Release: 2.3.0

[UlisesGascon]

What's included in the CHANGELOG.md

## 2.3.0

- Fix [CVE-2026-77078](https://www.cve.org/CVERecord?id=CVE-2026-77078) ([GHSA-wc9g-mqfw-jrwm](https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm))
- Fix [CVE-2026-77037](https://www.cve.org/CVERecord?id=CVE-2026-77037) ([GHSA-qfvm-cv95-jqjf](https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf))
- Fix [CVE-2026-77063](https://www.cve.org/CVERecord?id=CVE-2026-77063) ([GHSA-qvfw-j98x-7q72](https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72))
- Accept files whose size is exactly `limits.fileSize` ([#1407](https://github.com/expressjs/multer/pull/1407))
- Preserve the caller's async context (`AsyncLocalStorage`) when calling `next()` ([#1124](https://github.com/expressjs/multer/pull/1124))
- Decode WHATWG-escaped characters (`%0A`, `%0D`, `%22`) in `file.originalname` ([#1421](https://github.com/expressjs/multer/pull/1421))
- Do not crash when `fileFilter` invokes its callback more than once ([#1427](https://github.com/expressjs/multer/pull/1427))
- Use a fallback message for `MulterError` codes without a mapping ([#1448](https://github.com/expressjs/multer/pull/1448))
- Docs: clarify `preservePath` and `parts`, use `crypto.randomBytes` in the `DiskStorage` example ([#1414](https://github.com/expressjs/multer/pull/1414), [#1430](https://github.com/expressjs/multer/pull/1430), [#1436](https://github.com/expressjs/multer/pull/1436))
- Docs: add Indonesian and Japanese translations ([#1431](https://github.com/expressjs/multer/pull/1431), [#1354](https://github.com/expressjs/multer/pull/1354))
- Internal: run the test suite on Windows ([#1334](https://github.com/expressjs/multer/pull/1334))

What's Changed

• Update busboy link pointing to nonexistent section by @krzysdz in Update busboy link pointing to nonexistent section #1447
• Update outdated links to Express error handling guide by @krzysdz in Update outdated links to Express error handling guide #1405
• chore(deps): bump GitHub Actions and dev dependencies by @sheplu in chore(deps): bump GitHub Actions and dev dependencies #1445
• chore(ci): npm-publish via reusable workflows by @sheplu in chore(ci): npm-publish via reusable workflows #1364
• fix(tests): keep Git from rewriting fixture line endings on Windows by @MohammedAlkindi in fix(tests): keep Git from rewriting fixture line endings on Windows #1450
• docs: correct fieldNameSize default in limits table by @UlisesGascon in docs: correct fieldNameSize default in limits table #1432
• feat: normalize package.json by @UlisesGascon in feat: normalize package.json #1322
• fix(test): use path.sep for cross-platform path assertions by @kilisamemarisaaa in fix(test): use path.sep for cross-platform path assertions #1452
• docs(changelog): fix typo 'comaptible' to 'compatible' by @ayushshukla1807 in docs(changelog): fix typo 'comaptible' to 'compatible' #1383
• doc: adds context for link to Chinese README by @sunsheeppoplar in doc: adds context for link to Chinese README #1369
• docs: use crypto.randomBytes in diskStorage README example by @Hashim1999164 in docs: use crypto.randomBytes in diskStorage README example #1436
• docs: clarify preservePath behavior by @vibhor-aggr in docs: clarify preservePath behavior #1414
• docs: clarify parts limit behavior by @vibhor-aggr in docs: clarify parts limit behavior #1430
• chore: increase test coverage by @wojtekmaj in chore: increase test coverage #1355
• chore: drop deep-equal devDependency by @wojtekmaj in chore: drop deep-equal devDependency #1353
• docs: fix Chinese README translation by @vibhor-aggr in docs: fix Chinese README translation #1429
• Test: Enhance cross-platform test reliability and update CI workflow by @ShubhamOulkar in Test: Enhance cross-platform test reliability and update CI workflow #1334
• fix: fallback to error code when no message mapping exists by @sahilraut191685 in fix: fallback to error code when no message mapping exists #1448
• test: add coverage for preservePath by @kory-kaai in test: add coverage for preservePath #1454
• fix: prevent process crash when fileFilter calls its callback more than once by @spokodev in fix: prevent process crash when fileFilter calls its callback more than once #1427
• fix: preserve async hooks context in supported environments by @ajhyndman in fix: preserve async hooks context in supported environments #1124
• fix: allow files at exact fileSize limit by @raashish1601 in fix: allow files at exact fileSize limit #1407
• fix: decode WHATWG-escaped characters in file originalname by @webdevelopersrinu in fix: decode WHATWG-escaped characters in file originalname #1421
• docs: add Indonesian translation for README by @Derylfabiensyah in docs: add Indonesian translation for README #1431
• test: accept files exactly at fileSize limit by @abhu85 in test: accept files exactly at fileSize limit #1382
• docs: add Japanese translation to README by @noritaka1166 in docs: add Japanese translation to README #1354
• Update 'README-zh-cn.md' up to now by @pbstar in Update 'README-zh-cn.md' up to now #1264

New Contributors

• @krzysdz made their first contribution in Update busboy link pointing to nonexistent section #1447
• @sheplu made their first contribution in chore(deps): bump GitHub Actions and dev dependencies #1445
• @MohammedAlkindi made their first contribution in fix(tests): keep Git from rewriting fixture line endings on Windows #1450
• @kilisamemarisaaa made their first contribution in fix(test): use path.sep for cross-platform path assertions #1452
• @ayushshukla1807 made their first contribution in docs(changelog): fix typo 'comaptible' to 'compatible' #1383
• @sunsheeppoplar made their first contribution in doc: adds context for link to Chinese README #1369
• @Hashim1999164 made their first contribution in docs: use crypto.randomBytes in diskStorage README example #1436
• @vibhor-aggr made their first contribution in docs: clarify preservePath behavior #1414
• @sahilraut191685 made their first contribution in fix: fallback to error code when no message mapping exists #1448
• @kory-kaai made their first contribution in test: add coverage for preservePath #1454
• @spokodev made their first contribution in fix: prevent process crash when fileFilter calls its callback more than once #1427
• @ajhyndman made their first contribution in fix: preserve async hooks context in supported environments #1124
• @raashish1601 made their first contribution in fix: allow files at exact fileSize limit #1407
• @webdevelopersrinu made their first contribution in fix: decode WHATWG-escaped characters in file originalname #1421
• @Derylfabiensyah made their first contribution in docs: add Indonesian translation for README #1431
• @abhu85 made their first contribution in test: accept files exactly at fileSize limit #1382
• @noritaka1166 made their first contribution in docs: add Japanese translation to README #1354
• @pbstar made their first contribution in Update 'README-zh-cn.md' up to now #1264

Full Changelog: v2.2.0...main

[coveralls]

coverage: 99.688%. remained the same — release/2.3.0 into main

[UlisesGascon]

Note: the patch for the CI failures is included in the security patches

[bjohansebas]

go ahaead!