Bump the npm-minor-and-patch group across 1 directory with 19 updates

[dependabot]

Bumps the npm-minor-and-patch group with 19 updates in the / directory:

Package	From	To
@openai/agents	0.18.0	0.19.0
@tauri-apps/api	2.11.1	2.12.1
@tauri-apps/plugin-dialog	2.7.3	2.8.1
@tauri-apps/plugin-fs	2.5.2	2.6.0
express-rate-limit	8.7.0	8.7.1
katex	0.18.7	0.19.0
lucide-react	1.45.0	1.52.0
multer	2.3.0	2.4.0
@types/multer	2.2.0	2.3.0
openai	7.15.0	7.30.0
pdfjs-dist	6.3.289	6.4.299
sharp	0.35.4	0.35.5
tsx	4.23.13	4.23.15
zod	4.6.2	4.6.5
@playwright/cli	0.1.19	0.1.22
@tauri-apps/cli	2.11.4	2.12.1
@types/multer	2.2.0	2.3.0
@types/node	26.5.1	26.6.4
@vitejs/plugin-react	6.1.1	6.1.2
vite	8.3.0	8.3.3

Updates @openai/agents from 0.18.0 to 0.19.0

Release notes

Sourced from @​openai/agents's releases.

@​openai/agents-core@​0.19.0

Minor Changes

• 39d5e9e: fix: bound agent tool streaming callbacks to 1024 pending events by default, with onStreamMaxPendingEvents to adjust the limit or restore unlimited buffering with null.
• f0f3066: fix: reject started checkpoints without completed initial input validation, including older snapshots without completion evidence; restart with the original input and context.
• aeef9e1: fix: bind resumed MCP calls to their original recipients and require a fresh run for historical pending function calls without recipient provenance.
• 39decd7: fix: bind conditional tool approvals to isolated normalized execution input in core and Realtime, re-evaluate current policies on durable approval resumes, reject uncopyable normalized values before conditional approval, and preserve invalid-input handling (#1914, #1915).
• 3515c29: fix: redact default function-tool and Realtime approval parse failures; require explicit invocation policy for sensitive error traces and clarify when custom errorFunction feedback applies.

Patch Changes

• c55d64d: fix: add an optional rollback item budget for Responses session compaction.
• c345409: feat: add optional page limits for automatic MCP tool listing
• a0b1c6f: fix: Preserve current permanent function approval decisions when restoring nested runs from saved state.
• 9c94138: fix: honor the invoking Runner's sensitive-data tracing policy in Codex spans, including mixed CommonJS and ESM applications.
• c3e02d2: fix: Refresh cached sandbox application tools and preserve public agent identity in tool filters.
• f80c91c: fix: Preserve guarded final outputs, including empty strings, in default Agent.asTool output extraction.
• 3949bb1: fix: Apply static MCP tool filters when discovering tools without full agent and run context.
• 186f6ec: fix: Trim local workspace logical path separators in linear time.
• fdaf0a6: fix: handle MCP tools from one server whose names normalize to the same function tool name
• 817161d: build: Generate package metadata with native Node.js TypeScript support.
• 20e5946: chore: Run PTY signal regression tests with native Node.js instead of the tsx CLI.
• ec8bb33: fix: Preserve post-construction agent storage settings through model requests and cloning.
• 9623a22: fix: preserve multiline skill frontmatter descriptions and keep nested fields out of skill index metadata.
• 58844c7: fix: Withhold unvetted final assistant output from session history when output guardrails fail to complete.
• d0e5d43: fix: Keep parent transport overrides out of agent tool runs with an explicit Model while preserving common settings and explicit child overrides.
• 2127475: fix: preserve stored history excluded from the latest successful model exchange during automatic compaction.
• b9a4fb8: fix: respect sensitive-data trace settings for escaping tool callbacks.
• 7f135af: fix: update compatible runtime and development dependencies.
• ee65014: fix: Reject read-only host binds combined with privileged in-container Docker storage before provider or filesystem effects.
• 00eef0c: fix: Reject selected handoff input filters with server-managed conversationId or previousResponseId before handoff side effects; use client-managed history or a Session without continuation options instead.
• 218a2b8: fix: snapshot configured tool candidates during asynchronous enablement so in-place array changes do not duplicate or skip tools.
• 8ac97df: fix: Reject computer calls without aborting the run when onSafetyCheck explicitly returns false.
• 96aa754: fix: respect sensitive tracing settings for computer safety-check callback errors and enclosing run-span error names.
• 7efc536: fix: update compatible workspace dependencies while preserving supported provider and Expo versions.
• 8a26e30: fix: Serialize hosted MCP approval tool references without live configuration.
• 4ef9008: fix: Preserve cached MCP tools for unrelated servers with colon-suffixed names when invalidating another server's cache (#1976).
• f507590: fix: accept deferred hosted MCP listings before tool-search results (#1978)
• d187747: fix: Apply current MCP tool filters on every lookup while reusing cached tool discovery.
• fc2d2a4: feat: allow configuring phase-two memory consolidation turns.
• 0bdea85: fix: Compute sandbox parent paths in linear time while preserving existing path semantics.
• a9b543b: fix: preserve prompt formatting when rendering large multiline skill descriptions.
• 06bbcc0: chore: migrate tracing test mocks to Vitest 5.

