Skip to content

chore(deps): bump body-parser from 2.2.2 to 2.4.0 - #1641

Open
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/body-parser-2.4.0
Open

chore(deps): bump body-parser from 2.2.2 to 2.4.0#1641
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/body-parser-2.4.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bumps body-parser from 2.2.2 to 2.4.0.

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

v2.3.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.4.0

  • Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)
  • feat: add zstd content-encoding support (#586)
    • Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies
  • fix: avoid mutating the parser options and the request object while reading the body (#742, #750)
  • perf(json): avoid first-char regex for direct JSON bodies (#744)
  • deps:
    • content-type@^2.1.0
    • iconv-lite^0.7.3
    • qs@^6.16.1

2.3.0

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0
Commits
  • b4744d7 2.4.0 (#777)
  • f7075ea fix: prevent process crash from trailing bytes after a compressed body
  • 185ff1d chore: update dependencies (#778)
  • 73713f7 docs: fix depth error description (#776)
  • 2dcc826 docs: improve readability (#756)
  • 402dbdc docs: note that req.body may be undefined in v2 (#752)
  • 9883a1e perf: inline content stream setup (#750)
  • 02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
  • 822a0fd build(deps): bump the github-actions group with 3 updates (#771)
  • aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump body-parser from 2.2.2 to 2.4.0
cdf2197 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.2.2 to 2.4.0.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.4.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 23, 2026
@vercel

vercel Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
sentry-local Ready Ready Preview Oct 23, 2026 11:53pm UTC

Request Review

@github-actions github-actions Bot added the risk: medium PR risk score: medium label Oct 23, 2026
sentry-junior Bot and others added 2 commits October 23, 2026 23:40
@sentry-junior @BYK
Merge branch 'main' into fix
7343243 
Co-Authored-By: BYK <burak.kaya@sentry.io>
@sentry-junior @BYK
fix(deps): Limit body-parser bump to body-parser and qs
f3f354b 
Dependabot's lockfile re-resolution also pulled in transitive packages
published within pnpm's minimumReleaseAge window, which fails the
frozen install in CI. Rebuild the lockfile from main with only
body-parser 2.4.0 and its required qs 6.16.1.

Co-Authored-By: BYK <burak.kaya@sentry.io>

This branch was successfully deployed

1 active deployment
Preview — f3f354bd Deployed Oct 23, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BYK BYK BYK approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code risk: medium PR risk score: medium

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BYK