[Snyk] Upgrade body-parser from 1.13.3 to 1.20.5

[trabab]

Snyk has created this PR to upgrade body-parser from 1.13.3 to 1.20.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 24 versions ahead of your current version.

• The recommended version was released 3 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	601	No Known Exploit
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-14724253	601	Proof of Concept
	Prototype Poisoning SNYK-JS-QS-3153490	601	Proof of Concept
	Prototype Override Protection Bypass npm:qs:20170213	601	No Known Exploit
	Allocation of Resources Without Limits or Throttling SNYK-JS-BODYPARSER-17906397	601	No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: body-parser

• 1.20.5 - 2026-04-24
  

  What's Changed

  The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (#716)

  • refactor(json): simplify strict mode error string construction by @ jonchurch in #692
  • fix: correct off-by-one error in parameterCount by @ abhu85 in #716
  • deps(qs): bump qs to 6.15.1 by @ jonchurch in #722
  • Release: 1.20.5 by @ jonchurch in #721

  New Contributors

  • @ abhu85 made their first contribution in #716

  Special thanks to triager @ krzysdz for keeping this on our radar and effectively triaging the specific issue!

  Full Changelog: 1.20.4...1.20.5

• 1.20.4 - 2025-12-01
  

  What's Changed

  • Remove redundant depth check by @ blakeembrey in #538
  • ci: add support for Node.js v23 by @ Phillip9587 in #553
  • ci: restore CI for 1.x branch by @ bjohansebas in #665
  • deps: qs@^6.14.0 by @ bjohansebas in #664
  • deps: use tilde notation and update certain dependencies by @ Phillip9587 in #668
  • chore: remove SECURITY.md by @ Phillip9587 in #669
  • ci: add CodeQL (SAST) by @ Phillip9587 in #670
  • Release: 1.20.4 by @ UlisesGascon in #672

  Full Changelog: 1.20.3...1.20.4

• 1.20.3 - 2024-09-09
  

  What's Changed

  Important

  • deps: qs@6.13.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

  Other changes

  • chore: add support for OSSF scorecard reporting by @ inigomarquinez in #522
  • ci: fix errors in ci github action for node 8 and 9 by @ inigomarquinez in #523
  • fix: pin to node@22.4.1 by @ wesleytodd in #527
  • deps: qs@6.12.3 by @ melikhov-dev in #521
  • Add OSSF Scorecard badge by @ bjohansebas in #531
  • Linter by @ UlisesGascon in #534
  • Release: 1.20.3 by @ UlisesGascon in #535

  New Contributors

  • @ inigomarquinez made their first contribution in #522
  • @ melikhov-dev made their first contribution in #521
  • @ bjohansebas made their first contribution in #531
  • @ UlisesGascon made their first contribution in #534

  Full Changelog: 1.20.2...1.20.3

• 1.20.2 - 2023-02-22
• 1.20.1 - 2022-10-06
• 1.20.0 - 2022-04-03
• 1.19.2 - 2022-02-16
• 1.19.1 - 2021-12-10
• 1.19.0 - 2019-04-26
• 1.18.3 - 2018-05-14
• 1.18.2 - 2017-09-22
• 1.18.1 - 2017-09-12
• 1.18.0 - 2017-09-09
• 1.17.2 - 2017-05-18
• 1.17.1 - 2017-03-06
• 1.17.0 - 2017-03-01
• 1.16.1 - 2017-02-11
• 1.16.0 - 2017-01-18
• 1.15.2 - 2016-06-20
• 1.15.1 - 2016-05-06
• 1.15.0 - 2016-02-11
• 1.14.2 - 2015-12-16
• 1.14.1 - 2015-09-28
• 1.14.0 - 2015-09-16
• 1.13.3 - 2015-07-31

from body-parser GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[trabab]

This is a major version upgrade with significant breaking changes. The body-parser package has been deprecated in favor of the built-in express.json() and express.urlencoded() middleware in Express v4.16.0 and later. Direct use of bodyParser() has been removed.

Key Breaking Changes:

• Middleware Deprecation: The generic bodyParser() middleware is removed. You must now use specific parsers like bodyParser.json() or bodyParser.urlencoded().
• extended Option: The extended option for bodyParser.urlencoded() is now mandatory. You must explicitly set it to true or false to avoid deprecation warnings and ensure consistent parsing behavior.
• Express Integration: For applications using Express v4.16.0 or higher, the body-parser dependency is no longer needed and can be replaced by the built-in Express methods.

Recommendation:
Replace the deprecated body-parser middleware with the modern Express equivalents.

Before:

const bodyParser = require('body-parser');  
app.use(bodyParser.json());  
app.use(bodyParser.urlencoded({ extended: true }));  

After (for Express >= 4.16.0):

const express = require('express');  
app.use(express.json());  
app.use(express.urlencoded({ extended: true }));  

If you are not using Express or are using a version older than 4.16.0, you must update your code to use the specific parser functions from the body-parser package.

Source: Release notes, Stack Overflow

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.