chore(deps): bump the npm_and_yarn group across 2 directories with 10 updates

[dependabot]

Bumps the npm_and_yarn group with 7 updates in the /client directory:

Package	From	To
react-router-dom	6.30.3	7.0.0
postcss	8.5.6	8.5.26
vite	7.3.2	8.2.1
brace-expansion	1.1.14	1.1.18
js-yaml	4.1.1	4.3.1
socket.io-parser	4.2.6	4.2.7
ws	8.20.1	8.21.3

Bumps the npm_and_yarn group with 3 updates in the /server directory: socket.io-parser, ws and body-parser.

Updates react-router-dom from 6.30.3 to 7.0.0

Changelog

Sourced from react-router-dom's changelog.

7.0.0

Major Changes

• Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#11744)

  • defer
  • AbortedDeferredError
  • type TypedDeferredData
  • UNSAFE_DeferredData
  • UNSAFE_DEFERRED_SYMBOL,

• Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#11469)

• Remove single_fetch future flag. (#11522)

• Remove future.v7_startTransition flag (#11696)

• Remove future.v7_normalizeFormMethod future flag (#11697)

• Allow returning undefined from actions and loaders (#11680)

• update minimum node version to 18 (#11690)

• Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#11726)

• Remove future.v7_throwAbortReason from internalized @remix-run/router package (#11728)

• Add exports field to all packages (#11675)

• node package no longer re-exports from react-router (#11702)

• updates the minimum React version to 18 (#11689)

• • Remove the future.v7_partialHydration flag (#11725)
    • This also removes the <RouterProvider fallbackElement> prop
      • To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
    • Also worth nothing there is a related breaking changer with this future flag:
      • Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
      • With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load

• Remove future.v7_fetcherPersist flag (#11731)

Minor Changes

• Add prefetching support to Link/NavLink when using Remix SSR (#11402)
• Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#11401)
• Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#11396) (#11400)

Patch Changes

... (truncated)

Commits

• e8e3b00 chore: Update version for release (#12344)
• 1499f3e chore: Update version for release (pre) (#12315)
• 995bcbb chore: Update version for release (pre) (#12235)
• 0e9b346 chore: Update version for release (pre) (#12205)
• 6576bd0 chore: Update version for release (pre) (#12202)
• 8daac72 Merge branch 'dev' into release-next
• 2d5924f feat: configure export conditions properly (#12136)
• 18dc8b8 chore: Update version for release (pre) (#12184)
• fde6951 Merge branch 'dev' into release-next
• 813497a Drop support for Node 18 and installGlobals (#12171)
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (6.30.3) was attested. Review the package versions before updating.

Updates postcss from 8.5.6 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).

... (truncated)

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates vite from 7.3.2 to 8.2.1

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.1 (2026-08-06)

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
• css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
• deps: update all non-major dependencies (#23136) (14454fd)
• deps: update rolldown-related dependencies (#23070) (7ac6f7f)
• don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
• handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
• server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

• css: look up pure CSS chunks through a Set (#23114) (1331b0b)

Documentation

• build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

• deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
• deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

• bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
• bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

• bundled-dev: enable sourcemap playgrounds (#23080) (c2155fe)
• reduce logs (#23138) (7673c02)

8.2.0 (2026-07-30)

Features

• add input to server.fs.allow (#23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
• config: include column in config incompatibility location (#23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
• deps: update all non-major dependencies (#23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

... (truncated)

Commits

• 4216158 release: v8.2.1
• fddf4ea fix(server): use a random port when port is 0 (#23158)
• de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
• 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
• c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
• ef02435 docs(build): fix incomplete @default for build.minify (#23177)
• eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
• 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
• e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
• 14454fd fix(deps): update all non-major dependencies (#23136)
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.14 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• 2203f4f 1.1.15
• 0b09384 Backport v5.0.6 change to v1 (#111)
• See full diff in compare view

Updates js-yaml from 4.1.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.
• Fix digits in YAML named tag handles.

Security

• Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• Additional commits viewable in compare view

Updates nanoid from 3.3.11 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

3.3.15

• Fixed npm provenance error.

3.3.14

• Fixed random pool corruption on big ID sizes.

3.3.13

• Reduced npm package size.

3.3.12

• Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

3.3.15

• Fixed npm provenance error.

3.3.14

• Fixed random pool corruption on big ID sizes.

3.3.13

• Reduced npm package size.

3.3.12

• Fixed breaking Nano ID by requesting big ID.

Commits

• 9ad9805 Release 3.3.18 version
• 55e50a0 Update CI action
• e10f8d4 Update index.native.js (#606)
• 73d6716 Release 3.3.17 version
• f9d13f1 Sync 0 size behaviour with PostCSS 5
• 9760e11 Release 3.3.16 version
• e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
• 96dd086 Update CI action
• ba0bc3b Do not create latest release for v3
• 6819724 Release 3.3.15 version
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates react-router from 6.30.3 to 7.0.0

Release notes

Sourced from react-router's releases.

v7.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v700

v6.30.4

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6304

Changelog

Sourced from react-router's changelog.

