[pull] main from tinacms:main - #303

Merged

pull[bot] merged 3 commits into

Aug 17, 2026

pull Bot commented Aug 17, 2026 •

edited

Loading

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

dependabot Bot and others added 3 commits

August 17, 2026 08:49


          chore(deps): bump multer from 1.4.5-lts.1 to 2.2.0 (#7079)

61799cf

Bumps [multer](https://github.com/expressjs/multer) from 1.4.5-lts.1 to
2.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/multer/releases">multer's
releases</a>.</em></p>
<blockquote>
<h2>v2.2.0</h2>
<h2>Important</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-5038">CVE-2026-5038</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm">GHSA-3p4h-7m6x-2hcm</a>)</li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-5079">CVE-2026-5079</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j">GHSA-72gw-mp4g-v24j</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1397">expressjs/multer#1397</a></li>
<li>chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1409">expressjs/multer#1409</a></li>
<li>chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1410">expressjs/multer#1410</a></li>
<li>ci: add Node 26 to test matrix by <a
href="https://github.com/gameroman"><code>@gameroman</code></a> in <a
href="https://redirect.github.com/expressjs/multer/pull/1404">expressjs/multer#1404</a></li>
<li>Release: 2.2.0 by <a
href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/multer/pull/1412">expressjs/multer#1412</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/gameroman"><code>@gameroman</code></a>
made their first contribution in <a
href="https://redirect.github.com/expressjs/multer/pull/1404">expressjs/multer#1404</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0">https://github.com/expressjs/multer/compare/v2.1.1...v2.2.0</a></p>
<h2>v2.1.1</h2>
<h2>Important</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-3520">CVE-2026-3520</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2">GHSA-5528-5vmv-3xc2</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore: add node version to 25.x in CI by <a
href="https://github.com/imangas"><code>@imangas</code></a> in <a
href="https://redirect.github.com/expressjs/multer/pull/1372">expressjs/multer#1372</a></li>
<li>chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1378">expressjs/multer#1378</a></li>
<li>chore(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 by
<a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1377">expressjs/multer#1377</a></li>
<li>chore(deps): bump github/codeql-action from 3.24.7 to 4.32.4 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1376">expressjs/multer#1376</a></li>
<li>chore(deps): bump actions/upload-artifact from 4.5.0 to 7.0.0 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1375">expressjs/multer#1375</a></li>
<li>chore(deps): bump actions/checkout from 4.1.1 to 6.0.2 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/expressjs/multer/pull/1374">expressjs/multer#1374</a></li>
<li>fix error/abort handling by <a
href="https://github.com/ctcpip"><code>@ctcpip</code></a> in <a
href="https://redirect.github.com/expressjs/multer/pull/1373">expressjs/multer#1373</a></li>
<li>2.1.1 by <a
href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a>
in <a
href="https://redirect.github.com/expressjs/multer/pull/1380">expressjs/multer#1380</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/imangas"><code>@imangas</code></a> made
their first contribution in <a
href="https://redirect.github.com/expressjs/multer/pull/1372">expressjs/multer#1372</a></li>
<li><a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
made their first contribution in <a
href="https://redirect.github.com/expressjs/multer/pull/1378">expressjs/multer#1378</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/expressjs/multer/compare/v2.1.0...v2.1.1">https://github.com/expressjs/multer/compare/v2.1.0...v2.1.1</a></p>
<h2>v2.1.0</h2>
<h2>Important</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-2359">CVE-2026-2359</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc">GHSA-v52c-386h-88mc</a>)</li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-3304">CVE-2026-3304</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p">GHSA-xf7r-hgr6-v32p</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>chore: add funding to package.json by <a
href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in
<a
href="https://redirect.github.com/expressjs/multer/pull/1346">expressjs/multer#1346</a></li>
<li>chore: drop mkdirp dependency by <a
href="https://github.com/wojtekmaj"><code>@wojtekmaj</code></a> in <a
href="https://redirect.github.com/expressjs/multer/pull/1350">expressjs/multer#1350</a></li>
<li>chore: drop object-assign dependency by <a
href="https://github.com/wojtekmaj"><code>@wojtekmaj</code></a> in <a
href="https://redirect.github.com/expressjs/multer/pull/1351">expressjs/multer#1351</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/expressjs/multer/blob/main/CHANGELOG.md">multer's
changelog</a>.</em></p>
<blockquote>
<h2>2.2.0</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-5038">CVE-2026-5038</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm">GHSA-3p4h-7m6x-2hcm</a>)</li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-5079">CVE-2026-5079</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j">GHSA-72gw-mp4g-v24j</a>)</li>
</ul>
<h2>2.1.1</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-3520">CVE-2026-3520</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2">GHSA-5528-5vmv-3xc2</a>)</li>
<li>fix error/abort handling</li>
</ul>
<h2>2.1.0</h2>
<ul>
<li>Add <code>defParamCharset</code> option for UTF-8 filename support
(<a
href="https://redirect.github.com/expressjs/multer/pull/1210">#1210</a>)</li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-2359">CVE-2026-2359</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc">GHSA-v52c-386h-88mc</a>)</li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-3304">CVE-2026-3304</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p">GHSA-xf7r-hgr6-v32p</a>)</li>
</ul>
<h2>2.0.2</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-7338">CVE-2025-7338</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p">GHSA-fjgf-rc76-4x9p</a>)</li>
</ul>
<h2>2.0.1</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-48997">CVE-2025-48997</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg">GHSA-g5hg-p3ph-g8qg</a>)</li>
</ul>
<h2>2.0.0</h2>
<ul>
<li><strong>Breaking change: The minimum supported Node version is now
10.16.0</strong></li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-47935">CVE-2025-47935</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5">GHSA-44fp-w29j-9vj5</a>)</li>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2025-47944">CVE-2025-47944</a>
(<a
href="https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h">GHSA-4pg4-qvpc-4q3h</a>)</li>
</ul>
<h2>1.4.5-lts.2</h2>
<ul>
<li>Fix out-of-band error event from busboy (<a
href="https://redirect.github.com/expressjs/multer/issues/1177">#1177</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/expressjs/multer/commit/2e2af08157c66cbbc76539ccbd8869097a0c8feb"><code>2e2af08</code></a>
2.2.0 (<a
href="https://redirect.github.com/expressjs/multer/issues/1412">#1412</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/a192b5278f240967f5eb13dd1e9a413b4e1b6533"><code>a192b52</code></a>
feat: add fieldNestingDepth limit option</li>
<li><a
href="https://github.com/expressjs/multer/commit/9c801c7136fdaa8437b84c6455cd46a3467a8058"><code>9c801c7</code></a>
fix: clean up in-progress disk writes on abort</li>
<li><a
href="https://github.com/expressjs/multer/commit/0adb21d0294fe7315344feb6ddee00b0666d9e8a"><code>0adb21d</code></a>
ci: add Node 26 to test matrix (<a
href="https://redirect.github.com/expressjs/multer/issues/1404">#1404</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/f5e17c39c818edade71b4deec7d114fdaafd54af"><code>f5e17c3</code></a>
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (<a
href="https://redirect.github.com/expressjs/multer/issues/1410">#1410</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/de1fefd9d201f0ae48f1de056f00a349dd12f9bc"><code>de1fefd</code></a>
chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 (<a
href="https://redirect.github.com/expressjs/multer/issues/1409">#1409</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/67abfc89f4caa5f842eb75083ddb3854db4cc38a"><code>67abfc8</code></a>
chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/expressjs/multer/issues/1397">#1397</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/368c8a10cca11854cf17c24029fefd1eafb1c059"><code>368c8a1</code></a>
2.1.1 (<a
href="https://redirect.github.com/expressjs/multer/issues/1380">#1380</a>)</li>
<li><a
href="https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752"><code>7e66481</code></a>
🐛 fix recursion issue</li>
<li><a
href="https://github.com/expressjs/multer/commit/643571ef85e9db94b87a777773f4d67156f82a3e"><code>643571e</code></a>
✅ add explicit test for client able to send body without abrupt
disconnect</li>
<li>Additional commits viewable in <a
href="https://github.com/expressjs/multer/compare/v1.4.5-lts.1...v2.2.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~ulisesgascon">ulisesgascon</a>, a new
releaser for multer since your current version.</p>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kulesy <kulewidak@gmail.com>


