[dependabot]

Bumps multer from 2.0.2 to 2.4.0.

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

What's Changed

• docs: remove README translations by @​UlisesGascon in expressjs/multer#1463
• ci: add macOS to the test matrix by @​kilisamemarisaaa in expressjs/multer#1464
• feat. improve wording for LIMIT_UNEXPECTED_FILE error code by @​flashbag in expressjs/multer#426
• feat: add filename to file errors by @​UjjwalKumar239 in expressjs/multer#1416
• refactor: remove concat-stream dependency by @​Phillip9587 in expressjs/multer#1356
• fix: reject non-integer fileSize limits by @​abhu85 in expressjs/multer#1395
• fix: allow exactly limits.parts parts by @​deepakganesh78 in expressjs/multer#1446
• fix: do not consume maxCount for files skipped by fileFilter by @​Sagargupta16 in expressjs/multer#1426
• fix: validate all limits at construction time by @​ShubhamOulkar in expressjs/multer#1335
• test: cover storage engine _removeFile invocation semantics by @​kilisamemarisaaa in expressjs/multer#1460
• feat: accept a function for limits by @​hossein-zare in expressjs/multer#1133
• fix: add flush option to disk storage to fsync files before completion by @​kilisamemarisaaa in expressjs/multer#1458
• feat: expose busboy defCharset, highWaterMark and fileHwm options by @​UlisesGascon in expressjs/multer#1465
• docs: describe the file stream contract for storage engines by @​UlisesGascon in expressjs/multer#1468

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
• Accept a function for limits, called with the request, to set limits per request (#1133)
• Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
• Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
• Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
• Allow multer.diskStorage() to be called without options (#1471)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
• Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
• Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
• Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
• Files skipped by fileFilter no longer count towards maxCount (#1426)
• Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
• Remove the concat-stream dependency (#1356)
• Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
• Docs: add FormData upload examples (#896)
• Docs: remove the translated READMEs (#1463)
• Internal: run the test suite on macOS (#1464)

2.3.0

• Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)
• Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)
• Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)
• Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)
• Add MulterError codes INVALID_FIELD_NAME and STREAM_DESTROYED
• Add opt-in limits.fieldArrayIndexLimit to bound numeric array indexes in field names (#1438)
• Accept files whose size is exactly limits.fileSize (#1407)
• Preserve the caller's async context (AsyncLocalStorage) when calling next() (#1124)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in file.originalname (#1421)
• Do not crash when fileFilter invokes its callback more than once (#1427)
• Use a fallback message for MulterError codes without a mapping (#1448)
• Docs: clarify preservePath and parts, use crypto.randomBytes in the DiskStorage example (#1414, #1430, #1436)
• Docs: add Indonesian, Japanese and Tamil translations and refresh all translations from the current README (#1431, #1354, #1462)
• Internal: run the test suite on Windows (#1334)

2.2.0

• Fix CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm)
• Fix CVE-2026-5079 (GHSA-72gw-mp4g-v24j)

2.1.1

• Fix CVE-2026-3520 (GHSA-5528-5vmv-3xc2)
• fix error/abort handling

2.1.0

... (truncated)

Commits

• 35979e5 2.4.0 (#1469)
• b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
• e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
• 00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
• 8d5c3b7 feat: allow diskStorage without options (#1471)
• 02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
• bc3f72d fix: decode escaped field names, not just filenames (#1473)
• 2661325 docs: add JSDoc to the public API (#1467)
• 53337f9 fix: remove late-completing uploads aborted before the engine names them
• 7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity. It will be closed in two weeks if no further activity occurs. 1Password employees have been nudged.

[github-actions]

This pull request has been automatically closed due to inactivity. Please re-open if it is still required.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.