[dependabot]

Bumps multer from 2.2.0 to 2.5.0.

Release notes

Sourced from multer's releases.

v2.5.0

Important: Security

• Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)

What's Changed

• docs: fix typo in .none() and grammar in .any() by @​haimingZZ in expressjs/multer#1485
• fix: don't add a failed upload to the abort cleanup list by @​UlisesGascon in expressjs/multer#1489
• fix: allow a field value exactly at the fieldSize limit by @​MaxFreedomPollard in expressjs/multer#1481
• chore(deps): bump github/codeql-action/init from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1488
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1487
• chore(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.2 by @​dependabot[bot] in expressjs/multer#1486
• Release: 2.5.0 by @​UlisesGascon in expressjs/multer#1490

New Contributors

• @​haimingZZ made their first contribution in expressjs/multer#1485

Full Changelog: expressjs/multer@v2.4.0...v2.5.0

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

... (truncated)

Changelog

Sourced from multer's changelog.

2.5.0

• Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
• Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
• Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)

2.4.0

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
• Accept a function for limits, called with the request, to set limits per request (#1133)
• Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
• Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
• Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
• Allow multer.diskStorage() to be called without options (#1471)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
• Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
• Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
• Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
• Files skipped by fileFilter no longer count towards maxCount (#1426)
• Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
• Remove the concat-stream dependency (#1356)
• Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
• Docs: add FormData upload examples (#896)
• Docs: remove the translated READMEs (#1463)
• Internal: run the test suite on macOS (#1464)

2.3.0

• Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)
• Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)
• Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)
• Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)
• Add MulterError codes INVALID_FIELD_NAME and STREAM_DESTROYED
• Add opt-in limits.fieldArrayIndexLimit to bound numeric array indexes in field names (#1438)
• Accept files whose size is exactly limits.fileSize (#1407)
• Preserve the caller's async context (AsyncLocalStorage) when calling next() (#1124)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in file.originalname (#1421)
• Do not crash when fileFilter invokes its callback more than once (#1427)
• Use a fallback message for MulterError codes without a mapping (#1448)
• Docs: clarify preservePath and parts, use crypto.randomBytes in the DiskStorage example (#1414, #1430, #1436)
• Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README (#1431, #1354, #1462)
• Internal: run the test suite on Windows (#1334)

Commits

• 2c380d0 2.5.0 (#1490)
• 80a2d9d fix: swallow late busboy error after teardown
• c901d48 chore(deps): bump github/codeql-action/analyze to 4.38.2 (#1486)
• ba3619a chore(deps): bump github/codeql-action/upload-sarif (#1487)
• 0b72081 chore(deps): bump github/codeql-action/init to 4.38.2 (#1488)
• 7661ce7 fix: allow a field value exactly at the fieldSize limit (#1481)
• 6dac92f fix: don't add a failed upload to the abort cleanup list (#1489)
• dd9f062 docs: fix typo in .none() and grammar in .any() (#1485)
• 35979e5 2.4.0 (#1469)
• b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Medium Risk
Multer sits on the Nest/Express file-upload path; the bump is lockfile-only but behavior and limit-handling fixes could affect edge-case uploads.

Overview
This PR only updates redisinsight/api/package-lock.json, resolving multer from 2.2.0 to 2.5.0. The app already pins multer through npm overrides (for @nestjs/platform-express multipart handling); there are no source or package.json changes in the diff.

The new lockfile entry also reflects upstream dropping the concat-stream dependency from multer’s tree. 2.5.0 brings a security fix (CVE-2026-113872) plus minor upload parsing/cleanup fixes from releases between 2.2.0 and 2.5.0.

^{Reviewed by Cursor Bugbot for commit 1d0ef7f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T20:32:03.530709Z	1d0ef7f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.