Bump multer from 1.4.5-lts.2 to 2.0.0
Open
Number: #951
Type: Pull Request
State: Open
Type: Pull Request
State: Open
Author:
![dependabot[bot]](https://github.com/dependabot.png)
dependabot[bot]
Association: Contributor
Comments: 0
dependabot[bot]Association: Contributor
Comments: 0
Created:
June 04, 2025 at 05:35 PM UTC
(12 months ago)
(12 months ago)
Updated:
June 04, 2025 at 05:35 PM UTC
(12 months ago)
(12 months ago)
Labels:
dependencies javascript
dependencies javascript
Description:
Bumps multer from 1.4.5-lts.2 to 2.0.0.
Release notes
Sourced from multer's releases.
v2.0.0
Important
- Breaking change: The minimum supported Node version is now 10.16.0
- Fix CVE-2025-47935 (GHSA-44fp-w29j-9vj5)
- Fix CVE-2025-47944 (GHSA-4pg4-qvpc-4q3h)
What's Changed
- 🐛 drain stream. fixes regression in node 18, remove old CI, set minimum node version, fix readme badges, add .npmrc
- fix: handle two busboy error events
- ♻️ fully drain stream
- 🥅 explicitly handle req error
- 🚨 lint:fix
- ⬆️ bump mocha
- docs: include release 2.0.0 details
Changelog
Sourced from multer's changelog.
2.0.0
- Breaking change: The minimum supported Node version is now 10.16.0
- Fix CVE-2025-47935 (GHSA-44fp-w29j-9vj5)
- Fix CVE-2025-47944 (GHSA-4pg4-qvpc-4q3h)
Commits
2c8505f🐛 drain stream. fixes regression in node 18, remove old CI, set minimum node ...bde1822ci: add ci pipeline toltsbranch (#1302)- See full diff in compare view
Maintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for multer since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Pull Request Statistics
Commits:
1
1
Files Changed:
2
2
Additions:
+5
+5
Deletions:
-5
-5
Package Dependencies
Security Advisories
Multer vulnerable to Denial of Service from maliciously crafted requests
GHSA-4pg4-qvpc-4q3h
CVE-2025-47944
HIGH
### Impact
A vulnerability in Multer versions >=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandle...
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
GHSA-44fp-w29j-9vj5
CVE-2025-47935
HIGH
### Impact
Multer <2.0.0 is vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is ...
Technical Details
| ID: | 874712 |
| UUID: | 2568002756 |
| Node ID: | PR_kwDOCH94Sc6ZEJzE |
| Host: | GitHub |
| Repository: | scriptex/node-rest-api |
| Merge State: | Unknown |