grok-cli-to-openai-compatible 1.7.6 → 1.7.7

package/CHANGELOG.md

@@ -10,6 +10,21 @@ Categories: **New features**, **Improvements**, **Fixes**, **Security**, **Depen
 
 Entries come from git history, tags, and [GitHub Releases](https://github.com/yanshekki/Grok-Cli-to-OpenAI-compatible/releases). A version that appears in `package.json` history but was never published to npm is marked. npm dates are the registry publish time in Hong Kong (UTC+8). Commit subjects are not rewritten into claims the commits do not make.
 
+## [1.7.7] - 2026-10-25
+
+### Security
+
+- Upgrade `multer` 1.4.5-lts.2 → **2.5.0** for CVE-2026-77078 (High multipart field-name DoS) and later 2.x multipart fixes including CVE-2026-113872. Upload routes still use `memoryStorage()`. Oversize and malformed multipart now map `MulterError` to **413** / **400** instead of 500.
+- Lock `body-parser` at **1.20.9** (CVE-2026-111181) via `overrides` so `express.json` / `urlencoded` pick up the patched transitive. Repo lockfile was on 1.20.8.
+- Operators: prefer Node **22.23.4+** or **24.22.1+** after the 2026-10-21 Node security releases (High Brotli OOB CVE-2026-111497). `engines` stays `>=20`.
+
+### Dependency upgrades
+
+- `express` range `^4.21.2` → `^4.22.3` (resolved version already 4.22.3).
+- `vite` 6.4.4 → **6.4.5** (GHSA-8g5g-mxqh-grgj, incomplete `server.fs.deny` backport; Admin Vite dev server only).
+- `typescript-eslint` 8.71.1 → **8.72.0**.
+- `@types/multer` 1.4.13 → **2.3.0** (multer 2 does not ship its own types).
+
 ## [1.7.6] - 2026-10-11
 
 ### Dependency upgrades

package/CHANGELOG.zh.md

@@ -10,6 +10,21 @@
 
 條目來自 git 歷史、標籤，以及 [GitHub Releases](https://github.com/yanshekki/Grok-Cli-to-OpenAI-compatible/releases)。`package.json` 有過、但未曾發佈到 npm 的版本會註明。npm 日期是登錄庫發佈時間（香港時間，UTC+8）。沒有把 commit 說明改寫成 commit 本身沒有的說法。
 
+## [1.7.7] - 2026-10-25
+
+### 安全
+
+- 將 `multer` 由 1.4.5-lts.2 升到 **2.5.0**，修 CVE-2026-77078（High，multipart 欄位名稱 DoS）以及其後 2.x 的 multipart 修正（含 CVE-2026-113872）。上傳路徑仍用 `memoryStorage()`。過大或格式錯誤的 multipart 會把 `MulterError` 對應成 **413**／**400**，不再變成 500。
+- 用 `overrides` 把 `body-parser` 鎖在 **1.20.9**（CVE-2026-111181），讓 `express.json`／`urlencoded` 用到已修的傳遞依賴。倉庫 lockfile 先前是 1.20.8。
+- 營運建議：2026-10-21 Node 安全更新之後，生產環境優先用 **22.23.4+** 或 **24.22.1+**（High Brotli 越界寫入 CVE-2026-111497）。`engines` 仍是 `>=20`。
+
+### 依賴升級
+
+- `express` 範圍 `^4.21.2` → `^4.22.3`（實際解析版本本來已是 4.22.3）。
+- `vite` 6.4.4 → **6.4.5**（GHSA-8g5g-mxqh-grgj，`server.fs.deny` 回移植不完整；只影響 Admin Vite 開發伺服器）。
+- `typescript-eslint` 8.71.1 → **8.72.0**。
+- `@types/multer` 1.4.13 → **2.3.0**（multer 2 不自帶型別）。
+
 ## [1.7.6] - 2026-10-11
 
