Skip to content

chore(deps): bump multer and @nestjs/platform-express - #155

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-efec0cc522
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-efec0cc522

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026

Copy link
Copy Markdown
Contributor

Bumps multer to 2.5.0 and updates ancestor dependency @nestjs/platform-express. These dependencies need to be updated together.

Updates multer from 2.4.0 to 2.5.0

Release notes

Sourced from multer's releases.

v2.5.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/multer@v2.4.0...v2.5.0

Changelog

Sourced from multer's changelog.

2.5.0

  • Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
  • Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
  • Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)
Commits
  • 2c380d0 2.5.0 (#1490)
  • 80a2d9d fix: swallow late busboy error after teardown
  • c901d48 chore(deps): bump github/codeql-action/analyze to 4.38.2 (#1486)
  • ba3619a chore(deps): bump github/codeql-action/upload-sarif (#1487)
  • 0b72081 chore(deps): bump github/codeql-action/init to 4.38.2 (#1488)
  • 7661ce7 fix: allow a field value exactly at the fieldSize limit (#1481)
  • 6dac92f fix: don't add a failed upload to the abort cleanup list (#1489)
  • dd9f062 docs: fix typo in .none() and grammar in .any() (#1485)
  • See full diff in compare view

Updates @nestjs/platform-express from 11.2.7 to 12.3.2

Release notes

Sourced from @​nestjs/platform-express's releases.

v12.3.0 (2026-10-27)

Features

Bug fixes

... (truncated)

Commits
  • a415cff chore(release): publish v12.3.2 release
  • 9576609 chore(release): publish v12.3.1 release
  • 3acb8e5 chore(release): publish v12.3.0 release
  • 0eef541 fix(deps): update dependency multer to v2.5.0 [security] (#18268)
  • 0c9db73 fix(express): map unsupported multipart content types to 415 (#18264)
  • 0fb57c8 fix(core,express,fastify,ws,socket.io): load adapters with an older core (#18...
  • cb4d9ff fix(express): end a head response for an empty streamable file (#18234)
  • a4d86df fix(express): leave 5xx http-errors errors unmapped so they are logged (#18232)
  • 769e89e fix(express): apply middleware to controller root routes in strict mode
  • 7ea8765 fix(express): map http-errors errors to http exceptions (#18214)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [multer](https://github.com/expressjs/multer) to 2.5.0 and updates ancestor dependency [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express). These dependencies need to be updated together.


Updates `multer` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.4.0...v2.5.0)

Updates `@nestjs/platform-express` from 11.2.7 to 12.3.2
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.3.2/packages/platform-express)

---
updated-dependencies:
- dependency-name: multer
  dependency-version: 2.5.0
  dependency-type: indirect
- dependency-name: "@nestjs/platform-express"
  dependency-version: 12.3.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 31, 2026
@coderabbitai

coderabbitai Bot commented Oct 31, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 92646415-17e2-4d06-b585-b519c26e5a96

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants