Skip to content

build(deps): bump multer from 2.4.0 to 2.5.0 in the npm-security group across 1 directory - #491

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-security-ee2592a201
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-security-ee2592a201

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-security group with 1 update in the / directory: multer.

Updates multer from 2.4.0 to 2.5.0

Release notes

Sourced from multer's releases.

v2.5.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.4.0...v2.5.0

Changelog

Sourced from multer's changelog.

2.5.0

  • Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
  • Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
  • Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)
Commits
  • 2c380d0 2.5.0 (#1490)
  • 80a2d9d fix: swallow late busboy error after teardown
  • c901d48 chore(deps): bump github/codeql-action/analyze to 4.38.2 (#1486)
  • ba3619a chore(deps): bump github/codeql-action/upload-sarif (#1487)
  • 0b72081 chore(deps): bump github/codeql-action/init to 4.38.2 (#1488)
  • 7661ce7 fix: allow a field value exactly at the fieldSize limit (#1481)
  • 6dac92f fix: don't add a failed upload to the abort cleanup list (#1489)
  • dd9f062 docs: fix typo in .none() and grammar in .any() (#1485)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.
Bumps the npm-security group with 1 update in the / directory: [multer](https://github.com/expressjs/multer).


Updates `multer` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.4.0...v2.5.0)

---
updated-dependencies:
- dependency-name: multer
  dependency-version: 2.5.0
  dependency-type: indirect
  dependency-group: npm-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

0 participants