chore(deps): bump @tus/server from 2.4.2 to 2.4.5

[dependabot]

Bumps @tus/server from 2.4.2 to 2.4.5.

Release notes

Sourced from @​tus/server's releases.

@​tus/server@​2.4.5

Patch Changes

• 4493247: Set CORS headers before the 412 Tus-Resumable check and header-validation 400s so browsers can read those responses.

@​tus/server@​2.4.4

Patch Changes

• 92db7b8: Stop delayed POST_RECEIVE events from firing after an upload write settles, and skip progress tracking for writes that start without POST_RECEIVE listeners. Use POST_FINISH when a terminal upload notification is required.
• 0cf2903: Fix a crash when a response hook returns a null-body status (204, 205, or 304).
• 6757b9e: Stop hanging when a request body stream errors, and treat that failure as an aborted request instead of exposing runtime error details.

@​tus/server@​2.4.3

Patch Changes

• 7d6f382: Use the precomputed EXPOSED_HEADERS constant for the default Access-Control-Expose-Headers value instead of rebuilding it on every request.
• d2489f2: Reject encoded path separators and NUL bytes in default upload IDs, and prevent file store paths from escaping their configured directory. Applications using nested IDs must provide a custom getFileIdFromRequest.
• 42bc9da: Ensure PostHandler onUploadFinish hook headers override response defaults correctly.
• Updated dependencies [d2489f2]
  • @​tus/utils@​0.7.1

Commits

• 0bd46b0 [ci] release (#874)
• 4493247 @​tus/server: set CORS headers before early returns (#873)
• cdd6e79 [ci] release (#861)
• 6757b9e @​tus/server: stop hanging when request body stream errors (#872)
• 92db7b8 @​tus/server: avoid unnecessary POST_RECEIVE throttling (#858)
• cc037b9 @​tus/server: share cancellation context test helper (#863)
• fdd8cc7 @​tus/server: validate proposed merges in CI (#862)
• 69253d9 @​tus/s3-store: map missing S3 resources to 404 (#859)
• 0cf2903 @​tus/server: handle null-body response statuses (#860)
• 83ccb2b Update skill
• Additional commits viewable in compare view

[claude]

LGTM, straightforward dependency version bump.

• Reviewed the diff: only package.json and package-lock.json change, bumping @ tus/server 2.4.2 -> 2.4.5 (transitively @ tus/utils to ^0.7.1).
• No source, config, or lockfile inconsistencies beyond the expected resolved URLs/integrity hash updates for the two packages.
• Upstream changelog for this range is patch-level bug fixes (CORS header ordering, null-body response handling, path traversal hardening in @ tus/utils), consistent with a routine dependency update.

Extended reasoning...

Overview

This PR touches only package.json and package-lock.json, bumping the pinned dependency @ tus/server from 2.4.2 to 2.4.5. The lockfile update correctly reflects the corresponding bump of the transitive dependency @ tus/utils from ^0.7.0 to ^0.7.1, including updated resolved URLs and integrity hashes. No application source code, configuration, or other files are modified.

Security risks

No new security risk is introduced by this change itself — it is a version bump of an existing, already-trusted dependency. If anything, the referenced upstream release notes indicate the bump includes several defensive fixes (rejecting encoded path separators and NUL bytes in upload IDs, preventing file store paths from escaping their configured directory), which are net security improvements rather than regressions. There is inherent trust placed in the upstream package registry and the dependabot-generated lockfile, but that is standard for any dependency bump and not specific to this PR.

Level of scrutiny

This warrants a low level of scrutiny. It is a mechanical, automated dependency bump (dependabot) confined to manifest/lockfile changes with no source code touched, following an established and unambiguous pattern.

Other factors

The diff was verified directly (git diff against package.json) confirming the version bump matches the PR description exactly. No CLAUDE.md conventions apply, no CODEOWNERS concerns were flagged, and the bug hunting system reported no findings. This combination of small, self-contained, mechanical scope and no outstanding review objections supports approval without requiring additional human review.

[coveralls]

Coverage Report for CI Build 35869830528

Coverage remained the same at 83.416%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	14214
Covered Lines:	12283
Line Coverage:	86.41%
Relevant Branches:	8705
Covered Branches:	6835
Branch Coverage:	78.52%
Branches in Coverage %:	Yes
Coverage Strength:	767.73 hits per line

---

💛 - Coveralls

[ferhatelmas]

there is a regression here, after the fix landed, will bump stores and merge this

[ferhatelmas]

this is ready to merge but holding for dependency proxy age requirement, otherwise will block image builds

accidentally approved