MultipleUpload JavaScript upload component
Works with any backend npm install Zero dependencies
Contact

Changelog

Release notes for the MultipleUpload npm package, newest first. The current version is 1.3.

1.3

Current . npm

1.3.1 — security update Recommended

Security and reliability fixes — run npm install multipleupload@latest to upgrade.

  • Cross-site scripting via file names. Toast notifications and several queue/preview elements inserted file names and server error text as markup, so a hostile file name could execute script. These are now escaped or inserted as text.
  • Reference Node middleware: it could not accept the browser client's chunked-upload requests at all (raw body plus X-Upload-Id headers), and a filesystem error could crash the process. Chunked uploads now work end-to-end; assembly is atomic, streams with backpressure instead of buffering whole files in memory, and counts only fully-written chunks.
  • Queue reliability. Completion events now fire when a queue drains through failures or cancellation (previously success-only, which also left later batches unable to signal upload start); an onBeforeUpload veto no longer strands a file forever; pausing now stops files still in the pre-upload pipeline.

Cloud sources

  • Box promoted to a first-class source.
  • Unsplash search-and-import source added.
  • Companion broker: self-hosted Node OAuth plus file proxy (Dropbox, Box, Drive, OneDrive) with proxy and server-to-destination transfer modes.

Headless framework hooks

  • useUploader() for React and Vue.
  • use:uploader Svelte action.
  • UploaderService for Angular.

Image editor

  • Content-aware smart-crop (edge-energy focal point - not AI).
  • Text and sticker overlays with styling controls.
  • Filter adjustments (brightness, contrast, saturation, sepia, grayscale) plus presets.
  • EXIF metadata viewer and crop-ratio chips.
  • AVIF and WebP output with a quality slider.

Image pipeline

  • EXIF auto-rotate on upload.
  • PDF poster thumbnails.
  • URL-based transforms via the transformUrl client helper, honored by your server.

Validation and UX

  • Standalone aspectRatio validator and per-file rename UI.
  • Restore prompt to resume incomplete uploads after reload.
  • Whole-page drop target, form auto-attach, locale auto-detect.
  • Accessibility: ARIA live-region announcements, reduced-motion support, focus traps.
  • 28 built-in locales.

Server endpoints

  • Reference GCS server endpoints for signed direct uploads.
  • Pluggable server-side image transformer for the URL-transform pipeline.

Earlier releases

1.2

7 transport strategies including GCS, 4 cloud pickers, AES-GCM encryption, an offline service-worker queue, cross-tab coordination, locales expanded from 20 to 30, webcam / screen / audio capture, and a virus-scan hook.

1.1

The core rewrite: pluggable transport strategies, direct-to-S3 / Azure / tus, IndexedDB resume, an inline image editor, and the canonical single-source build.