 ### 依賴升級

package/README-ZH.md

@@ -739,6 +739,21 @@ gctoac setup|start|status|stop|doctor|logs|update
 
 這裡只列最近三個版本。較舊的版本在 [CHANGELOG.zh.md](./CHANGELOG.zh.md)。
 
+### 1.7.7 — 2026-10-25
+
+#### 安全
+
+- 將 `multer` 由 1.4.5-lts.2 升到 **2.5.0**，修 CVE-2026-77078（High，multipart 欄位名稱 DoS）以及其後 2.x 的 multipart 修正（含 CVE-2026-113872）。上傳路徑仍用 `memoryStorage()`。過大或格式錯誤的 multipart 會把 `MulterError` 對應成 **413**／**400**，不再變成 500。
+- 用 `overrides` 把 `body-parser` 鎖在 **1.20.9**（CVE-2026-111181），讓 `express.json`／`urlencoded` 用到已修的傳遞依賴。倉庫 lockfile 先前是 1.20.8。
+- 營運建議：2026-10-21 Node 安全更新之後，生產環境優先用 **22.23.4+** 或 **24.22.1+**（High Brotli 越界寫入 CVE-2026-111497）。`engines` 仍是 `>=20`。
+
+#### 依賴升級
+
+- `express` 範圍 `^4.21.2` → `^4.22.3`（實際解析版本本來已是 4.22.3）。
+- `vite` 6.4.4 → **6.4.5**（GHSA-8g5g-mxqh-grgj，`server.fs.deny` 回移植不完整；只影響 Admin Vite 開發伺服器）。
+- `typescript-eslint` 8.71.1 → **8.72.0**。
+- `@types/multer` 1.4.13 → **2.3.0**（multer 2 不自帶型別）。
+
 ### 1.7.6 — 2026-10-11
 
 #### 依賴升級
@@ -768,16 +783,6 @@ gctoac setup|start|status|stop|doctor|logs|update
 - CI 的 `actions/checkout` 與 `actions/setup-node` 由 v4 改為 v7。發佈 job 使用 Node 24，以便內建 npm 為 11.5.1 或更新。
 - 兩份 README 只保留最近三個版本，並按類別分組。完整記錄在 `CHANGELOG.md` 與 `CHANGELOG.zh.md`。
 
-### 1.7.4 — 2026-08-14
-
-#### 修正
-
-- Grok CLI 在檔案寫好之後以 exit `1` 結束時（`maxTurns`／失敗的 `use_tool` 複製），`/v1/images/generations` 仍交回 Imagine 圖片。Gateway 會取回今次 run 的 session 圖片與沙箱 `output.*`，串流期間輪詢並複製；`n=1` 一拿到檔案就停止行程。
-
-#### 內部／CI
-
-- 為 v1.7.3 的 i18n 字串重新建置 `public/admin/boot.js`。
-
 [完整更新日誌](./CHANGELOG.zh.md)
 
 ---
@@ -793,6 +798,7 @@ gctoac setup|start|status|stop|doctor|logs|update
 - 不要 commit `.env`，不要外洩 admin key／OTP  
 - 可完全關閉 Admin：`gctoac admin off`（只能用 `gctoac admin on` 重開）  
 - 一鍵更新／PM2／改 port 需 admin（視 admin key／OTP session 為 root）
+- 生產環境 Node：優先 **22.23.4+** 或 **24.22.1+**（2026-10-21 安全更新）。`engines` 仍是 `>=20`。
 
 ---
 

package/README.md

@@ -802,6 +802,21 @@ The changelog rule and the full steps are in [CONTRIBUTING.md](./CONTRIBUTING.md
 
 Only the latest three versions are listed here. Older releases are in [CHANGELOG.md](./CHANGELOG.md).
 
