Skip to content

chore(deps): bump body-parser from 2.2.0 to 2.4.0 in /packages/playwright-cloudflare/examples/stagehand - #250

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/playwright-cloudflare/examples/stagehand/body-parser-2.4.0
Open

chore(deps): bump body-parser from 2.2.0 to 2.4.0 in /packages/playwright-cloudflare/examples/stagehand#250
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/playwright-cloudflare/examples/stagehand/body-parser-2.4.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps body-parser from 2.2.0 to 2.4.0.

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

v2.3.0

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.4.0

  • Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)
  • feat: add zstd content-encoding support (#586)
    • Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies
  • fix: avoid mutating the parser options and the request object while reading the body (#742, #750)
  • perf(json): avoid first-char regex for direct JSON bodies (#744)
  • deps:
    • content-type@^2.1.0
    • iconv-lite^0.7.3
    • qs@^6.16.1

2.3.0

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0

2.2.2

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction

2.2.1

  • Security fix for GHSA-wqch-xfxh-vrr4
  • deps:
    • type-is@^2.0.1
    • iconv-lite@^0.7.0
      • Handle split surrogate pairs when encoding UTF-8
      • Avoid false positives in encodingExists by using prototype-less objects
    • raw-body@^3.0.1
    • debug@^4.4.3
Commits
  • b4744d7 2.4.0 (#777)
  • f7075ea fix: prevent process crash from trailing bytes after a compressed body
  • 185ff1d chore: update dependencies (#778)
  • 73713f7 docs: fix depth error description (#776)
  • 2dcc826 docs: improve readability (#756)
  • 402dbdc docs: note that req.body may be undefined in v2 (#752)
  • 9883a1e perf: inline content stream setup (#750)
  • 02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
  • 822a0fd build(deps): bump the github-actions group with 3 updates (#771)
  • aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump body-parser
06d6d0d 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.2.0 to 2.4.0.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.0...v2.4.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 28, 2026
@clanky-the-clanker

clanky-the-clanker Bot commented Oct 28, 2026

Copy link
Copy Markdown

✅ Approved — This lockfile-only bump to body-parser 2.4.0 picks up upstream security fixes and is consistent with express's declared range. No issues found.

The decision is advisory: this comment never approves, blocks or requests changes on the pull request.

✅ All checks passed

🔒 Security: ✅ LGTM

Upgrading picks up the upstream body-parser security fixes. All resolved URLs point to registry.npmjs.org, and every entry has an integrity hash.

📖 AGENTS.md: ✅ LGTM

A dependency-only lockfile update needs no change to repository guidance files.

📋 Code Quality: ✅ LGTM

This pull request is a lockfile-only bump. The nested body-parser@2.4.0 satisfies express's ^2.2.0 range. Removing the top-level iconv-lite@0.6.3 is safe because nothing else depends on it. The engines field stays at node >=18, and the new zstd support degrades to a 415 response on older Node versions.

⚡ Performance: ✅ LGTM

No performance concerns.

📝 Documentation: ✅ LGTM

No documentation changes are needed.

Reviewed commit: 06d6d0d5

@github-actions

github-actions Bot commented Oct 28, 2026

Copy link
Copy Markdown

@cloudflare/playwright-mcp preview for commit 06d6d0d

npm i https://pkg.pr.new/cloudflare/browser-run/@cloudflare/playwright-mcp@06d6d0d53736466329f2a27c66fe3deb6fd762f7

Published by this workflow run. New pushes and reruns update this comment.

@github-actions

github-actions Bot commented Oct 28, 2026

Copy link
Copy Markdown

@cloudflare/playwright preview for commit 06d6d0d

npm i https://pkg.pr.new/cloudflare/browser-run/@cloudflare/playwright@06d6d0d53736466329f2a27c66fe3deb6fd762f7

Published by this workflow run. New pushes and reruns update this comment.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants