GitHub
09/23/2026, 2:05 AMGitHub
09/23/2026, 2:15 AMGitHub
09/23/2026, 4:05 AM<https://github.com/pact-foundation/pact-js-cli/tree/main|main> by renovate[bot]
<https://github.com/pact-foundation/pact-js-cli/commit/3464a44baeb710f63164c3716c400ea4bf26cc93|3464a44b> - chore(deps): pin dependencies (#186)
pact-foundation/pact-js-cliGitHub
09/23/2026, 8:52 AM<https://github.com/pact-foundation/pact-js-cli/tree/main|main> by renovate[bot]
<https://github.com/pact-foundation/pact-js-cli/commit/4eaf87e5b41d90a2fa2a93cb0b2a6cf59dea9b58|4eaf87e5> - chore(deps): update dependency eslint-import-resolver-typescript to v3.10.1 (#187)
pact-foundation/pact-js-cliGitHub
09/24/2026, 7:34 PMGitHub
09/25/2026, 6:41 AM<https://github.com/pact-foundation/pact-js-cli/tree/main|main> by renovate[bot]
<https://github.com/pact-foundation/pact-js-cli/commit/cc14c3481a1e786b977aa14e1f291f3a3a0b9d66|cc14c348> - chore(deps): update postgres docker digest to 5a5a84b (#188)
pact-foundation/pact-js-cliGitHub
09/25/2026, 2:31 PMpact-foundation
• stops external contributors being able to test anything that touches a broker
2. Disable publishing steps only for examples which do so
• stops external contributors being able to test anything that touches a broker
3. Hard code PACT_BROKER_TOKEN secret and export to env, if external org is not pact-foundation
• At least allows users/maintainers to test/confirm behaviour for anything that touches a broker
4. On contributor workflows, only run publishing steps on linux machines and use docker based locally running pact-broker
• would allow test of basic_auth based flows which are unsupported by the PactFlow broker
pact-foundation/pact-jsGitHub
09/25/2026, 2:31 PMnpm notice Publishing to <https://registry.npmjs.org/> with tag latest and public access
+ @pact-foundation/pact@14.0.0
done!
remote: error: GH013: Repository rule violations found for refs/heads/master.
remote: Review all repository rules at <https://github.com/pact-foundation/pact-js/rules?ref=refs%2Fheads%2Fmaster>
remote:
remote: - Required status check "Test completion check" is expected.
remote:
To <https://github.com/pact-foundation/pact-js>
* [new tag] v14.0.0 -> v14.0.0
! [remote rejected] master -> master (push declined due to repository rule violations)
error: failed to push some refs to '<https://github.com/pact-foundation/pact-js>'
This has stopped
• Updated package.json / lockfile from being committed back
• Updated changelog from being committed back
• A release from being created, with the appropriate changelog
furthermore, renovate auto-merged a PR after the release, meaning it's awkward to retrospectively update the changelog and version in a sequential manner.
Ideally the release workflow should work as before the new restrictions were applied, or the release workflow should be able to circumvent restrictions.
cc: @JP-Ellis
pact-foundation/pact-jsGitHub
09/25/2026, 4:14 PMGitHub
09/25/2026, 8:43 PMGitHub
09/26/2026, 10:31 AMGitHub
09/26/2026, 12:13 PM$ been incorrectly parsed as math syntax (#20140 by @fisker)
<!-- Input -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus `$BAR`from`c.sh`, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.
---
Configuration
📅 Schedule: (UTC)
• Branch creation
• At any time (no schedule defined)
• Automerge
• At any time (no schedule defined)
🚦 Automerge: Enabled.
♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
---
• If you want to rebase/retry this PR, check this box
---
This PR was generated by Mend Renovate. View the repository job log.
pact-foundation/pact-js-cliGitHub
09/26/2026, 12:54 PM<https://github.com/pact-foundation/pact-js-cli/tree/main|main> by renovate[bot]
<https://github.com/pact-foundation/pact-js-cli/commit/c872c48e33174bd54ed4a51a002fcbcacd674588|c872c48e> - chore(deps): update dependency prettier to v3.9.9 (#189)
pact-foundation/pact-js-cliGitHub
09/26/2026, 2:33 PMGitHub
09/27/2026, 10:09 PMGitHub
09/28/2026, 2:00 AM* 0-3 * * 1)
• Automerge
• At any time (no schedule defined)
🚦 Automerge: Enabled.
♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
---
• If you want to rebase/retry this PR, check this box
---
This PR was generated by Mend Renovate. View the repository job log.
pact-foundation/pact-js-cliGitHub
09/28/2026, 2:14 AM* 0-3 * * 1)
• Automerge
• At any time (no schedule defined)
🚦 Automerge: Enabled.
♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
---
• If you want to rebase/retry this PR, check this box
---
This PR was generated by Mend Renovate. View the repository job log.
pact-foundation/pact-js-coreGitHub
09/28/2026, 2:48 AM* 0-3 * * 1)
• Automerge
• At any time (no schedule defined)
🚦 Automerge: Enabled.
♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
---
• If you want to rebase/retry this PR, check this box
---
This PR was generated by Mend Renovate. View the repository job log.
pact-foundation/pact-jsGitHub
09/28/2026, 5:31 AM<https://github.com/pact-foundation/pact-js-cli/tree/main|main> by renovate[bot]
<https://github.com/pact-foundation/pact-js-cli/commit/7a8a64ac9499b8df6ee0e67deb0ffc489d274c8b|7a8a64ac> - chore(deps): lock file maintenance (#190)
pact-foundation/pact-js-cliGitHub
09/28/2026, 2:53 PM[4.2.0] - 2023-03-29
Added
• Add support for tsconfig extends as array of strings. #. See PR #245. Thanks to `@DanielSidhion` for this PR!
[3.14.2] - 2023-02-25
Fixed
• bump JSON5 from v1.0.1 to v1.0.2 in tsconfig-paths v3.14.1 to fix CVE-2022-46175 #234. See PR #234. Thanks to `@mihaiplesa` for this PR!
[4.1.2] - 2023-01-02
Fixed
• Bump JSON5 dependency to 2.2.2 to fix CVE-2022-46175. See PR #232. Thanks to `@oparisblue` for this PR!Commits • `11b774d` v4.2.0 • `c47106b` Add changelog for 4.2.0 • `5156ef1` Add support for extends as array of strings. (#245) • `910a138` Update changelog for 3.14.2 • `76dab76` v4.1.2 • `4a5bfee` Update changelog for 4.1.2 • `9721a98` Bump JSON5 dependency to 2.2.2 to fix CVE-2022-46175 (#232) • See full diff in compare view Dependabot compatibility score Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
pact-foundation/nestjs-pactGitHub
09/28/2026, 2:54 PMv21.2.3
21.2.3 (2026-09-19)
Bug Fixes
• fix(types): correct breaking-change-exclamation-mark rule config type by `@lazerg` in conventional-changelog/commitlint#4954
• fix(config-nx-scopes): read scopes from the nx project graph by `@dylanpulver` in conventional-changelog/commitlint#4957
• fix(lint): trim trailing whitespace off the message handed to ignore matchers by `@dylanpulver` in conventional-changelog/commitlint#4960
• fix(load): detect dynamic await support on node majors above 20 by `@dylanpulver` in conventional-changelog/commitlint#4961
• fix(rules): report the case that matched in case rule failure messages by `@dylanpulver` in conventional-changelog/commitlint#4962
• fix(load): run the parser factory of scoped conventional-changelog presets by `@maximilliangrand` in conventional-changelog/commitlint#4968
Refactor
• refactor(load): drop the node version check gating cosmiconfig loaders by `@dylanpulver` in conventional-changelog/commitlint#4972
Chore, ci, build, etc.
• build: install pnpm via npm instead of corepack by `@escapedcat` in conventional-changelog/commitlint#4948
• build: retire the docker compose dev environment by `@escapedcat` in conventional-changelog/commitlint#4949
• build: verify pnpm tarball against the packageManager sha512 pin by `@escapedcat` in conventional-changelog/commitlint#4952
• ci: stabilize Windows CI by raising Vitest default timeout by `@escapedcat` with `@Copilot` in conventional-changelog/commitlint#4959
• docs: drop the Node 24 config-loading workaround note by `@escapedcat` in conventional-changelog/commitlint#4976
• chore: move pnpm settings from .npmrc to pnpm-workspace.yaml by `@escapedcat` in conventional-changelog/commitlint#4977
• chore: swap pnpm resolutionMode time-based for minimumReleaseAge by `@escapedcat` in conventional-changelog/commitlint#4984
New Contributors
• `@lazerg` made their first contribution in conventional-changelog/commitlint#4954
• `@escapedcat` with `@Copilot` made their first contribution in conventional-changelog/commitlint#4959
• `@dylanpulver` made their first contribution in conventional-changelog/commitlint#4957
• `@maximilliangrand` made their first contribution in conventional-changelog/commitlint#4968
Full Changelog: conventional-changelog/commitlint@v21.2.2...v21.2.3
v21.2.2
21.2.2 (2026-08-13)
Bug Fixes
• parse: require colon after note keywords (conventional-commits-parser 7.1.2) (#4927) (b83c515), closes conventional-changelog/conventional-changelog#1517
• fix(container): resolve packages from TypeScript configs by `@Guflly` in conventional-changelog/commitlint#4914
• fix(resolve-extends): support Yarn Plug'n'Play by `@Guflly` in conventional-changelog/commitlint#4933
Chore, docs, etc.
