🚨 [security] Update body-parser 1.19.0 → 1.20.3 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ body-parser (1.19.0 → 1.20.3) · Repo · Changelog

Security Advisories 🚨

🚨 body-parser vulnerable to denial of service when url encoding is enabled

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References

Release Notes

1.20.3

What's Changed

Important

• deps: qs@6.13.0
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

• chore: add support for OSSF scorecard reporting by @inigomarquinez in #522
• ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in #523
• fix: pin to node@22.4.1 by @wesleytodd in #527
• deps: qs@6.12.3 by @melikhov-dev in #521
• Add OSSF Scorecard badge by @bjohansebas in #531
• Linter by @UlisesGascon in #534
• Release: 1.20.3 by @UlisesGascon in #535

New Contributors

• @inigomarquinez made their first contribution in #522
• @melikhov-dev made their first contribution in #521
• @bjohansebas made their first contribution in #531
• @UlisesGascon made their first contribution in #534

Full Changelog: 1.20.2...1.20.3

1.20.2

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: raw-body@2.5.2

1.20.1 (from changelog)

• deps: qs@6.11.0
• perf: remove unnecessary object clone

1.20.0

• Fix error message for json parse whitespace in strict
• Fix internal error when inflated body exceeds limit
• Prevent loss of async hooks context
• Prevent hanging when request already read
• deps: depd@2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: http-errors@2.0.0
  • deps: depd@2.0.0
  • deps: statuses@2.0.1
• deps: on-finished@2.4.1
• deps: qs@6.10.3
• deps: raw-body@2.5.1
  • deps: http-errors@2.0.0

1.19.2

• deps: bytes@3.1.2
• deps: qs@6.9.7
  • Fix handling of __proto__ keys
• deps: raw-body@2.4.3
  • deps: bytes@3.1.2

1.19.1

• deps: bytes@3.1.1
• deps: http-errors@1.8.1
  • deps: inherits@2.0.4
  • deps: toidentifier@1.0.1
  • deps: setprototypeof@1.2.0
• deps: qs@6.9.6
• deps: raw-body@2.4.2
  • deps: bytes@3.1.1
  • deps: http-errors@1.8.1
• deps: safe-buffer@5.2.1
• deps: type-is@~1.6.18

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ bytes (indirect, 3.1.0 → 3.1.2) · Repo · Changelog

Release Notes

3.1.2 (from changelog)

• Fix return value for un-parsable strings

3.1.1 (from changelog)

• Fix "thousandsSeparator" incorrecting formatting fractional part

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 33 commits:

• Release 3.1.2
• build: Node.js@17.4
• build: mocha@9.2.0
• Fix return value for un-parsable strings
• build: Node.js@17.3
• Release 3.1.1
• build: mocha@9.1.3
• build: nyc@15.1.0
• docs: add documentation for "bytes" function
• Fix "thousandsSeparator" incorrecting formatting fractional part
• lint: include code in markdown
• build: nyc@14.1.1
• build: support Node.js 17.x
• docs: add quotes around example in thousandsSeparator
• build: mocha@8.4.0
• build: support Node.js 16.x
• build: support Node.js 15.x
• build: mocha@7.2.0
• build: eslint@7.32.0
• build: support Node.js 14.x
• build: support Node.js 13.x
• build: eslint@6.8.0
• build: mocha@6.2.3
• build: eslint@5.16.0
• build: nyc@13.3.0
• build: support Node.js 12.x
• build: Node.js@11.15
• build: Node.js@10.24
• build: use GitHub Actions instead of Travis CI
• build: Node.js@11.9
• build: nyc@13.2.0
• build: eslint@5.13.0
• docs: fix npm version badge

↗️ raw-body (indirect, 2.4.0 → 2.5.2) · Repo · Changelog

Release Notes

2.5.2 (from changelog)

• Fix error message for non-stream argument

2.5.1 (from changelog)

• Fix error on early async hooks implementations

2.5.0 (from changelog)

• Prevent loss of async hooks context
• Prevent hanging when stream is not readable
• deps: http-errors@2.0.0
  • deps: depd@2.0.0
  • deps: statuses@2.0.1

2.4.3 (from changelog)

• deps: bytes@3.1.2

2.4.2 (from changelog)

• deps: bytes@3.1.1
• deps: http-errors@1.8.1
  • deps: setprototypeof@1.2.0
  • deps: toidentifier@1.0.1

2.4.1 (from changelog)

• deps: http-errors@1.7.3
  • deps: inherits@2.0.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 call-bind (added, 1.0.7)

🆕 define-data-property (added, 1.1.4)

🆕 es-define-property (added, 1.0.0)

🆕 es-errors (added, 1.3.0)

🆕 function-bind (added, 1.1.2)

🆕 get-intrinsic (added, 1.2.4)

🆕 gopd (added, 1.0.1)

🆕 has-property-descriptors (added, 1.0.2)

🆕 has-proto (added, 1.0.3)

🆕 has-symbols (added, 1.0.3)

🆕 hasown (added, 2.0.2)

🆕 object-inspect (added, 1.13.2)

🆕 set-function-length (added, 1.2.2)

🆕 side-channel (added, 1.0.6)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #523.