andras/fizika
andras/fizika
Watch
1
0
Fork
You've already forked fizika
 0
Code Issues Pull requests 10 Projects Releases Packages 1 Wiki Activity Actions

Update dependency multer to v2.5.0 #11

Open
andras wants to merge 1 commit from renovate/multer-2.x-lockfile into main
pull from: renovate/multer-2.x-lockfile
merge into: andras:main
Conversation 0 Commits 1 Files changed 1 +3 -80
andras commented 2026-09-19 21:01:43 +01:00
Owner
Copy link

This PR contains the following updates:

Package Type Update Change
multer dependencies minor 2.1.1 → 2.5.0

Release Notes

expressjs/multer (multer)

v2.5.0

Compare Source

  • Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
  • Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#​1481)
  • Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#​1489)

v2.4.0

Compare Source

  • Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#​1416)
  • Accept a function for limits, called with the request, to set limits per request (#​1133)
  • Add opt-in flush option to DiskStorage to fsync files before the callback runs (#​1458)
  • Expose busboy's defCharset, highWaterMark and fileHwm options (#​1465)
  • Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#​1466)
  • Allow multer.diskStorage() to be called without options (#​1471)
  • Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#​1473)
  • Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#​1478)
  • Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#​1395, #​1335)
  • Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#​1446)
  • Files skipped by fileFilter no longer count towards maxCount (#​1426)
  • Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#​426)
  • Remove the concat-stream dependency (#​1356)
  • Docs: add JSDoc to the public API and document the storage engine stream contract (#​1467, #​1468)
  • Docs: add FormData upload examples (#​896)
  • Docs: remove the translated READMEs (#​1463)
  • Internal: run the test suite on macOS (#​1464)