• docs: fix typos in comments and JSDoc by `@maxtaran2010` in conventional-changelog/commitlint#4880... (truncated) Changelog Sourced from @commitlint/config-conventional's changelog.
21.2.3 (2026-09-19)
Bug Fixes
• rules: report the case that matched in case rule failure messages (#4962) (9f5f7bc)
21.2.2 (2026-08-13)
Note: Version bump only for package@commitlint/config-conventional
21.2.0 (2026-06-30)
Features
• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)
21.1.0 (2026-06-23)
Note: Version bump only for package@commitlint/config-conventional
21.0.2 (2026-05-29)
Note: Version bump only for package@commitlint/config-conventional
21.0.1 (2026-05-12)
Note: Version bump o…pact-foundation/nestjs-pact
GitHub
09/28/2026, 2:54 PM21.2.2 (2026-08-13)
Note: Version bump only for package@commitlint/config-conventional
21.2.0 (2026-06-30)
Features
• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)
21.1.0 (2026-06-23)
Note: Version bump only for package@commitlint/config-conventional
21.0.2 (2026-05-29)
Note: Version bump only for package@commitlint/config-conventional
21.0.1 (2026-05-12)
Note: Version bump only for package@commitlint/config-conventional
21.0.0 (2026-05-08)
• chore!: minimum node version v22 (#4679) (ac2b3f4), closes #4679
BREAKING CHANGES... (truncated) Commits • `d00d190` v21.2.2 • `3146d04` docs(config-conventional): document rules that go beyond the spec (#4910) • `f2e8dae` chore: update dependency typescript to v7 (#4886) • `1b4e5bc` v21.2.0 • `fdb566f` feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9... • `6f1c0af` v21.1.0 • `8069048` v21.0.2 • `db8d7d6` v21.0.1 • `1329a25` chore: migrate to pnpm (#4762) • `6099ae5` chore: replace eslint with oxlint (#4756) • Additional commits viewable in compare view Dependabot compatibility score You can trigger a rebase of this PR by commenting
@dependabot rebase.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.pact-foundation/nestjs-pact
GitHub
09/28/2026, 2:57 PM3.9.9
• Markdown: Fix text withbeen incorrectly parsed as math syntax (#20140 by `@fisker`)$
🔗 Changelog
3.9.8
• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by `@seiyab`)
🔗 Changelog
3.9.7
• Support Angular 22.2
• Fix regressions in v3.9
🔗 Changelog
3.9.6
What's Changed
• Preserve quotes for methods named(prettier/prettier#19621 by `@kovsu`)new
• Supportinimport deferparser (prettier/prettier#19624, prettier/prettier#19675 by `@fisker`)typescript
• Added a new official plugin `@prettier/plugin-yuku` :rocket: (prettier/prettier#19628, prettier/prettier#19629 by `@fisker`)
🔗 Changelog
3.9.5
🔗 Changelog
3.9.4
• Angular: Format->@content(name)to align with other block syntax (#19499 by `@fisker`)@content (name)
🔗 Changelog
3.9.3
• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by `@seiyab`)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by `@evoactivity`)
🔗 Changelog
3.9.1
• CLI: Fix ignored file has been cached incorrectly (#19483 by `@kovsu`)
🔗 Changelog
3.9.0
diff... (truncated) Changelog Sourced from prettier's changelog.
3.9.9
diff
Markdown: Fix text withbeen incorrectly parsed as math syntax (#20140 by `@fisker`)$
<!-- Input -->
Uses $FOO fromanda.sh, plusb.shfrom$BAR, before anything else runs here.c.sh
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.
