andylockran/Libero

Watch

Fork 0

Update dependency body-parser to ~1.20.0 #1

Open

renovate wants to merge 1 commit from renovate/body-parser-1.x into master

renovate commented

2026-10-26 21:20:14 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
body-parser	`~1.9.0` → `~1.20.0`

Release Notes

expressjs/body-parser (body-parser)

`v1.20.9`

Compare Source

Important: Security

Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

Release: 1.20.9 by @UlisesGascon in #779

Full Changelog: https://github.com/expressjs/body-parser/compare/1.20.8...1.20.9

`v1.20.8`

Compare Source

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

ci: backport npm-publish workflow from master by @UlisesGascon in #769
1.20.8 by @UlisesGascon in #770

Full Changelog: https://github.com/expressjs/body-parser/compare/1.20.7...1.20.8

`v1.20.6`

Compare Source

======

Security fix for GHSA-v422-hmwv-36x6
fix: improve limit option validation (#698)
- Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
- null and undefined fall back to the default 100kb limit

`v1.20.5`

Compare Source

======

refactor(json): simplify strict mode error string construction
fix: extended urlencoded parsing of arrays with >100 elements (#716)
deps: qs@~6.15.1

`v1.20.4`

Compare Source

======

deps: qs@~6.14.0
deps: use tilde notation for dependencies
deps: http-errors@~2.0.1
deps: raw-body@~2.5.3

`v1.20.3`

Compare Source

======

deps: qs@6.13.0
add depth option to customize the depth level in the parser
IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

`v1.20.2`

Compare Source

======

Fix strict json error message on Node.js 19+
deps: content-type@~1.0.5
- perf: skip value escaping when unnecessary
deps: raw-body@2.5.2

`v1.20.1`

Compare Source

======

deps: qs@6.11.0
perf: remove unnecessary object clone

`v1.20.0`

Compare Source

======

Fix error message for json parse whitespace in strict
Fix internal error when inflated body exceeds limit
Prevent loss of async hooks context
Prevent hanging when request already read
deps: depd@2.0.0
- Replace internal eval usage with Function constructor
- Use instance methods on process to check for listeners
deps: http-errors@2.0.0
- deps: depd@2.0.0
- deps: statuses@2.0.1
deps: on-finished@2.4.1
deps: qs@6.10.3
deps: raw-body@2.5.1
- deps: http-errors@2.0.0

`v1.19.2`

Compare Source

======

deps: bytes@3.1.2
deps: qs@6.9.7
- Fix handling of __proto__ keys
deps: raw-body@2.4.3
- deps: bytes@3.1.2

`v1.19.1`

Compare Source

======

deps: bytes@3.1.1
deps: http-errors@1.8.1
- deps: inherits@2.0.4
- deps: toidentifier@1.0.1
- deps: setprototypeof@1.2.0
deps: qs@6.9.6
deps: raw-body@2.4.2
- deps: bytes@3.1.1
- deps: http-errors@1.8.1
deps: safe-buffer@5.2.1
deps: type-is@~1.6.18

`v1.19.0`

Compare Source

======

deps: bytes@3.1.0
- Add petabyte (pb) support
deps: http-errors@1.7.2
- Set constructor name when possible
- deps: setprototypeof@1.1.1
- deps: statuses@'>= 1.5.0 < 2'
deps: iconv-lite@0.4.24
- Added encoding MIK
deps: qs@6.7.0
- Fix parsing array brackets after index
deps: raw-body@2.4.0
- deps: bytes@3.1.0
- deps: http-errors@1.7.2
- deps: iconv-lite@0.4.24
deps: type-is@~1.6.17
- deps: mime-types@~2.1.24
- perf: prevent internal throw on invalid type

`v1.18.3`

Compare Source

======

Fix stack trace for strict json parse error
deps: depd@~1.1.2
- perf: remove argument reassignment
deps: http-errors@~1.6.3
- deps: depd@~1.1.2
- deps: setprototypeof@1.1.0
- deps: statuses@'>= 1.3.1 < 2'
deps: iconv-lite@0.4.23
- Fix loading encoding with year appended
- Fix deprecation warnings on Node.js 10+
deps: qs@6.5.2
deps: raw-body@2.3.3
- deps: http-errors@1.6.3
- deps: iconv-lite@0.4.23
deps: type-is@~1.6.16
- deps: mime-types@~2.1.18