          chore: add missing changeset for the multer 2.2.0 bump (#7436)

4ef6b6d

Closes #7435

**TL;DR** #7079 bumped multer 1.4.5-lts.1 to 2.2.0 without a changeset.
This adds one, so both affected packages record the change.

**Pain:** multer is consumed via `catalog:` by `next-tinacms-cloudinary`
and `next-tinacms-dos`, both published, and neither is in the changesets
`ignore` list. #7079 landed the bump with no changeset, and nothing in
CI requires one. As it stands, `next-tinacms-cloudinary` will ship the
multer 1.x to 2.x major on the back of an unrelated patch entry
(`cloudinary-escape-search-expression`), so the changelog describes a
search-expression fix while a breaking runtime dependency change rides
along. `next-tinacms-dos` gets no release at all, leaving its published
dependency on multer 1.4.5-lts.1 while `main` says 2.2.0.

**Solution:** Added a changeset marking both packages `patch` and naming
the actual change, including that multer 1.x is end of life and 2.x
alters file-handling behaviour. Version Packages #7287 is still open, so
this is picked up in the current release rather than the one after.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>


          feat: add announcements banner (#7388)

17931b7

Add an announcement component linked to the /announcement endpoint

---------

Issue: TinaCloud#3898 Post alerts to TinaCMS editor and TinaCloud
dashboard
Assisted-by: OpenCode:big-pickle
Signed-off-by: brookjeynes-ssw <brookjeynes@ssw.com.au>

pull Bot locked and limited conversation to collaborators

pull Bot added the ⤵️ pull label

pull Bot merged commit 17931b7 into code:main

6 of 7 checks passed

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels