[dependabot]

Bumps multer to 2.5.0 and updates ancestor dependency express-openapi-validator. These dependencies need to be updated together.

Updates multer from 1.4.5-lts.1 to 2.5.0

Release notes

Sourced from multer's releases.

v2.5.0

Important: Security

• Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)

What's Changed

• docs: fix typo in .none() and grammar in .any() by @​haimingZZ in expressjs/multer#1485
• fix: don't add a failed upload to the abort cleanup list by @​UlisesGascon in expressjs/multer#1489
• fix: allow a field value exactly at the fieldSize limit by @​MaxFreedomPollard in expressjs/multer#1481
• chore(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1488
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1487
• chore(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1486
• Release: 2.5.0 by @​UlisesGascon in expressjs/multer#1490

New Contributors

• @​haimingZZ made their first contribution in expressjs/multer#1485

Full Changelog: expressjs/multer@v2.4.0...v2.5.0

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

... (truncated)

Changelog

Sourced from multer's changelog.

2.5.0

• Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
• Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
• Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)

2.4.0

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
• Accept a function for limits, called with the request, to set limits per request (#1133)
• Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
• Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
• Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
• Allow multer.diskStorage() to be called without options (#1471)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
• Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
• Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
• Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
• Files skipped by fileFilter no longer count towards maxCount (#1426)
• Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
• Remove the concat-stream dependency (#1356)
• Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
• Docs: add FormData upload examples (#896)
• Docs: remove the translated READMEs (#1463)
• Internal: run the test suite on macOS (#1464)

2.3.0

• Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)
• Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)
• Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)
• Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)
• Add MulterError codes INVALID_FIELD_NAME and STREAM_DESTROYED
• Add opt-in limits.fieldArrayIndexLimit to bound numeric array indexes in field names (#1438)
• Accept files whose size is exactly limits.fileSize (#1407)
• Preserve the caller's async context (AsyncLocalStorage) when calling next() (#1124)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in file.originalname (#1421)
• Do not crash when fileFilter invokes its callback more than once (#1427)
• Use a fallback message for MulterError codes without a mapping (#1448)
• Docs: clarify preservePath and parts, use crypto.randomBytes in the DiskStorage example (#1414, #1430, #1436)
• Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README (#1431, #1354, #1462)
• Internal: run the test suite on Windows (#1334)

2.2.0

• Fix CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm)
• Fix CVE-2026-5079 (GHSA-72gw-mp4g-v24j)

2.1.1

... (truncated)

Commits

• 2c380d0 2.5.0 (#1490)
• 80a2d9d fix: swallow late busboy error after teardown
• c901d48 chore(deps): bump github/codeql-action/analyze to 4.38.2 (#1486)
• ba3619a chore(deps): bump github/codeql-action/upload-sarif (#1487)
• 0b72081 chore(deps): bump github/codeql-action/init to 4.38.2 (#1488)
• 7661ce7 fix: allow a field value exactly at the fieldSize limit (#1481)
• 6dac92f fix: don't add a failed upload to the abort cleanup list (#1489)
• dd9f062 docs: fix typo in .none() and grammar in .any() (#1485)
• 35979e5 2.4.0 (#1469)
• b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.

Updates express-openapi-validator from 4.13.8 to 4.13.9

Commits

• See full diff in compare view