`v1.18.2`

Compare Source

======

deps: debug@2.6.9
perf: remove argument reassignment

`v1.18.1`

Compare Source

======

deps: content-type@~1.0.4
- perf: remove argument reassignment
- perf: skip parameter parsing when no parameters
deps: iconv-lite@0.4.19
- Fix ISO-8859-1 regression
- Update Windows-1255
deps: qs@6.5.1
- Fix parsing & compacting very deep objects
deps: raw-body@2.3.2
- deps: iconv-lite@0.4.19

`v1.18.0`

Compare Source

======

Fix JSON strict violation error to match native parse error
Include the body property on verify errors
Include the type property on all generated errors
Use http-errors to set status code on errors
deps: bytes@3.0.0
deps: debug@2.6.8
deps: depd@~1.1.1
- Remove unnecessary Buffer loading
deps: http-errors@~1.6.2
- deps: depd@1.1.1
deps: iconv-lite@0.4.18
- Add support for React Native
- Add a warning if not loaded as utf-8
- Fix CESU-8 decoding in Node.js 8
- Improve speed of ISO-8859-1 encoding
deps: qs@6.5.0
deps: raw-body@2.3.1
- Use http-errors for standard emitted errors
- deps: bytes@3.0.0
- deps: iconv-lite@0.4.18
- perf: skip buffer decoding on overage chunk
perf: prevent internal throw when missing charset

`v1.17.2`

Compare Source

======

deps: debug@2.6.7
- Fix DEBUG_MAX_ARRAY_LENGTH
- deps: ms@2.0.0
deps: type-is@~1.6.15
- deps: mime-types@~2.1.15

`v1.17.1`

Compare Source

======

deps: qs@6.4.0
- Fix regression parsing keys starting with [

`v1.17.0`

Compare Source

======

deps: http-errors@~1.6.1
- Make message property enumerable for HttpErrors
- deps: setprototypeof@1.0.3
deps: qs@6.3.1
- Fix compacting nested arrays

`v1.16.1`

Compare Source

======

deps: debug@2.6.1
- Fix deprecation messages in WebStorm and other editors
- Undeprecate DEBUG_FD set to 1 or 2

`v1.16.0`

Compare Source

======

deps: debug@2.6.0
- Allow colors in workers
- Deprecated DEBUG_FD environment variable
- Fix error when running under React Native
- Use same color for same namespace
- deps: ms@0.7.2
deps: http-errors@~1.5.1
- deps: inherits@2.0.3
- deps: setprototypeof@1.0.2
- deps: statuses@'>= 1.3.1 < 2'
deps: iconv-lite@0.4.15
- Added encoding MS-31J
- Added encoding MS-932
- Added encoding MS-936
- Added encoding MS-949
- Added encoding MS-950
- Fix GBK/GB18030 handling of Euro character
deps: qs@6.2.1
- Fix array parsing from skipping empty values
deps: raw-body@~2.2.0
- deps: iconv-lite@0.4.15
deps: type-is@~1.6.14
- deps: mime-types@~2.1.13

`v1.15.2`

Compare Source

======

deps: bytes@2.4.0
deps: content-type@~1.0.2
- perf: enable strict mode
deps: http-errors@~1.5.0
- Use setprototypeof module to replace __proto__ setting
- deps: statuses@'>= 1.3.0 < 2'
- perf: enable strict mode
deps: qs@6.2.0
deps: raw-body@~2.1.7
- deps: bytes@2.4.0
- perf: remove double-cleanup on happy path
deps: type-is@~1.6.13
- deps: mime-types@~2.1.11

`v1.15.1`

Compare Source

======

deps: bytes@2.3.0
- Drop partial bytes on all parsed units
- Fix parsing byte string that looks like hex
deps: raw-body@~2.1.6
- deps: bytes@2.3.0
deps: type-is@~1.6.12
- deps: mime-types@~2.1.10

