Skip to content

chore(deps): bump body-parser from 2.2.1 to 2.3.0 - #17

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/body-parser-2.3.0
Open

chore(deps): bump body-parser from 2.2.1 to 2.3.0#17
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/body-parser-2.3.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps body-parser from 2.2.1 to 2.3.0.

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

v2.2.2

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0

2.2.2 / 2026-01-07

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction
Commits
  • d0f2ace 2.3.0 (#735)
  • 7d03f2f chore: updated deps to latest (#733)
  • 8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
  • 32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
  • ff0f6b9 docs: update outdated reference to MDN docs (#730)
  • 14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
  • 37f36a2 deps: update content-type and type-is (#728)
  • e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
  • e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
  • a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
chore(deps): bump body-parser from 2.2.1 to 2.3.0
a2a063d 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.2.1 to 2.3.0.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.1...v2.3.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026
nmori added a commit that referenced this pull request Sep 8, 2026
@nmori @claude
v5.66.7+3 chore(deps): 脆弱性警告への対応（29件 → 17件）
386a4b7 
npm audit fix が 0 件変更だったのは、overrides が古いバージョンを
ピン留めしていたため。範囲内バンプと overrides 更新の両方で対応した。

package.json:
・dompurify ^3.4.11 → ^3.4.15（GHSA-55q2-fjhq-7xh7 は 3.4.12 以下が対象のため
  Dependabot の 3.4.13 提案では不足）
・overrides.qs 6.15.2 → 6.16.0
・overrides["@xmldom/xmldom"] 0.8.13 → 0.8.15
・overrides["engine.io-client"] 6.6.5 → 6.6.6
  （6.6.6 が ws ~8.21.0 を要求するため ws の high も連鎖解決）
・overrides.grunt に js-yaml 3.15.2 を追加
  （grunt が ~3.14.0 固定で修正版に上がらないため、grunt 配下だけ解除）

package-lock.json（範囲内バンプ）:
・socket.io-parser 4.2.6 → 4.2.7
・brace-expansion 1.1.14/2.1.0 → 1.1.18/2.1.4
・immutable 4.3.8 → 4.3.9
・body-parser 2.2.1 → 2.3.0
・@humanfs/node 0.16.7 → 0.16.8
・js-yaml 4.1.1 → 4.3.2

Dependabot PR #17 #19 #20 #21 #22 #23 はこれで解消。

残る 17 件は AngularJS 一式（EOL、修正版なし）、electron 本体（メジャー）、
ビルド／パッケージング専用ツール（@electron/packager, extract-zip,
grunt-contrib-compress, appdmg, electron-installer-dmg）で、
いずれも配布物の実行時経路に含まれないため今回は見送り。

検証: npx tsc --noEmit / npm run build（win64 パッケージングまで）成功

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants