Skip to content

fix: Bump body-parser from 2.2.2 to 2.3.0 - #10600

Merged
mtrezza merged 1 commit into
alphafrom
dependabot/npm_and_yarn/body-parser-2.3.0
Sep 23, 2026
Merged

fix: Bump body-parser from 2.2.2 to 2.3.0#10600
mtrezza merged 1 commit into
alphafrom
dependabot/npm_and_yarn/body-parser-2.3.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps body-parser from 2.2.2 to 2.3.0.

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0
Commits
  • d0f2ace 2.3.0 (#735)
  • 7d03f2f chore: updated deps to latest (#733)
  • 8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
  • 32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
  • ff0f6b9 docs: update outdated reference to MDN docs (#730)
  • 14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
  • 37f36a2 deps: update content-type and type-is (#728)
  • e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
  • e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
  • a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Bot label; pull requests that updates a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026
@codecov

codecov Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.82%. Comparing base (25263e7) to head (eb19ad0).
⚠️ Report is 3 commits behind head on alpha.

Additional details and impacted files 
@@           Coverage Diff           @@
##            alpha   #10600   +/-   ##
=======================================
  Coverage   93.82%   93.82%           
=======================================
  Files         192      192           
  Lines       16882    16882           
  Branches      252      252           
=======================================
  Hits        15840    15840           
  Misses       1020     1020           
  Partials       22       22

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/body-parser-2.3.0 branch 3 times, most recently from 3be3eac to cf78854 Compare July 26, 2026 00:58
@mtrezza

mtrezza commented Sep 23, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
refactor: Bump body-parser from 2.2.2 to 2.3.0
eb19ad0 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.2.2 to 2.3.0.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/body-parser-2.3.0 branch from cf78854 to eb19ad0 Compare September 23, 2026 02:59
@coderabbitai

coderabbitai Bot commented Sep 23, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fe561460-0e76-430d-8197-e2f9183429bb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@mtrezza mtrezza changed the title refactor: Bump body-parser from 2.2.2 to 2.3.0 fix: Bump body-parser from 2.2.2 to 2.3.0 Sep 23, 2026
@parse-github-assistant

parse-github-assistant Bot commented Sep 23, 2026

Copy link
Copy Markdown

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

  • Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
  • Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
  • Group code into logical blocks. Add a short comment before each block to explain its purpose.
  • We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
  • Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
  • Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

@mtrezza
mtrezza merged commit 77e955f into alpha Sep 23, 2026
25 checks passed
@mtrezza
mtrezza deleted the dependabot/npm_and_yarn/body-parser-2.3.0 branch September 23, 2026 03:26
parseplatformorg pushed a commit that referenced this pull request Sep 23, 2026
@semantic-release-bot
chore(release): 9.10.1-alpha.20 [skip ci]
9aaf925 
## [9.10.1-alpha.20](9.10.1-alpha.19...9.10.1-alpha.20) (2026-09-23)

### Bug Fixes

* Bump body-parser from 2.2.2 to 2.3.0 ([#10600](#10600)) ([77e955f](77e955f))
@parseplatformorg

parseplatformorg commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

🎉 This change has been released in version 9.10.1-alpha.20

@parseplatformorg parseplatformorg added the state:released-alpha Released as alpha version label Sep 23, 2026
parseplatformorg pushed a commit that referenced this pull request Sep 24, 2026
@semantic-release-bot
chore(release): 9.10.1 [skip ci]
f6ced11 
## [9.10.1](9.10.0...9.10.1) (2026-09-24)

### Bug Fixes

* `Parse.Query.explain` runs afterFind trigger on query plan results ([#10536](#10536)) ([64d58ff](64d58ff))
* Account takeover via empty password in LDAP auth adapter ([GHSA-863r-39r9-vfcf](GHSA-863r-39r9-vfcf)) ([#10642](#10642)) ([f261957](f261957))
* Bump @parse/push-adapter from 8.4.0 to 8.5.3 ([#10676](#10676)) ([ae167c4](ae167c4))
* Bump body-parser from 2.2.2 to 2.3.0 ([#10600](#10600)) ([77e955f](77e955f))
* Bump express-rate-limit from 8.3.1 to 8.7.0 ([#10672](#10672)) ([73d8600](73d8600))
* Bump follow-redirects from 1.15.11 to 1.16.0 ([#10577](#10577)) ([d577327](d577327))
* Bump parse from 8.6.0 to 8.6.2, @parse/push-adapter from 8.5.3 to 8.5.5 and ws from 8.21.0 to 8.21.3 ([#10688](#10688)) ([11c8a40](11c8a40))
* Bump qs from 6.15.2 to 6.16.0 ([#10651](#10651)) ([25263e7](25263e7))
* Bump undici from 7.28.0 to 7.29.1 ([#10674](#10674)) ([2f09a30](2f09a30))
* Bump ws from 8.20.0 to 8.21.0 ([#10576](#10576)) ([629426f](629426f))
* Creating a session can delete another user's session ([#10582](#10582)) ([0df8779](0df8779))
* GraphQL argument and enum validation errors disclose target class names when public introspection is disabled ([GHSA-6m77-f8xr-f723](GHSA-6m77-f8xr-f723)) ([#10665](#10665)) ([fead3db](fead3db))
* GraphQL schema is disclosed by replaying an automatic persisted query when public introspection is disabled ([GHSA-gxxq-pghq-9vrc](GHSA-gxxq-pghq-9vrc)) ([#10669](#10669)) ([8d22053](8d22053))
* Install the latest Parse Server version in bootstrap.sh ([#10556](#10556)) ([997ee15](997ee15))
* LiveQuery discloses protected fields by resolving an incomplete subscriber identity ([GHSA-9jpp-xhh6-75mf](GHSA-9jpp-xhh6-75mf)) ([#10654](#10654)) ([66c507b](66c507b))
* Per-entry cache TTL is ignored by the in-memory cache adapter ([#10671](#10671)) ([1352c67](1352c67))
* Rate limit is bypassed by sending request header `X-Forwarded-For: 127.0.0.1` when Parse Server option `trustProxy` is permissive ([#10664](#10664)) ([ebd425e](ebd425e))
* Relation count query bypasses protectedFields for identity-scoped groups ([GHSA-rmhf-xv62-rm99](GHSA-rmhf-xv62-rm99)) ([#10667](#10667)) ([a32977f](a32977f))
* Server crash from unhandled promise rejection when multiple Cloud Code validator fields fail ([#10540](#10540)) ([90c2778](90c2778))
* Unauthenticated deletion of installation records via operator injection in device token deduplication ([GHSA-cc6h-c8m4-hgrx](GHSA-cc6h-c8m4-hgrx)) ([#10657](#10657)) ([ad00f82](ad00f82))
* Unverified auth provider identity accepted on password login for code-based auth adapters ([GHSA-mr43-w6c2-mvjq](GHSA-mr43-w6c2-mvjq)) ([#10662](#10662)) ([9b73e6f](9b73e6f))
@parseplatformorg

parseplatformorg commented Sep 24, 2026

Copy link
Copy Markdown
Contributor

🎉 This change has been released in version 9.10.1

@parseplatformorg parseplatformorg added the state:released Released as stable version label Sep 24, 2026
@mtrezza mtrezza mentioned this pull request Sep 25, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Bot label; pull requests that updates a dependency file javascript Pull requests that update javascript code state:released Released as stable version state:released-alpha Released as alpha version

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mtrezza @parseplatformorg