Update dependency multer to v2.4.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
multer	2.3.0 → 2.4.0

---

Release Notes

expressjs/multer (multer)

v2.4.0

Compare Source

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#​1416)
• Accept a function for limits, called with the request, to set limits per request (#​1133)
• Add opt-in flush option to DiskStorage to fsync files before the callback runs (#​1458)
• Expose busboy's defCharset, highWaterMark and fileHwm options (#​1465)
• Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#​1466)
• Allow multer.diskStorage() to be called without options (#​1471)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#​1473)
• Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#​1478)
• Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#​1395, #​1335)
• Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#​1446)
• Files skipped by fileFilter no longer count towards maxCount (#​1426)
• Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#​426)
• Remove the concat-stream dependency (#​1356)
• Docs: add JSDoc to the public API and document the storage engine stream contract (#​1467, #​1468)
• Docs: add FormData upload examples (#​896)
• Docs: remove the translated READMEs (#​1463)
• Internal: run the test suite on macOS (#​1464)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 3c9482d5-9e1a-4cdf-8e14-ccb2ea77760b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.89%. Comparing base (d982935) to head (34c78c0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #997   +/-   ##
=======================================
  Coverage   97.89%   97.89%           
=======================================
  Files          91       91           
  Lines        3084     3084           
  Branches      537      537           
=======================================
  Hits         3019     3019           
  Misses         23       23           
  Partials       42       42           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.