3.9.8
diff
Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by `@seiyab`)
<!-- Input -->
Ifis not a [module](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, aWebAssembly.Module
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
3.9.7
diff
Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by `@Austin1serb`, `@giaBaoJS`)
<!-- Input -->
- [x] short first line.
</tr></table>... (truncated) Commits • `cdd17f2` Release 3.9.9 • `dc7b896` Disable
singleDollarTextMath in mdast-util-math (#20140)
• `f9be58f` Git blame ignore 3.9.8
• `88470cb` Bump Prettier dependency to 3.9.8
• `9559cab` Clean changelog_unreleased
• `4fc8ee8` Update dependents count
• `4f2ab67` Release 3.9.8
• `3d82af8` Update Regex related dependencies (#20082)
• `5ec8db1` [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• `5b142ed` Release Release `@prettier/plugin-hermes` `@0`.2.3, `@prettier/plugin-oxc` `@0`.2.3, an...
• Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for prettier since your current version.
Dependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for…
pact-foundation/nestjs-pactGitHub
09/28/2026, 2:57 PM3.9.6
What's Changed
• Preserve quotes for methods named(prettier/prettier#19621 by `@kovsu`)new
• Supportinimport deferparser (prettier/prettier#19624, prettier/prettier#19675 by `@fisker`)typescript
• Added a new official plugin `@prettier/plugin-yuku` :rocket: (prettier/prettier#19628, prettier/prettier#19629 by `@fisker`)
🔗 Changelog
3.9.5
🔗 Changelog
3.9.4
• Angular: Format->@content(name)to align with other block syntax (#19499 by `@fisker`)@content (name)
🔗 Changelog
3.9.3
• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by `@seiyab`)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by `@evoactivity`)
🔗 Changelog
3.9.1
• CLI: Fix ignored file has been cached incorrectly (#19483 by `@kovsu`)
🔗 Changelog
3.9.0
diff
🔗 Prettier 3.9: Major parser upgrades and Formatting improvements
3.8.5
• Fix Flow variance annotation print (#19022 by `@marcoww6`)
🔗 Changelog
3.8.4
• Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (prettier/prettier#17746 by `@byplayer`)
🔗 Changelog
3.8.3
• SCSS: Prevent trailing comma infunction (prettier/prettier#18471 by `@kovsu`)if()
🔗 Changelog... (truncated) Changelog Sourced from prettier's changelog.
3.9.6
diff
TypeScript: Preserve quotes for methods named(#19621 by `@kovsu`)new
// Input
interface Container {
"new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}
TypeScript: Support(#19624, #19675 by `@fisker`)import defer
// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";
JavaScript: Added a new official plugin(#19628, #19629 by `@fisker`)@prettier/plugin-yuku
is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).@prettier/plugin-yuku
This plugin includes two new parsers:(JavaScript syntax) andyuku(TypeScript syntax).yuku-ts
To use this plugin:
1. Install the plugin:
yarn add --dev prettier @prettier/plugin-yuku... (truncated) Commits • `8f0c950` Release 3.9.6 • `e910764` Update changelog • `ec3f1c7` Update typescript-eslint to v8.65.0 (#19675) • `73d2efc` Update Yuku parser to v0.7.0 (#19664) • `dd5e24e` Preserve quotes for
TSMethodSignature nodes named new (#19621)
• `c03ab4e` Update dependency eslint-plugin-unicorn to v72 (#19633)
• `b74dd53` Update Yuku parser to v0.6.5 (#19654)
• `f1b594e` Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• `0d9dfb6` Update Yuku parser to v0.6.4 (#19650)
• `3bbb815` Remove typescript-only directory (#19636)
• Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for prettier since your current version.
Dependabot compatibility score
You can trigger a rebase of this PR by commenting @dependabot rebase.