`v1.15.0`

Compare Source

======

deps: http-errors@~1.4.0
- Add HttpError export, for err instanceof createError.HttpError
- deps: inherits@2.0.1
- deps: statuses@'>= 1.2.1 < 2'
deps: qs@6.1.0
deps: type-is@~1.6.11
- deps: mime-types@~2.1.9

`v1.14.2`

Compare Source

======

deps: bytes@2.2.0
deps: iconv-lite@0.4.13
deps: qs@5.2.0
deps: raw-body@~2.1.5
- deps: bytes@2.2.0
- deps: iconv-lite@0.4.13
deps: type-is@~1.6.10
- deps: mime-types@~2.1.8

`v1.14.1`

Compare Source

======

Fix issue where invalid charset results in 400 when verify used
deps: iconv-lite@0.4.12
- Fix CESU-8 decoding in Node.js 4.x
deps: raw-body@~2.1.4
- Fix masking critical errors from iconv-lite
- deps: iconv-lite@0.4.12
deps: type-is@~1.6.9
- deps: mime-types@~2.1.7

`v1.14.0`

Compare Source

======

Fix JSON strict parse error to match syntax errors
Provide static require analysis in urlencoded parser
deps: depd@~1.1.0
- Support web browser loading
deps: qs@5.1.0
deps: raw-body@~2.1.3
- Fix sync callback when attaching data listener causes sync read
deps: type-is@~1.6.8
- Fix type error when given invalid type to match against
- deps: mime-types@~2.1.6

`v1.13.3`

Compare Source

======

deps: type-is@~1.6.6
- deps: mime-types@~2.1.4

`v1.13.2`

Compare Source

======

deps: iconv-lite@0.4.11
deps: qs@4.0.0
- Fix dropping parameters like hasOwnProperty
- Fix user-visible incompatibilities from 3.1.0
- Fix various parsing edge cases
deps: raw-body@~2.1.2
- Fix error stack traces to skip makeError
- deps: iconv-lite@0.4.11
deps: type-is@~1.6.4
- deps: mime-types@~2.1.2
- perf: enable strict mode
- perf: remove argument reassignment

`v1.13.1`

Compare Source

======

deps: qs@2.4.2
- Downgraded from 3.1.0 because of user-visible incompatibilities

`v1.13.0`

Compare Source

======

Add statusCode property on Errors, in addition to status
Change type default to application/json for JSON parser
Change type default to application/x-www-form-urlencoded for urlencoded parser
Provide static require analysis
Use the http-errors module to generate errors
deps: bytes@2.1.0
- Slight optimizations
deps: iconv-lite@0.4.10
- The encoding UTF-16 without BOM now defaults to UTF-16LE when detection fails
- Leading BOM is now removed when decoding
deps: on-finished@~2.3.0
- Add defined behavior for HTTP CONNECT requests
- Add defined behavior for HTTP Upgrade requests
- deps: ee-first@1.1.1
deps: qs@3.1.0
- Fix dropping parameters like hasOwnProperty
- Fix various parsing edge cases
- Parsed object now has null prototype
deps: raw-body@~2.1.1
- Use unpipe module for unpiping requests
- deps: iconv-lite@0.4.10
deps: type-is@~1.6.3
- deps: mime-types@~2.1.1
- perf: reduce try block size
- perf: remove bitwise operations
perf: enable strict mode
perf: remove argument reassignment
perf: remove delete call

`v1.12.4`

Compare Source

======

deps: debug@~2.2.0
deps: qs@2.4.2
- Fix allowing parameters like constructor
deps: on-finished@~2.2.1
deps: raw-body@~2.0.1
- Fix a false-positive when unpiping in Node.js 0.8
- deps: bytes@2.0.1
deps: type-is@~1.6.2
- deps: mime-types@~2.0.11

