Skip to content

CHANGELOG.md

Latest commit

 

History

History
181 lines (120 loc) · 9.92 KB

CHANGELOG.md

File metadata and controls

181 lines (120 loc) · 9.92 KB
Raw

Change log

All notable changes to this project will be documented in this file. This project adheres to Semantic Versioning.

2.5.0

  • Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
  • Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#1481)
  • Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#1489)

2.4.0

  • Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
  • Accept a function for limits, called with the request, to set limits per request (#1133)
  • Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
  • Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
  • Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
  • Allow multer.diskStorage() to be called without options (#1471)
  • Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
  • Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
  • Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
  • Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
  • Files skipped by fileFilter no longer count towards maxCount (#1426)
  • Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
  • Remove the concat-stream dependency (#1356)
  • Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
  • Docs: add FormData upload examples (#896)
  • Docs: remove the translated READMEs (#1463)
  • Internal: run the test suite on macOS (#1464)

2.3.0

2.2.0

2.1.1

2.1.0

2.0.2

2.0.1

2.0.0

1.4.5-lts.2

  • Fix out-of-band error event from busboy (#1177)

1.4.5-lts.1

  • No changes

1.4.4-lts.1

  • Bugfix: Bump busboy to fix CVE-2022-24434 (#1097)
  • Breaking: Require Node.js 10.16.0 or later (#1097)

1.4.4 - 2021-12-07

  • Bugfix: Handle missing field names (#913)
  • Docs: Add Vietnamese translation (#803)
  • Docs: Improve Spanish translation (#948)

1.4.3 - 2021-08-09

  • Bugfix: Avoid deprecated pseudoRandomBytes function (#774)
  • Docs: Add Português Brazil translation for README (#758)
  • Docs: Clarify the callback calling convention (#775)
  • Docs: Add example on how to link to html multipart form (#580)
  • Docs: Add Spanish translation for README (#838)
  • Docs: Add Math.random() to storage filename example (#841)
  • Docs: Fix mistakes in russian doc (#869)
  • Docs: Improve Português Brazil translation (#877)
  • Docs: Update var to const in all Readmes (#1024)
  • Internal: Bump mkdirp version (#862)
  • Internal: Bump Standard version (#878)

1.4.2 - 2019-07-16

  • Docs: Add Russian translation for README (#662)
  • Docs: Patch zh-CN README base on newest README (#670)
  • Docs: Fix broken link in Readme (#679)
  • Docs: Fix broken link in Chinese Readme (#730)
  • Docs: Fix typo in Russian README (#738)
  • Docs: Add unit for fieldSize in busboy limit params (#734)
  • Internal: Make unit tests compatible with Node.js 13.x (#752)

1.4.1 - 2018-10-11

  • Bugfix: Make sure that req.file.buffer always is a Buffer

1.4.0 - 2018-09-26

  • Feature: Make Multer errors inherit from MulterError

1.3.1 - 2018-06-28

  • Bugfix: Bump vulnerable dependency

1.3.0 - 2017-01-25

  • Feature: Expose preservePath option

1.2.1 - 2016-12-14

  • Bugfix: Prevent Multiple Errors from Crashing

1.2.0 - 2016-08-04

  • Feature: add .none() for accepting only fields

1.1.0 - 2015-10-23

  • Feature: accept any file, regardless of fieldname

1.0.6 - 2015-10-03

  • Bugfix: always report limit errors

1.0.5 - 2015-09-19

  • Bugfix: drain the stream before considering request done

1.0.4 - 2015-09-19

  • Bugfix: propagate all errors from busboy

1.0.3 - 2015-08-06

  • Bugfix: ensure file order is correct

1.0.2 - 2015-08-06

  • Bugfix: don't hang when hitting size limit

1.0.1 - 2015-07-20

  • Bugfix: decrement pending writes on error

1.0.0 - 2015-07-18

  • Introduce storage engines
  • Specify expected fields
  • Follow the W3C JSON form spec