+### 1.7.7 — 2026-10-25
+
+#### Security
+
+- Upgrade `multer` 1.4.5-lts.2 → **2.5.0** for CVE-2026-77078 (High multipart field-name DoS) and later 2.x multipart fixes including CVE-2026-113872. Upload routes still use `memoryStorage()`. Oversize and malformed multipart now map `MulterError` to **413** / **400** instead of 500.
+- Lock `body-parser` at **1.20.9** (CVE-2026-111181) via `overrides` so `express.json` / `urlencoded` pick up the patched transitive. Repo lockfile was on 1.20.8.
+- Operators: prefer Node **22.23.4+** or **24.22.1+** after the 2026-10-21 Node security releases (High Brotli OOB CVE-2026-111497). `engines` stays `>=20`.
+
+#### Dependency upgrades
+
+- `express` range `^4.21.2` → `^4.22.3` (resolved version already 4.22.3).
+- `vite` 6.4.4 → **6.4.5** (GHSA-8g5g-mxqh-grgj, incomplete `server.fs.deny` backport; Admin Vite dev server only).
+- `typescript-eslint` 8.71.1 → **8.72.0**.
+- `@types/multer` 1.4.13 → **2.3.0** (multer 2 does not ship its own types).
+
 ### 1.7.6 — 2026-10-11
 
 #### Dependency upgrades
@@ -831,16 +846,6 @@ Only the latest three versions are listed here. Older releases are in [CHANGELOG
 - CI `actions/checkout` and `actions/setup-node` move from v4 to v7. The publish job uses Node 24 so the bundled npm is 11.5.1 or newer.
 - READMEs keep the latest three versions, by category. The full history is in `CHANGELOG.md` and `CHANGELOG.zh.md`.
 
-### 1.7.4 — 2026-08-14
-
-#### Fixes
-
-- `/v1/images/generations` returns the Imagine image when Grok CLI exits 1 after the file was written (`maxTurns` / failed `use_tool` copies). The gateway recovers this run’s session images and sandbox `output.*`, polls and copies during the stream, and for `n=1` stops the process once a file is in hand.
-
-#### Internal/CI
-
-- Rebuild `public/admin/boot.js` for the v1.7.3 i18n strings.
-
 [Full changelog](./CHANGELOG.md)
 
 ---
@@ -856,6 +861,7 @@ Only the latest three versions are listed here. Older releases are in [CHANGELOG
 - Never commit `.env` or share admin keys / OTP codes  
 - Admin can be fully disabled: `gctoac admin off` (re-enable only via `gctoac admin on`)  
 - One-click update / PM2 / port change require admin (treat admin keys / OTP sessions as root)
+- Production Node: prefer **22.23.4+** or **24.22.1+** (2026-10-21 security releases). `engines` remains `>=20`.
 
 ---
 

package/dist/middlewares/error.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.middleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/error.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAY/D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAEtF;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,YAAY,GAClB,IAAI,CAuCN"}
+{"version":3,"file":"error.middleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/error.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAc/D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAEtF;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,YAAY,GAClB,IAAI,CAkDN"}

package/dist/middlewares/error.middleware.js

@@ -1,7 +1,12 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.notFoundHandler = notFoundHandler;
 exports.errorMiddleware = errorMiddleware;
+const multer_1 = __importDefault(require("multer"));
+const env_1 = require("../config/env");
 const http_exception_1 = require("../exceptions/http.exception");
 const exception_factory_1 = require("../exceptions/exception.factory");
 const logger_1 = require("../utils/logger");
@@ -19,6 +24,16 @@ function errorMiddleware(err, req, res, _next) {
         res.status(httpErr.statusCode).json((0, http_exception_1.toProtocolErrorBody)(httpErr, path));
         return;
     }
+    // multer 2 raises MulterError instead of crashing on oversize / bad field names
+    if (err instanceof multer_1.default.MulterError) {
+        err =
+            err.code === 'LIMIT_FILE_SIZE'
+                ? exception_factory_1.ExceptionFactory.documentTooLarge(env_1.env.UPLOAD_MAX_BYTES)
+                : exception_factory_1.ExceptionFactory.validation(err.message || 'Invalid multipart upload', {
+                    multerCode: err.code,
+                    field: err.field,
+                });
+    }
     if (err instanceof http_exception_1.HttpException) {
         if (err.statusCode >= 500) {
             logger_1.logger.error({ err, requestId: req.requestId, path: req.path }, err.message);