@​openai/agents-extensions@​0.19.0

Minor Changes

• 38cee6d: fix: require Daytona SDK ^0.201.0 for patched OpenTelemetry dependencies while preserving polling-based sandbox lifecycle behavior.

Patch Changes

... (truncated)

Commits

• 5ef4f23 chore: update versions (#1876)
• 96aa754 fix: redact computer safety-check callback trace errors (#2018)
• 130a8d3 fix: honor configured archive limits in remote sandbox creation (#2020)
• 24946f3 fix(openai): omit mixed tool output from strict conversion errors (#2022)
• b9a4fb8 fix: redact escaping tool callback trace errors (#2017)
• a73577e fix(extensions): omit raw provider diagnostics from AI SDK traces (#2021)
• 3626398 fix: honor sensitive-data opt-out in Responses tracing (#2016)
• 58b08f8 fix(tracing): bound repeated span truncation work (#2013)
• 3f84742 fix: require approval for double-click and drag in computer HITL example (#2015)
• 734144c fix: release consumed realtime response waiters (#2014)
• Additional commits viewable in compare view

Updates @tauri-apps/api from 2.11.1 to 2.12.1

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.1

All found vulnerabilities were already reviewed and decided to be ignored
2 ignored: 2 high

[2.12.1]

Bug Fixes

• c9a3cb892 (#16166 by @​FabianLars) The macos-private-api feature flag / macOSPrivateAPI tauri.conf.json value is no longer required to use transparency or fullscreen on macOS.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m997ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.5s�[22m�[39m
GET https://run-actions-2-azure-eastus.actions.githubusercontent.com/210//idtoken/dd253aee-436e-8e22-8c02-25aaaa05b17c/69013391-05d6-5397-b35a-e76c0a237b30?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 336ms
📦 @tauri-apps/api@2.12.1 → https://registry.npmjs.org/
GET https://run-actions-2-azure-eastus.actions.githubusercontent.com/210//idtoken/dd253aee-436e-8e22-8c02-25aaaa05b17c/69013391-05d6-5397-b35a-e76c0a237b30?api-version=2.0&audience=sigstore 200 107ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.1

@​tauri-apps/api v2.12.0

All found vulnerabilities were already reviewed and decided to be ignored
2 ignored: 2 high

[2.12.0]

... (truncated)

Commits

• 30da1fd feat(ci): run audit before publishing
• 1aefcf6 fix: pnpm audit
• 026f260 apply version updates (#16150)
• a4dcca8 fix(plugin): skip build script writes on docs.rs builds (#16186)
• f040897 docs: link WRY and TAO to their repositories (#16163)
• c9a3cb8 fix: enable macos private apis regardless of feature flags (#16166)
• 64bfdd9 fix: ignore src-tauri in vite configs (#16165)
• 793f0c4 fix(window): copy WebView2Loader.dll for nightly (#16164)
• d15cf9b fix(bundler): make glob error variants available on all platforms (#16149)
• 447fa9f fix(core): tauri-utils publish
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-dialog from 2.7.3 to 2.8.1

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

dialog-js v2.8.1

[2.8.1]

• 569ee82c Fix the docs.rs build for Android: the build script now detects docs.rs through the DOCS_RS environment variable, since cfg(docsrs) is never set for build scripts.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.8.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 7.1kB dist-js/index.cjs
npm notice 15.1kB dist-js/index.d.ts
npm notice 7.0kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.8.1
npm notice filename: tauri-apps-plugin-dialog-2.8.1.tgz
npm notice package size: 6.8 kB
npm notice unpacked size: 34.3 kB
npm notice shasum: f29f3c28862a1ed767b6fd241f34abf26129f88f
npm notice integrity: sha512-/DtE3B62JgpYu[...]phsKnb+738Dmw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3028120915
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-dialog@2.8.1

dialog v2.8.1

[2.8.1]

• 569ee82c Fix the docs.rs build for Android: the build script now detects docs.rs through the DOCS_RS environment variable, since cfg(docsrs) is never set for build scripts.