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will clo…
pact-foundation/nestjs-pactGitHub
09/28/2026, 11:06 PMprocess in case global is overwritten - by @AriPerkkio in #11343 (0b792)
• detect-async-leaks:
• Ignore process.stdio handles - by @AriPerkkio in #11333 (0fd6b)
• expect:
• Fix toMatchObject with asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in #11100 (42523)
• jsdom:
• Fix Request with Blob body on jsdom 28+ - by @harshit-d3v in #11295 (d1c3e)
• reporter:
• agent to respect --silent - by @Raj4478 and @AriPerkkio in #11271 (5b95e)
• reporters:
• Handle concurrent createReport calls - by @7rulnik in #11278 (e8e55)
• hanging-process to use ESM entrypoint - by @AriPerkkio in #11316 (4e91e)
• spy:
• Fix stack overflow when spying Set.prototype.add - by …
pact-foundation/pact-js-coreGitHub
09/28/2026, 11:06 PMGitHub
09/28/2026, 11:24 PMGitHub
09/29/2026, 12:39 AMv2.4.0
Highlights
multer finally supports Google Cloud Functions and Firebase 🎉
These platforms read the request body before your code runs, so multer's classicreceived nothing: emptyreq.pipe(busboy), emptyreq.body, and nearly a decade of duplicated issues.req.files
The newoption closes that gap: you decide how the body reaches the parser, so the pre-readstreamHandlerjust works (see image).rawBody
const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})
This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.
Important: Security
• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
What's Changed
• docs: remove README translations by `@UlisesGascon` in expressjs/multer#1463
• ci: add macOS to the test matrix by `@kilisamemarisaaa` in expressjs/multer#1464
• feat. improve wording for LIMIT_UNEXPECTED_FILE error code by `@flashbag` in expressjs/multer#426
• feat: add filename to file errors by `@UjjwalKumar239` in expressjs/multer#1416
• refactor: remove concat-stream dependency by `@Phillip9587` in expressjs/multer#1356
• fix: reject non-integer fileSize limits by `@abhu85` in expressjs/multer#1395
• fix: allow exactly limits.parts parts by `@deepakganesh78` in expressjs/multer#1446
• fix: do not consume maxCount for files skipped by fileFilter by `@Sagargupta16` in expressjs/multer#1426
• fix: validate all limits at construction time by `@ShubhamOulkar` in expressjs/multer#1335
• test: cover storage engine _removeFile invocation semantics by `@kilisamemarisaaa` in expressjs/multer#1460
• feat: accept a function for limits by `@hossein-zare` in expressjs/multer#1133
• fix: add flush option to disk storage to fsync files before completion by `@kilisamemarisaaa` in expressjs/multer#1458
• feat: expose busboy defCharset, highWaterMark and fileHwm options by `@UlisesGascon` in expressjs/multer#1465
• docs: describe the file stream contract for storage engines by `@UlisesGascon` in expressjs/multer#1468... (truncated) Changelog Sourced from multer's changelog.
2.4.0
• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• AddtofilenameandLIMIT_FILE_SIZEerrors (#1416)LIMIT_UNEXPECTED_FILE
• Accept a function for, called with the request, to set limits per request (#1133)limits
• Add opt-inoption toflushto fsync files before the callback runs (#1458)DiskStorage
• Expose busboy's,defCharsetandhighWaterMarkoptions (#1465)fileHwm
• Addoption to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)streamHandler
• Allowto be called without options (#1471)multer.diskStorage()
• Decode WHATWG-escaped characters (,%0A,%0D) in field names, matching%22since 2.3.0:file.originalnamekeys,req.bodyandfile.fieldnamenow carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)err.field
• Report the decoded filename inonerr.filenameerrors, matchingLIMIT_FILE_SIZE(#1478)file.originalname
• Reject non-integer or negativevalues at construction time; a float limit silently disabled the check (#1395, #1335)limits
• Accept requests with exactlyparts;limits.partsnow fires only when the limit is exceeded. If you setLIMIT_PART_COUNTone higher to work around this, you can drop the extra one (#1446)parts
• Files skipped byno longer count towardsfileFilter(#1426)maxCount
• Change themessage to "Unexpected file field" (#426)LIMIT_UNEXPECTED_FILE
• Remove thedependency (#1356)concat-stream
• Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
• Docs: add FormData upload examples (#896)
• Docs: remove the translated READMEs (#1463)
• Internal: run the test suite on macOS (#1464)Commits • `35979e5` 2.4.0 (#1469) • `b888532` chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474) • `e6bcd7d` chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475) • <https://github.com/expr… pact-foundation/pact-js
GitHub
09/29/2026, 12:40 AMGitHub
09/29/2026, 4:39 AM<https://github.com/pact-foundation/pact-js-cli/tree/main|main> by renovate[bot]
<https://github.com/pact-foundation/pact-js-cli/commit/222aafc0aaa9fc01b413cdad191b5149641d796c|222aafc0> - chore(deps): update dependency @types/node to v24.19.0 (#191)
pact-foundation/pact-js-cli