7.0.0

Major Changes

• Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#11744)

  • defer
  • AbortedDeferredError
  • type TypedDeferredData
  • UNSAFE_DeferredData
  • UNSAFE_DEFERRED_SYMBOL,
• • Collapse @remix-run/router into react-router (#11505)
  • Collapse react-router-dom into react-router
  • Collapse @remix-run/server-runtime into react-router
  • Collapse @remix-run/testing into react-router

• Remove single fetch future flag. (#11522)

• Drop support for Node 16, React Router SSR now requires Node 18 or higher (#11391)

• Remove future.v7_startTransition flag (#11696)

• • Expose the underlying router promises from the following APIs for compsition in React 19 APIs: (#11521)
    • useNavigate()
    • useSubmit
    • useFetcher().load
    • useFetcher().submit
    • useRevalidator.revalidate

• Remove future.v7_normalizeFormMethod future flag (#11697)

• For Remix consumers migrating to React Router, the crypto global from the Web Crypto API is now required when using cookie and session APIs. This means that the following APIs are provided from react-router rather than platform-specific packages: (#11837)

  • createCookie
  • createCookieSessionStorage
  • createMemorySessionStorage
  • createSessionStorage

  For consumers running older versions of Node, the installGlobals function from @remix-run/node has been updated to define globalThis.crypto, using Node's require('node:crypto').webcrypto implementation.

  Since platform-specific packages no longer need to implement this API, the following low-level APIs have been removed:

  • createCookieFactory
  • createSessionStorageFactory
  • createCookieSessionStorageFactory
  • createMemorySessionStorageFactory

• Imports/Exports cleanup (#11840)

  • Removed the following exports that were previously public API from @remix-run/router
    • types
      • AgnosticDataIndexRouteObject
      • AgnosticDataNonIndexRouteObject

... (truncated)

Commits

• e8e3b00 chore: Update version for release (#12344)
• 1499f3e chore: Update version for release (pre) (#12315)
• fd76ac8 Merge branch 'dev' into release-next
• 1217253 add export conditions for route module types (#12312)
• b0e037f un-deprecate types for library mode (#12309)
• 144a89a fix types for Await's render prop (#12298)
• 7d365ed matches as component prop (#12291)
• 7d92685 typegen: not ignored by skipLibCheck (#12289)
• 2bd6740 Add react-router.config.ts (#12251)
• 5a7b291 typegen: +types.\<route> -> +types/\<route> (#12284)
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (6.30.3) was attested. Review the package versions before updating.

Updates socket.io-parser from 4.2.6 to 4.2.7

Release notes

Sourced from socket.io-parser's releases.

socket.io-parser@4.2.7

Bug Fixes

• honor toJSON() when deconstructing a binary packet (#5518) (57f1114)
• reject binary packets with zero attachments (7c6ef57)

New Contributors

• @​spokodev made their first contribution in socketio/socket.io#5518

Commits

• 4054894 chore(release): socket.io-parser@4.2.7
• 7c6ef57 fix(parser): reject binary packets with zero attachments
• 57f1114 fix(parser): honor toJSON() when deconstructing a binary packet (#5518)
• 8d2e4f7 docs(security): add CVE-2026-59724 and CVE-2026-59725
• d2d753f refactor(sio): align client file matching in Node.js HTTP server
• dfb5ab3 fix(sio): prevent uWebSockets.js from serving missing client files
• dcbd961 perf(eio): optimize polling request body buffering
• 6bb2e7f refactor(sio): internalize base64id dependency
• a80711a refactor(eio): internalize base64id dependency
• 8bead0f chore: upgrade to TypeScript 6
• Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
</tr></table>

... (truncated)

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates socket.io-parser from 4.2.6 to 4.2.7

Release notes

Sourced from socket.io-parser's releases.

socket.io-parser@4.2.7

Bug Fixes

• honor toJSON() when deconstructing a binary packet (#5518) (57f1114)
• reject binary packets with zero attachments (7c6ef57)

New Contributors

• @​spokodev made their first contribution in socketio/socket.io#5518

Commits

• 4054894 chore(release): socket.io-parser@4.2.7
• 7c6ef57 fix(parser): reject binary packets with zero attachments
• 57f1114 fix(parser): honor toJSON() when deconstructing a binary packet (#5518)
• 8d2e4f7 docs(security): add CVE-2026-59724 and CVE-2026-59725
• d2d753f refactor(sio): align client file matching in Node.js HTTP server
• dfb5ab3 fix(sio): prevent uWebSockets.js from serving missing client files
• dcbd961 perf(eio): optimize polling request body buffering
• 6bb2e7f refactor(sio): internalize base64id dependency
• a80711a refactor(eio): internalize base64id dependency
• 8bead0f chore: upgrade to TypeScript 6
• Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
</tr></table>

... (truncated)

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates body-parser from 1.20.5 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• fix: improve limit option validation by @​Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

• Security fix for GHSA-v422-hmwv-36x6
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit

Commits

• 5cc4fb8 1.20.6 (#746)
• 3492672 fix: improve limit option validation (#741)
• See full diff in