[dependabot]

Bumps multer from 2.4.0 to 2.5.0.

Release notes

Sourced from multer's releases.

v2.5.0

Important: Security

• Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)

What's Changed

• docs: fix typo in .none() and grammar in .any() by @​haimingZZ in expressjs/multer#1485
• fix: don't add a failed upload to the abort cleanup list by @​UlisesGascon in expressjs/multer#1489
• fix: allow a field value exactly at the fieldSize limit by @​MaxFreedomPollard in expressjs/multer#1481
• chore(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1488
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1487
• chore(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1486
• Release: 2.5.0 by @​UlisesGascon in expressjs/multer#1490

New Contributors

• @​haimingZZ made their first contribution in expressjs/multer#1485

Full Changelog: expressjs/multer@v2.4.0...v2.5.0

Changelog

Sourced from multer's changelog.

2.5.0

• Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
• Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
• Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)

Commits

• 2c380d0 2.5.0 (#1490)
• 80a2d9d fix: swallow late busboy error after teardown
• c901d48 chore(deps): bump github/codeql-action/analyze to 4.38.2 (#1486)
• ba3619a chore(deps): bump github/codeql-action/upload-sarif (#1487)
• 0b72081 chore(deps): bump github/codeql-action/init to 4.38.2 (#1488)
• 7661ce7 fix: allow a field value exactly at the fieldSize limit (#1481)
• 6dac92f fix: don't add a failed upload to the abort cleanup list (#1489)
• dd9f062 docs: fix typo in .none() and grammar in .any() (#1485)
• See full diff in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: pierreb-devkit/Node
• Branch: master
• File: .coderabbit.yaml
• Commit: 695ad5b
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 658a2ea8-4ff3-456e-8b6c-a1e468c5944a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}