Releases Backlog (1.x and 2.x)

[bjohansebas]

Blockers

• Reach consensus on versions. See

Next 1.x

Current ideas: #1310 (comment)

Next Major Backlog

Releasing a new version and dropping support for older Node.js is now necessary for this module. Here's the list of remaining tasks to launch v2, given that @LinusU has already done most of the work (#399):

• Move the package from ESM to CommonJS (convert package to commonjs #1304).
• Align Node.js support with Express v5 (support node >=18 #1303)
• Update dependencies:
  • @fastify/busboy
  • append-field v2 -> v1 (For CommonJS support)

This is a draft of what I’ve seen is missing to release v2. @LinusU, do you have anything else pending?

[ctcpip]

this needs to be multer v3, as v2 needs to go out with the v1 api due to a security issue that requires a breaking change

[UlisesGascon]

Well... This can be more tricky than it seems (ref):

So far seems like we had break semver compatibility in multer@1.4.4 due a patch for CVE-2022-24434:

Multer 1.x is affected by CVE-2022-24434. This is fixed in v1.4.4-lts.1 which drops support for versions of Node.js before 6. Please upgrade to at least Node.js 6 and version 1.4.4-lts.1 of Multer. If you need support for older versions of Node.js, we are open to accepting patches that would fix the CVE on the main 1.x release line, whilst maintaining compatibility with Node.js 0.10.
npm deprecation message

So... My suggestion on 1.x version line is the following:

• Publish multer@1.5.0 with the following changes
  • Fix the engines in the pkg (based on the ADR is major, but actually I will like to consider this case as minor as an exception as we already break semver) fix: update engines field #1306
  • Solve the CI issues Uncaught AssertionError [ERR_ASSERTION]: ifError got unwanted exception: write EPIPE (ref)
  • Potentially other PRs that can be port from v2
• Deprecate the existing beta versions: 1.4.5-lts.2, 1.4.5-lts.1 and 1.4.4-lts.1
• Announce when we drop support for multer@1.x, so the users can migrate to multer@2.x gradually.

Then... the next major will be multer@2 and not multer@3.... WDYT?