Bump body-parser and express by dependabot[bot] · Pull Request #20 · Equal-Vote/star-quick-questions

dependabot · 2026-09-10T21:04:22Z

Bumps body-parser and express. These dependencies needed to be updated together.
Updates body-parser from 1.20.3 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

ci: backport npm-publish workflow from master by @UlisesGascon in expressjs/body-parser#769

1.20.8 by @UlisesGascon in expressjs/body-parser#770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

docs: include security fix in 1.20.6 changes by @UlisesGascon in expressjs/body-parser#747

deps: qs@~6.16.0 by @krzysdz in expressjs/body-parser#761

1.20.7 by @UlisesGascon in expressjs/body-parser#767

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

refactor(json): simplify strict mode error string construction by @jonchurch in expressjs/body-parser#692

fix: correct off-by-one error in parameterCount by @abhu85 in expressjs/body-parser#716

deps(qs): bump qs to 6.15.1 by @jonchurch in expressjs/body-parser#722

Release: 1.20.5 by @jonchurch in expressjs/body-parser#721

New Contributors

@abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.8

Same code base as 1.20.7. This was created to test the new release process.

1.20.7

deps: qs@~6.16.0

1.20.6

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

1.20.5

refactor(json): simplify strict mode error string construction

fix: extended urlencoded parsing of arrays with >100 elements (#716)

deps: qs@~6.15.1

1.20.4

deps: qs@~6.14.0

deps: use tilde notation for dependencies

deps: http-errors@~2.0.1

deps: raw-body@~2.5.3

Commits

5c08c20 1.20.8 (#770)
0cea4f4 ci: backport npm-publish workflow from master (#769)
0f0f0d7 1.20.7 (#767)
355eb04 deps: qs@~6.16.0 (#761)
8be369a docs: include security fix in 1.20.6 changes
5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
0defdbe release(patch): 1.20.5
cd0e7a0 deps(qs): bump qs to 6.15.1
6f24d7e fix: correct off-by-one error in parameterCount (#716)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates express from 4.21.2 to 4.22.2

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.

deps: qs@~6.15.1

deps: body-parser@~1.20.5

New Contributors

@suuuuuuminnnnnn made their first contribution in expressjs/express#7021

@SAY-5 made their first contribution in expressjs/express#7181

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Release: 4.22.1 by @UlisesGascon in expressjs/express#6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

Refactor: improve readability by @sazk07 in expressjs/express#6190

ci: add support for Node.js@23.0 by @UlisesGascon in expressjs/express#6080

Method functions with no path should error by @wesleytodd in expressjs/express#5957

ci: updated github actions ci workflow by @Phillip9587 in expressjs/express#6323

ci: reorder npm i steps to fix ci for older node versions by @Phillip9587 in expressjs/express#6336

Backport: ci: add node.js 24 to test matrix by @Phillip9587 in expressjs/express#6506

chore(4.x): wider range for query test skip by @jonchurch in expressjs/express#6513

use tilde notation for certain dependencies by @UlisesGascon in expressjs/express#6905

deps: qs@6.14.0 by @UlisesGascon in expressjs/express#6909

deps: use tilde notation for qs by @Phillip9587 in expressjs/express#6919

Release: 4.22.0 by @UlisesGascon in expressjs/express#6921

Full Changelog: expressjs/express@4.21.2...4.22.0

Changelog

Sourced from express's changelog.

4.22.2 / 2026-05-011

fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)

This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.

deps: qs@~6.15.1

deps: body-parser@~1.20.5

4.22.1 / 2025-12-01

Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

4.22.0 / 2025-12-01

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

deps: use tilde notation for dependencies

deps: qs@6.14.0

Commits

df0abc9 4.22.2
836d366 4.x update qs to 6.15.1, body-parser 1.20.5 (#7224)
8d09bfe fix: restore array parsing for req.query repeated keys (#7181)
d39e8ad deps: body-parser@~1.20.4 (#7021)
efe85d9 deps: qs@^6.14.1 (#6972)
f62378e 📝 add note to history
12fae14 4.22.1
5ddf311 Revert "sec: security patch for CVE-2024-51999"
49744ab 4.22.0 (#6921)
6e97452 sec: security patch for CVE-2024-51999
Additional commits viewable in compare view

coderabbitai · 2026-09-10T21:04:52Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 03ca40b8-0ae3-4910-af83-f1c2d6661063

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Bumps [body-parser](https://github.com/expressjs/body-parser) and [express](https://github.com/expressjs/express). These dependencies needed to be updated together. Updates `body-parser` from 1.20.3 to 1.20.8 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md) - [Commits](expressjs/body-parser@1.20.3...1.20.8) Updates `express` from 4.21.2 to 4.22.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md) - [Commits](expressjs/express@4.21.2...v4.22.2) --- updated-dependencies: - dependency-name: body-parser dependency-version: 1.20.8 dependency-type: indirect - dependency-name: express dependency-version: 4.22.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 10, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b249afcfbc branch from 2a0e9eb to 7811339 Compare September 14, 2026 00:48

Navigation Menu

Uh oh!

Bump body-parser and express - #20

Bump body-parser and express#20
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-b249afcfbc

dependabot Bot commented on behalf of github Sep 10, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.20.8

Important

What's Changed

1.20.7

What's Changed

1.20.6

Important: Security

What's Changed

v1.20.5

What's Changed

New Contributors

1.20.8

1.20.7

1.20.6

1.20.5

1.20.4

v4.22.2

What's Changed

New Contributors

v4.22.1

What's Changed

4.22.0

Important: Security

What's Changed

4.22.2 / 2026-05-011

4.22.1 / 2025-12-01

4.22.0 / 2025-12-01

Uh oh!

coderabbitai Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 10, 2026 •

edited

Loading

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading