[Snyk] Upgrade body-parser from 1.13.3 to 1.20.6

[trabab]

Snyk has created this PR to upgrade body-parser from 1.13.3 to 1.20.6.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 25 versions ahead of your current version.

• The recommended version was released 2 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	624	No Known Exploit
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-14724253	624	Proof of Concept
	Prototype Poisoning SNYK-JS-QS-3153490	624	Proof of Concept
	Prototype Override Protection Bypass npm:qs:20170213	624	No Known Exploit
	Allocation of Resources Without Limits or Throttling SNYK-JS-BODYPARSER-17906397	624	No Known Exploit
	Uncaught Exception SNYK-JS-QS-19432019	624	Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: body-parser

• 1.20.6 - 2026-07-09
  

  Important: Security

  • Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

  What's Changed

  • fix: improve limit option validation by @ Phillip9587 in #741

  Full Changelog: 1.20.5...1.20.6

• 1.20.5 - 2026-04-24
  

  What's Changed

  The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (#716)

  • refactor(json): simplify strict mode error string construction by @ jonchurch in #692
  • fix: correct off-by-one error in parameterCount by @ abhu85 in #716
  • deps(qs): bump qs to 6.15.1 by @ jonchurch in #722
  • Release: 1.20.5 by @ jonchurch in #721

  New Contributors

  • @ abhu85 made their first contribution in #716

  Special thanks to triager @ krzysdz for keeping this on our radar and effectively triaging the specific issue!

  Full Changelog: 1.20.4...1.20.5

• 1.20.4 - 2025-12-01
  

  What's Changed

  • Remove redundant depth check by @ blakeembrey in #538
  • ci: add support for Node.js v23 by @ Phillip9587 in #553
  • ci: restore CI for 1.x branch by @ bjohansebas in #665
  • deps: qs@^6.14.0 by @ bjohansebas in #664
  • deps: use tilde notation and update certain dependencies by @ Phillip9587 in #668
  • chore: remove SECURITY.md by @ Phillip9587 in #669
  • ci: add CodeQL (SAST) by @ Phillip9587 in #670
  • Release: 1.20.4 by @ UlisesGascon in #672

  Full Changelog: 1.20.3...1.20.4

• 1.20.3 - 2024-09-09
• 1.20.2 - 2023-02-22
• 1.20.1 - 2022-10-06
• 1.20.0 - 2022-04-03
• 1.19.2 - 2022-02-16
• 1.19.1 - 2021-12-10
• 1.19.0 - 2019-04-26
• 1.18.3 - 2018-05-14
• 1.18.2 - 2017-09-22
• 1.18.1 - 2017-09-12
• 1.18.0 - 2017-09-09
• 1.17.2 - 2017-05-18
• 1.17.1 - 2017-03-06
• 1.17.0 - 2017-03-01
• 1.16.1 - 2017-02-11
• 1.16.0 - 2017-01-18
• 1.15.2 - 2016-06-20
• 1.15.1 - 2016-05-06
• 1.15.0 - 2016-02-11
• 1.14.2 - 2015-12-16
• 1.14.1 - 2015-09-28
• 1.14.0 - 2015-09-16
• 1.13.3 - 2015-07-31

from body-parser GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[trabab]

The body-parser package is now deprecated as its functionality has been built directly into Express since version 4.16.0. While your existing code may still function, it relies on a legacy pattern, and this upgrade requires a code modification to align with modern best practices.

Highlights:

• Deprecation: The body-parser package is no longer a necessary dependency for most use cases when using modern versions of Express. [1, 2, 9, 15]
• Built-in Alternatives: The core functionalities have been integrated into Express as express.json() and express.urlencoded(). [1, 6]

Recommendation:
It is highly recommended to remove the body-parser dependency and update your application's middleware initialization:

• Replace app.use(bodyParser.json()) with app.use(express.json()). [15]
• Replace app.use(bodyParser.urlencoded({ extended: true })) with app.use(express.urlencoded({ extended: true })). [6]

This change removes a dependency and aligns the code with current Express standards.

Source: Package Release History

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.