[release-1.10] chore(deps): bump multer to 2.2.0

[JessicaJHee]

Description

Bumps multer to 2.2.0 to fix CVE-2026-5038 and CVE-2026-5079

Which issue(s) does this PR fix

• Fixes RHIDP-15787 and RHIDP-15786

PR acceptance criteria

Please make sure that the following steps are complete:

• GitHub Actions are completed and successful
• Unit Tests are updated and passing
• E2E Tests are updated and passing
• Documentation is updated if necessary (requirement for new features)
• Add a screenshot if the change is UX/UI related

How to test changes / Special notes to the reviewer

[kim-tsao]

/lgtm

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5166
• quay.io/rhdh-community/rhdh:pr-5166-abd7e65f

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.75%. Comparing base (7994cdb) to head (0213ba3).
⚠️ Report is 4 commits behind head on release-1.10.

Additional details and impacted files

@@                Coverage Diff                @@
##           release-1.10    #5166       +/-   ##
=================================================
+ Coverage         41.03%   69.75%   +28.71%     
=================================================
  Files               121      115        -6     
  Lines              2220     4771     +2551     
  Branches            539      543        +4     
=================================================
+ Hits                911     3328     +2417     
- Misses             1304     1443      +139     
+ Partials              5        0        -5     

Flag	Coverage Δ
install-dynamic-plugins	92.44% <ø> (?)
rhdh	40.17% <ø> (-0.87%)	⬇️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7994cdb...0213ba3. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[openshift-ci]

New changes are detected. LGTM label has been removed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5166
• quay.io/rhdh-community/rhdh:pr-5166-0213ba32