... (truncated)

Commits

• 7eb8246 publish new versions (#3673)
• 65ce65b fix(ci): Android e2e flakes, shell Terminated sent before output (#3672)
• cbd691b chore(examples): update Android project for API example
• 974bbdc publish new versions (#3667)
• 3113a54 chore(deps): update urlpattern to 0.6 (#3670)
• b443d6b fix(http): release the request's resources once fetch_send settles (#3669)
• 2a9c29e fix(updater): restore the current app when a macOS install fails (fix #3505, ...
• d4835d0 publish new versions (#3660)
• 569ee82 fix: mobile docs.rs builds
• 25f3874 chore(deps): update dependency eslint-plugin-security to v4.1.0 (#3661)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.5.2 to 2.6.0

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

deep-link-js v2.6.0

[2.6.0]

• ecd3273e (#3480 by @​renovate) Updated windows-rs dependencies:

  • deep-link: updated windows-registry to 0.6 and windows-result to 0.4. The public Error::Windows variant wraps windows_result::Error; applications using this type directly should update their windows-result dependency.
  • opener: updated windows to 0.62. The public Error::Win32Error variant wraps windows::core::Error; applications using this type directly should update their windows dependency.
  • single-instance: updated windows-sys to 0.61
  • updater: updated windows-sys to 0.61

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-deep-link@2.6.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 6.2kB README.md
npm notice 4.7kB dist-js/index.cjs
npm notice 4.0kB dist-js/index.d.ts
npm notice 4.5kB dist-js/index.js
npm notice 801B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-deep-link
npm notice version: 2.6.0
npm notice filename: tauri-apps-plugin-deep-link-2.6.0.tgz
npm notice package size: 4.8 kB
npm notice unpacked size: 21.1 kB
npm notice shasum: 42f4e74e87aea6ace90871ad293f4fface5910cc
npm notice integrity: sha512-41rOuYUZjxcEz[...]TsoJQ2R9U5MCA==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3005261605
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-deep-link@2.6.0

deep-link v2.6.0

[2.6.0]

... (truncated)

Commits

• a2364a5 fix: integration test
• 67ebc13 fix(ci): check-publish job should check .changes/pre.json
• cbfd428 Publish New Versions (v2) (#3618)
• f460570 chore: fmt
• a433ec0 fix: mobile clippy warnings
• 3d8a3c8 chore: edition 2024
• b517cc7 fix: actually set rust-version to 1.90
• b6a38a5 fix(ci): e2e test error reporting
• 9b29b60 feat: update to tauri 2.12
• 3a01943 tests(e2e): fix e2e failures on Linux and Windows (#3642)
• Additional commits viewable in compare view

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
• 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
• 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
• 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
• Additional commits viewable in compare view

Updates katex from 0.18.7 to 0.19.0

Release notes

Sourced from katex's releases.

v0.19.0

0.19.0 (2026-10-01)

Documentation

• note strict changes shipped in 0.18.11 (#4300) (cbb1fce)

BREAKING CHANGES

• Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

v0.18.11

0.18.11 (2026-10-01)

Features

• handle character metrics warnings via strict (#4243) (4237070)

v0.18.10

0.18.10 (2026-09-30)

Features

• make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

v0.18.9

0.18.9 (2026-09-23)

Features

• types: add contrib module declarations (#4250) (aafa187)

v0.18.8

0.18.8 (2026-09-23)

Bug Fixes

• array: preserve trailing rows in align (#4283) (ddfcc29)

Changelog

Sourced from katex's changelog.

0.19.0 (2026-10-01)

Documentation

• note strict changes shipped in 0.18.11 (#4300) (cbb1fce)

BREAKING CHANGES

• Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

0.18.11 (2026-10-01)

Features

• handle character metrics warnings via strict (#4243) (4237070)

0.18.10 (2026-09-30)

Features

• make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

0.18.9 (2026-09-23)

Features

• types: add contrib module declarations (#4250) (aafa187)

0.18.8 (2026-09-23)

Bug Fixes

• array: preserve trailing rows in align (#4283) (ddfcc29)

Commits

• 6ea2dc9 chore(release): 0.19.0 [ci skip]
• cbb1fce docs: note strict changes shipped in 0.18.11 (#4300)
• d5bed9f chore(release): 0.18.11 [ci skip]
• 4237070 feat: handle character metrics warnings via strict (#4243)
• 411da70 chore(release): 0.18.10 [ci skip]
• a477b2e feat: make KaTeX fallback to browsr math font before Times New Roman (#4298)
• 5a6a8f8 chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 (#4297)
• 71a7bc0 chore(release): 0.18.9 [ci skip]
• aafa187 feat(types): add contrib module declarations (#4250)
• e749fd1 chore(release): 0.18.8 [ci skip]
• Additional commits viewable in compare view

Updates lucide-react from 1.45.0 to 1.52.0

Release notes

Sourced from lucide-react's releases.