v2.3.0

Compare Source

v2.2.0

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [multer](https://github.com/expressjs/multer) | dependencies | minor | [`2.1.1` → `2.5.0`](https://renovatebot.com/diffs/npm/multer/2.1.1/2.5.0) | --- ### Release Notes <details> <summary>expressjs/multer (multer)</summary> ### [`v2.5.0`](https://github.com/expressjs/multer/blob/HEAD/CHANGELOG.md#250) [Compare Source](https://github.com/expressjs/multer/compare/v2.4.0...v2.5.0) - Fix [CVE-2026-113872](https://www.cve.org/CVERecord?id=CVE-2026-113872) ([GHSA-q7qp-rjg7-q26m](https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m)) - Accept a field value of exactly `limits.fieldSize` bytes, so `LIMIT_FIELD_VALUE` fires only when the limit is exceeded. This also covers the default `fieldSize` of 1MB, so a [`1048576`](https://github.com/expressjs/multer/commit/1048576) byte value is no longer rejected when you set no limits. If you set `fieldSize` one higher to work around this, you can drop the extra one ([#&#8203;1481](https://github.com/expressjs/multer/pull/1481)) - Do not add a file to the abort cleanup list when its storage engine reports an error after a `LIMIT_FILE_SIZE` abort; `DiskStorage` no longer tries to unlink an undefined path ([#&#8203;1489](https://github.com/expressjs/multer/pull/1489)) ### [`v2.4.0`](https://github.com/expressjs/multer/blob/HEAD/CHANGELOG.md#240) [Compare Source](https://github.com/expressjs/multer/compare/v2.3.0...v2.4.0) - Fix [CVE-2026-88932](https://www.cve.org/CVERecord?id=CVE-2026-88932) ([GHSA-3pph-fpjx-jg34](https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34)) - Add `filename` to `LIMIT_FILE_SIZE` and `LIMIT_UNEXPECTED_FILE` errors ([#&#8203;1416](https://github.com/expressjs/multer/pull/1416)) - Accept a function for `limits`, called with the request, to set limits per request ([#&#8203;1133](https://github.com/expressjs/multer/pull/1133)) - Add opt-in `flush` option to `DiskStorage` to fsync files before the callback runs ([#&#8203;1458](https://github.com/expressjs/multer/pull/1458)) - Expose busboy's `defCharset`, `highWaterMark` and `fileHwm` options ([#&#8203;1465](https://github.com/expressjs/multer/pull/1465)) - Add `streamHandler` option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) ([#&#8203;1466](https://github.com/expressjs/multer/pull/1466)) - Allow `multer.diskStorage()` to be called without options ([#&#8203;1471](https://github.com/expressjs/multer/pull/1471)) - Decode WHATWG-escaped characters (`%0A`, `%0D`, `%22`) in field names, matching `file.originalname` since 2.3.0: `req.body` keys, `file.fieldname` and `err.field` now carry the real name. If you matched the escaped spelling as a workaround, use the real name now ([#&#8203;1473](https://github.com/expressjs/multer/pull/1473)) - Report the decoded filename in `err.filename` on `LIMIT_FILE_SIZE` errors, matching `file.originalname` ([#&#8203;1478](https://github.com/expressjs/multer/pull/1478)) - Reject non-integer or negative `limits` values at construction time; a float limit silently disabled the check ([#&#8203;1395](https://github.com/expressjs/multer/pull/1395), [#&#8203;1335](https://github.com/expressjs/multer/pull/1335)) - Accept requests with exactly `limits.parts` parts; `LIMIT_PART_COUNT` now fires only when the limit is exceeded. If you set `parts` one higher to work around this, you can drop the extra one ([#&#8203;1446](https://github.com/expressjs/multer/pull/1446)) - Files skipped by `fileFilter` no longer count towards `maxCount` ([#&#8203;1426](https://github.com/expressjs/multer/pull/1426)) - Change the `LIMIT_UNEXPECTED_FILE` message to "Unexpected file field" ([#&#8203;426](https://github.com/expressjs/multer/pull/426)) - Remove the `concat-stream` dependency ([#&#8203;1356](https://github.com/expressjs/multer/pull/1356)) - Docs: add JSDoc to the public API and document the storage engine stream contract ([#&#8203;1467](https://github.com/expressjs/multer/pull/1467), [#&#8203;1468](https://github.com/expressjs/multer/pull/1468)) - Docs: add FormData upload examples ([#&#8203;896](https://github.com/expressjs/multer/pull/896)) - Docs: remove the translated READMEs ([#&#8203;1463](https://github.com/expressjs/multer/pull/1463)) - Internal: run the test suite on macOS ([#&#8203;1464](https://github.com/expressjs/multer/pull/1464)) ### [`v2.3.0`](https://github.com/expressjs/multer/blob/HEAD/CHANGELOG.md#230) [Compare Source](https://github.com/expressjs/multer/compare/v2.2.0...v2.3.0) - Fix [CVE-2026-77078](https://www.cve.org/CVERecord?id=CVE-2026-77078) ([GHSA-wc9g-mqfw-jrwm](https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm)) - Fix [CVE-2026-77037](https://www.cve.org/CVERecord?id=CVE-2026-77037) ([GHSA-qfvm-cv95-jqjf](https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf)) - Fix [CVE-2026-77063](https://www.cve.org/CVERecord?id=CVE-2026-77063) ([GHSA-qvfw-j98x-7q72](https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72)) - Fix [CVE-2026-82333](https://www.cve.org/CVERecord?id=CVE-2026-82333) ([GHSA-535w-7cp7-47q4](https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4)) - Add `MulterError` codes `INVALID_FIELD_NAME` and `STREAM_DESTROYED` - Add opt-in `limits.fieldArrayIndexLimit` to bound numeric array indexes in field names ([#&#8203;1438](https://github.com/expressjs/multer/pull/1438)) - Accept files whose size is exactly `limits.fileSize` ([#&#8203;1407](https://github.com/expressjs/multer/pull/1407)) - Preserve the caller's async context (`AsyncLocalStorage`) when calling `next()` ([#&#8203;1124](https://github.com/expressjs/multer/pull/1124)) - Decode WHATWG-escaped characters (`%0A`, `%0D`, `%22`) in `file.originalname` ([#&#8203;1421](https://github.com/expressjs/multer/pull/1421)) - Do not crash when `fileFilter` invokes its callback more than once ([#&#8203;1427](https://github.com/expressjs/multer/pull/1427)) - Use a fallback message for `MulterError` codes without a mapping ([#&#8203;1448](https://github.com/expressjs/multer/pull/1448)) - Docs: clarify `preservePath` and `parts`, use `crypto.randomBytes` in the `DiskStorage` example ([#&#8203;1414](https://github.com/expressjs/multer/pull/1414), [#&#8203;1430](https://github.com/expressjs/multer/pull/1430), [#&#8203;1436](https://github.com/expressjs/multer/pull/1436)) - Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README ([#&#8203;1431](https://github.com/expressjs/multer/pull/1431), [#&#8203;1354](https://github.com/expressjs/multer/pull/1354), [#&#8203;1462](https://github.com/expressjs/multer/pull/1462)) - Internal: run the test suite on Windows ([#&#8203;1334](https://github.com/expressjs/multer/pull/1334)) ### [`v2.2.0`](https://github.com/expressjs/multer/blob/HEAD/CHANGELOG.md#220) [Compare Source](https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0) - Fix [CVE-2026-5038](https://www.cve.org/CVERecord?id=CVE-2026-5038) ([GHSA-3p4h-7m6x-2hcm](https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm)) - Fix [CVE-2026-5079](https://www.cve.org/CVERecord?id=CVE-2026-5079) ([GHSA-72gw-mp4g-v24j](https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDMuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Update dependency multer to v2.4.0
All checks were successful
Deploy to Pages / deploy (pull_request) Successful in 6s
Details
Test / test (pull_request) Successful in 7s
Details
Build and Publish Docker Image / build-and-push (pull_request) Successful in 26s
Details
aecc7f023a
andras force-pushed renovate/multer-2.x-lockfile from aecc7f023a
All checks were successful
Deploy to Pages / deploy (pull_request) Successful in 6s
Details
Test / test (pull_request) Successful in 7s
Details
Build and Publish Docker Image / build-and-push (pull_request) Successful in 26s
Details
to f8a7f48bc5
All checks were successful
Deploy to Pages / deploy (pull_request) Successful in 2s
Details
Test / test (pull_request) Successful in 5s
Details
Build and Publish Docker Image / build-and-push (pull_request) Successful in 13s
Details
2026-10-22 16:27:51 +01:00 Compare
andras changed title from Update dependency multer to v2.4.0 to Update dependency multer to v2.5.0 2026-10-22 16:27:52 +01:00
All checks were successful
Deploy to Pages / deploy (pull_request) Successful in 2s
Details
Test / test (pull_request) Successful in 5s
Details
Build and Publish Docker Image / build-and-push (pull_request) Successful in 13s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/multer-2.x-lockfile:renovate/multer-2.x-lockfile
git switch renovate/multer-2.x-lockfile

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/multer-2.x-lockfile
git switch renovate/multer-2.x-lockfile
git rebase main
git switch main
git merge --ff-only renovate/multer-2.x-lockfile
git switch renovate/multer-2.x-lockfile
git rebase main
git switch main
git merge --no-ff renovate/multer-2.x-lockfile
git switch main
git merge --squash renovate/multer-2.x-lockfile
git switch main
git merge --ff-only renovate/multer-2.x-lockfile
git switch main
git merge renovate/multer-2.x-lockfile
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
dependencies
Pull requests that update a dependency file

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
github_actions
Pull requests that update GitHub Actions code

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
dependencies
documentation
duplicate
enhancement
github_actions
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
andras/fizika!11
No description provided.