise the production upload handlers in addition to this isolated Multer test.

This test proves that the option rejects nested[value], but it uses a newly created Multer instance rather than the assets, file-tree, or voice middleware. Add at least one request through each affected upload route so a future handler can’t drop the shared limit without failing regression coverage.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/shared/tests/multipart-upload-limits.test.ts` around lines 10 - 31,
Extend multipart upload limit coverage beyond the isolated Multer instance by
issuing requests through each affected production upload route, including the
assets, file-tree, and voice handlers. Assert that nested fields are rejected
with the expected limit error/status, ensuring each route preserves the shared
FLAT_MULTIPART_FIELD_NESTING_DEPTH configuration.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@server/shared/tests/multipart-upload-limits.test.ts`:
- Around line 10-31: Extend multipart upload limit coverage beyond the isolated
Multer instance by issuing requests through each affected production upload
route, including the assets, file-tree, and voice handlers. Assert that nested
fields are rejected with the expected limit error/status, ensuring each route
preserves the shared FLAT_MULTIPART_FIELD_NESTING_DEPTH configuration.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e6d75ead-465c-478d-9178-3ead3e1e7ee2

📥 Commits

Reviewing files that changed from the base of the PR and between 264e094 and 240e342.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

• eslint.config.js
• package.json
• server/modules/assets/assets.routes.ts
• server/modules/file-tree/file-tree.module.ts
• server/modules/voice/voice.module.ts
• server/shared/multipart-upload-limits.ts
• server/shared/tests/multipart-upload-limits.test.ts