Version 1.52.0

What's Changed

• fix(icons): changed wifi-cog icon by @​karsa-mistmere in lucide-icons/lucide#4952

Full Changelog: lucide-icons/lucide@1.51.0...1.52.0

Version 1.51.0

What's Changed

• fix(site): persist icon customizer by @​karsa-mistmere in lucide-icons/lucide#4944
• chore(deps): Upgrade to vite 8 by @​ericfennis in lucide-icons/lucide#4950
• feat(icons): added rugby-ball icon by @​dev-mralph in lucide-icons/lucide#3496
• chore(deps): bump the react-deps group across 1 directory with 3 updates by @​dependabot[bot] in lucide-icons/lucide#4951
• fix(react-native): stop forwarding arbitrary rest props to child shape elements by @​cipherprofessor in lucide-icons/lucide#4903
• test(lucide-solid): add Vite and SolidStart integration fixtures by @​ericfennis in lucide-icons/lucide#4884
• feat(icons): add door-closed-cog icon by @​ajaxjiang96 in lucide-icons/lucide#4905
• feat(icons): add text-align-justify-* icons by @​HectorZaGa in lucide-icons/lucide#4942
• chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 in the github-actions group across 1 directory by @​dependabot[bot] in lucide-icons/lucide#4939
• chore(deps): Upgrade to vitest 5 by @​ericfennis in lucide-icons/lucide#4953
• feat(icons): added wind-arrow-up icon by @​jamesgpearce in lucide-icons/lucide#4501
• fix(github/actions): move to daily release flow by @​karsa-mistmere in lucide-icons/lucide#4911
• feat(@​lucide/solid): Support for Solid 2.0 RC by @​davedbase in lucide-icons/lucide#4751
• chore(deps-dev): bump the angular-deps group across 1 directory with 10 updates by @​dependabot[bot] in lucide-icons/lucide#4954
• chore(deps): bump nuxt from 4.4.8 to 4.5.1 by @​dependabot[bot] in lucide-icons/lucide#4949
• feat(icons): added armenian-dram icon by @​Elawphant in lucide-icons/lucide#4456
• feat(icons): add kazakh-tenge icon by @​hkayrad in lucide-icons/lucide#4925

New Contributors

• @​dev-mralph made their first contribution in lucide-icons/lucide#3496
• @​cipherprofessor made their first contribution in lucide-icons/lucide#4903
• @​HectorZaGa made their first contribution in lucide-icons/lucide#4942
• @​jamesgpearce made their first contribution in lucide-icons/lucide#4501
• @​davedbase made their first contribution in lucide-icons/lucide#4751
• @​Elawphant made their first contribution in lucide-icons/lucide#4456
• @​hkayrad made their first contribution in lucide-icons/lucide#4925

Full Changelog: lucide-icons/lucide@1.50.0...1.51.0

Version 1.50.0

What's Changed

• fix(shared): escape attribute values in buildLucideSvg by @​Saadanjum0 in lucide-icons/lucide#4940
• fix(github/actions): use canonical metadata instructions for PR suggestions by @​karsa-mistmere in lucide-icons/lucide#4910
• fix(icons): replaced nut & nut-off with compliant designs by @​karsa-mistmere in lucide-icons/lucide#4840
• chore(deps-dev): bump @​angular/router from 22.1.7 to 22.2.0 by @​dependabot[bot] in lucide-icons/lucide#4945
• chore(deps): bump next from 16.3.4 to 16.3.6 by @​dependabot[bot] in lucide-icons/lucide#4946
• chore(deps-dev): bump the svelte-deps group with 2 updates by @​dependabot[bot] in lucide-icons/lucide#4918
• test(integrations): add Vue integration fixtures for Vite, Nuxt and Vike by @​ericfennis in lucide-icons/lucide#4882
• feat(svelte): export context subpath by @​vugarbbakhishov-hub in lucide-icons/lucide#4927
• fix(lucide-preact): add Preact v11 compatibility by @​JoviDeCroock in lucide-icons/lucide#4924
• feat(icons): added layout-grid-circles icon by @​karsa-mistmere in lucide-icons/lucide#4567