package/dist/middlewares/error.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.middleware.js","sourceRoot":"","sources":["../../src/middlewares/error.middleware.ts"],"names":[],"mappings":";;AAYA,0CAEC;AAED,0CA4CC;AA3DD,iEAGsC;AACtC,uEAAmE;AACnE,4CAAyC;AAEzC,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,SAAgB,eAAe,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IAC9E,IAAI,CAAC,oCAAgB,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAY,EACZ,GAAY,EACZ,GAAa,EACb,KAAmB;IAEnB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE9B,gCAAgC;IAChC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,oCAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,IAAI,GAAG,YAAY,8BAAa,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC1B,eAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EACjD,GAAG,CAAC,OAAO,CACZ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAC5D,GAAG,CAAC,OAAO,CACZ,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,eAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAEnF,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,oCAAgB,CAAC,QAAQ,EAAE,CAAC;IAC5C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"error.middleware.js","sourceRoot":"","sources":["../../src/middlewares/error.middleware.ts"],"names":[],"mappings":";;;;;AAcA,0CAEC;AAED,0CAuDC;AAxED,oDAA4B;AAC5B,uCAAoC;AACpC,iEAGsC;AACtC,uEAAmE;AACnE,4CAAyC;AAEzC,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,SAAgB,eAAe,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IAC9E,IAAI,CAAC,oCAAgB,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAY,EACZ,GAAY,EACZ,GAAa,EACb,KAAmB;IAEnB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE9B,gCAAgC;IAChC,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,oCAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,gFAAgF;IAChF,IAAI,GAAG,YAAY,gBAAM,CAAC,WAAW,EAAE,CAAC;QACtC,GAAG;YACD,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAC5B,CAAC,CAAC,oCAAgB,CAAC,gBAAgB,CAAC,SAAG,CAAC,gBAAgB,CAAC;gBACzD,CAAC,CAAC,oCAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,IAAI,0BAA0B,EAAE;oBACrE,UAAU,EAAE,GAAG,CAAC,IAAI;oBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;iBACjB,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAAG,YAAY,8BAAa,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC1B,eAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EACjD,GAAG,CAAC,OAAO,CACZ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAC5D,GAAG,CAAC,OAAO,CACZ,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,eAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAEnF,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,oCAAgB,CAAC,QAAQ,EAAE,CAAC;IAC5C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,oCAAmB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-cli-to-openai-compatible",
-  "version": "1.7.6",
+  "version": "1.7.7",
   "description": "OpenAI-compatible API gateway for Grok CLI — with Admin panel, safe mode, and gctoac CLI",
   "keywords": [
     "grok",
@@ -83,10 +83,10 @@
     "cors": "^2.8.5",
     "dotenv": "^16.4.7",
     "execa": "5.1.1",
-    "express": "^4.21.2",
+    "express": "^4.22.3",
     "express-rate-limit": "^7.5.0",
     "helmet": "^8.0.0",
-    "multer": "^1.4.5-lts.1",
+    "multer": "^2.5.0",
     "pino": "^9.6.0",
     "pino-http": "^10.4.0",
     "prisma": "6.19.3",
@@ -96,7 +96,7 @@
     "@eslint/js": "^9.39.5",
     "@types/cors": "^2.8.17",
     "@types/express": "^4.17.21",
-    "@types/multer": "^1.4.12",
+    "@types/multer": "^2.3.0",
     "@types/node": "^22.13.10",
     "@vitest/coverage-v8": "^3.0.9",
     "eslint": "^9.39.5",
@@ -104,11 +104,14 @@
     "pino-pretty": "^13.0.0",
     "tsx": "^4.19.3",
     "typescript": "5.8",
-    "typescript-eslint": "^8.64.0",
-    "vite": "^6.4.3",
+    "typescript-eslint": "^8.72.0",
+    "vite": "^6.4.5",
     "vitest": "^3.0.9"
   },
   "engines": {
     "node": ">=20"
+  },
+  "overrides": {
+    "body-parser": "1.20.9"
   }
 }