... (truncated)

Commits

• 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
• 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
• e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
• f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
• See full diff in compare view

Updates multer from 2.3.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

What's Changed

• docs: remove README translations by @​UlisesGascon in expressjs/multer#1463
• ci: add macOS to the test matrix by @​kilisamemarisaaa in expressjs/multer#1464
• feat. improve wording for LIMIT_UNEXPECTED_FILE error code by @​flashbag in expressjs/multer#426
• feat: add filename to file errors by @​UjjwalKumar239 in expressjs/multer#1416
• refactor: remove concat-stream dependency by @​Phillip9587 in expressjs/multer#1356
• fix: reject non-integer fileSize limits by @​abhu85 in expressjs/multer#1395
• fix: allow exactly limits.parts parts by @​deepakganesh78 in expressjs/multer#1446
• fix: do not consume maxCount for files skipped by fileFilter by @​Sagargupta16 in expressjs/multer#1426
• fix: validate all limits at construction time by @​ShubhamOulkar in expressjs/multer#1335
• test: cover storage engine _removeFile invocation semantics by @​kilisamemarisaaa in expressjs/multer#1460
• feat: accept a function for limits by @​hossein-zare in expressjs/multer#1133
• fix: add flush option to disk storage to fsync files before completion by @​kilisamemarisaaa in expressjs/multer#1458
• feat: expose busboy defCharset, highWaterMark and fileHwm options by @​UlisesGascon in expressjs/multer#1465
• docs: describe the file stream contract for storage engines by @​UlisesGascon in expressjs/multer#1468

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
• Accept a function for limits, called with the request, to set limits per request (#1133)
• Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
• Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
• Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
• Allow multer.diskStorage() to be called without options (#1471)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
• Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
• Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
• Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
• Files skipped by fileFilter no longer count towards maxCount (#1426)
• Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
• Remove the concat-stream dependency (#1356)
• Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
• Docs: add FormData upload examples (#896)
• Docs: remove the translated READMEs (#1463)
• Internal: run the test suite on macOS (#1464)

Commits

• 35979e5 2.4.0 (#1469)
• b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
• e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
• 00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
• 8d5c3b7 feat: allow diskStorage without options (#1471)
• 02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
• bc3f72d fix: decode escaped field names, not just filenames (#1473)
• 2661325 docs: add JSDoc to the public API (#1467)
• 53337f9 fix: remove late-completing uploads aborted before the engine names them
• 7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
• Additional commits viewable in compare view

Updates @types/multer from 2.2.0 to 2.3.0

Commits

• See full diff in compare view

Updates openai from 7.15.0 to 7.30.0

Release notes

Sourced from openai's releases.

v7.30.0

7.30.0 (2026-10-06)

Features

• api: add standalone Decisions support (#2886) (7195644)

v7.29.0

7.29.0 (2026-10-05)

Features

• agents: observe local tool failures (#2861) (3808241)
• agents: run local tools during session creation streams (#2862) (7423ac3)
• tools: support tool search (defer_loading=true) in typed function helpers (#2880) (3fb01eb)

v7.28.0

7.28.0 (2026-10-02)

Features

• api: add custom voice creation and agent session events (#2858) (11b9283)

v7.27.0

7.27.0 (2026-10-01)

Features

• agents: prepare hosted files and download result artifacts (#2855) (7b5a9e0)

v7.26.0

7.26.0 (2026-10-01)

Features

• collect final output from beta Agents streams (#2850) (71d2412)
• agents: [1/n] parse typed output from agent streams (#2853) (95b197b)
• api: Add agent session trace listing (#2845) (c6dd4c7)
• beta: bind typed application functions to Agents tools (#2852) (6198ba0)

Bug Fixes

• api: allow original image detail in Chat Completions (#2851) (a3c1af5)
• api: correct the eval run cancellation endpoint (#2847) (2f77415)

... (truncated)

Changelog

Sourced from openai's changelog.

7.30.0 (2026-10-06)

Features

• api: add standalone Decisions support (#2886) (7195644)

7.29.0 (2026-10-05)

Features

• agents: observe local tool failures (#2861) (3808241)
• agents: run local tools during session creation streams (#2862) (7423ac3)
• tools: support tool search (defer_loading=true) in typed function helpers (#2880) (3fb01eb)

7.28.0 (2026-10-02)

Features

• api: add custom voice creation and agent ses...

  Description has been truncated