`v1.12.3`

Compare Source

======

Slight efficiency improvement when not debugging
deps: depd@~1.0.1
deps: iconv-lite@0.4.8
- Add encoding alias UNICODE-1-1-UTF-7
deps: raw-body@1.3.4
- Fix hanging callback if request aborts during read
- deps: iconv-lite@0.4.8

`v1.12.2`

Compare Source

======

deps: qs@2.4.1
- Fix error when parameter hasOwnProperty is present

`v1.12.1`

Compare Source

======

deps: debug@~2.1.3
- Fix high intensity foreground color for bold
- deps: ms@0.7.0
deps: type-is@~1.6.1
- deps: mime-types@~2.0.10

`v1.12.0`

Compare Source

======

add debug messages
accept a function for the type option
use content-type to parse Content-Type headers
deps: iconv-lite@0.4.7
- Gracefully support enumerables on Object.prototype
deps: raw-body@1.3.3
- deps: iconv-lite@0.4.7
deps: type-is@~1.6.0
- fix argument reassignment
- fix false-positives in hasBody Transfer-Encoding check
- support wildcard for both type and subtype (*/*)
- deps: mime-types@~2.0.9

`v1.11.0`

Compare Source

======

make internal extended: true depth limit infinity
deps: type-is@~1.5.6
- deps: mime-types@~2.0.8

`v1.10.2`

Compare Source

======

deps: iconv-lite@0.4.6
- Fix rare aliases of single-byte encodings
deps: raw-body@1.3.2
- deps: iconv-lite@0.4.6

`v1.10.1`

Compare Source

======

deps: on-finished@~2.2.0
deps: type-is@~1.5.5
- deps: mime-types@~2.0.7

`v1.10.0`

Compare Source

======

make internal extended: true array limit dynamic

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [body-parser](https://github.com/expressjs/body-parser) | [`~1.9.0` → `~1.20.0`](https://renovatebot.com/diffs/npm/body-parser/1.9.3/1.20.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/body-parser/1.20.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/body-parser/1.9.3/1.20.9?slim=true) | --- ### Release Notes <details> <summary>expressjs/body-parser (body-parser)</summary> ### [`v1.20.9`](https://github.com/expressjs/body-parser/releases/tag/1.20.9) [Compare Source](https://github.com/expressjs/body-parser/compare/1.20.8...1.20.9) #### Important: Security - Security fix for [CVE-2026-111181](https://www.cve.org/CVERecord?id=CVE-2026-111181) ([GHSA-27r3-jxmh-p828](https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828)) #### What's Changed - Release: 1.20.9 by [@UlisesGascon](https://github.com/UlisesGascon) in [#779](https://github.com/expressjs/body-parser/pull/779) **Full Changelog**: <https://github.com/expressjs/body-parser/compare/1.20.8...1.20.9> ### [`v1.20.8`](https://github.com/expressjs/body-parser/releases/tag/1.20.8) [Compare Source](https://github.com/expressjs/body-parser/compare/1.20.6...1.20.8) #### Important **Same code base as [1.20.7](https://github.com/expressjs/body-parser/releases/tag/1.20.7). This was created to test the new release process.** #### What's Changed - ci: backport npm-publish workflow from master by [@UlisesGascon](https://github.com/UlisesGascon) in [#769](https://github.com/expressjs/body-parser/pull/769) - 1.20.8 by [@UlisesGascon](https://github.com/UlisesGascon) in [#770](https://github.com/expressjs/body-parser/pull/770) **Full Changelog**: <https://github.com/expressjs/body-parser/compare/1.20.7...1.20.8> ### [`v1.20.6`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1206) [Compare Source](https://github.com/expressjs/body-parser/compare/1.20.5...1.20.6) \====== - Security fix for [GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6) - fix: improve `limit` option validation ([#698](https://github.com/expressjs/body-parser/issues/698)) - Invalid `limit` values (e.g. unparseable strings or `NaN`) now throw instead of being silently ignored, which previously disabled size limit enforcement - `null` and `undefined` fall back to the default 100kb limit ### [`v1.20.5`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1205) [Compare Source](https://github.com/expressjs/body-parser/compare/1.20.4...1.20.5) \====== - refactor(json): simplify strict mode error string construction - fix: extended urlencoded parsing of arrays with >100 elements ([#716](https://github.com/expressjs/body-parser/issues/716)) - deps: qs@\~6.15.1 ### [`v1.20.4`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1204) [Compare Source](https://github.com/expressjs/body-parser/compare/1.20.3...1.20.4) \====== - deps: qs@\~6.14.0 - deps: use tilde notation for dependencies - deps: http-errors@\~2.0.1 - deps: raw-body@\~2.5.3 ### [`v1.20.3`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1203) [Compare Source](https://github.com/expressjs/body-parser/compare/1.20.2...1.20.3) \====== - deps: qs\@6.13.0 - add `depth` option to customize the depth level in the parser - IMPORTANT: The default `depth` level for parsing URL-encoded data is now `32` (previously was `Infinity`) ### [`v1.20.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1202) [Compare Source](https://github.com/expressjs/body-parser/compare/1.20.1...1.20.2) \====== - Fix strict json error message on Node.js 19+ - deps: content-type@\~1.0.5 - perf: skip value escaping when unnecessary - deps: raw-body\@2.5.2 ### [`v1.20.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1201) [Compare Source](https://github.com/expressjs/body-parser/compare/1.20.0...1.20.1) \====== - deps: qs\@6.11.0 - perf: remove unnecessary object clone ### [`v1.20.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1200) [Compare Source](https://github.com/expressjs/body-parser/compare/1.19.2...1.20.0) \====== - Fix error message for json parse whitespace in `strict` - Fix internal error when inflated body exceeds limit - Prevent loss of async hooks context - Prevent hanging when request already read - deps: depd\@2.0.0 - Replace internal `eval` usage with `Function` constructor - Use instance methods on `process` to check for listeners - deps: http-errors\@2.0.0 - deps: depd\@2.0.0 - deps: statuses\@2.0.1 - deps: on-finished\@2.4.1 - deps: qs\@6.10.3 - deps: raw-body\@2.5.1 - deps: http-errors\@2.0.0 ### [`v1.19.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1192) [Compare Source](https://github.com/expressjs/body-parser/compare/1.19.1...1.19.2) \====== - deps: bytes\@3.1.2 - deps: qs\@6.9.7 - Fix handling of `__proto__` keys - deps: raw-body\@2.4.3 - deps: bytes\@3.1.2 ### [`v1.19.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1191) [Compare Source](https://github.com/expressjs/body-parser/compare/1.19.0...1.19.1) \====== - deps: bytes\@3.1.1 - deps: http-errors\@1.8.1 - deps: inherits\@2.0.4 - deps: toidentifier\@1.0.1 - deps: setprototypeof\@1.2.0 - deps: qs\@6.9.6 - deps: raw-body\@2.4.2 - deps: bytes\@3.1.1 - deps: http-errors\@1.8.1 - deps: safe-buffer\@5.2.1 - deps: type-is@\~1.6.18 ### [`v1.19.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1190) [Compare Source](https://github.com/expressjs/body-parser/compare/1.18.3...1.19.0) \====== - deps: bytes\@3.1.0 - Add petabyte (`pb`) support - deps: http-errors\@1.7.2 - Set constructor name when possible - deps: setprototypeof\@1.1.1 - deps: statuses@'>= 1.5.0 < 2' - deps: iconv-lite\@0.4.24 - Added encoding MIK - deps: qs\@6.7.0 - Fix parsing array brackets after index - deps: raw-body\@2.4.0 - deps: bytes\@3.1.0 - deps: http-errors\@1.7.2 - deps: iconv-lite\@0.4.24 - deps: type-is@\~1.6.17 - deps: mime-types@\~2.1.24 - perf: prevent internal `throw` on invalid type ### [`v1.18.3`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1183) [Compare Source](https://github.com/expressjs/body-parser/compare/1.18.2...1.18.3) \====== - Fix stack trace for strict json parse error - deps: depd@\~1.1.2 - perf: remove argument reassignment - deps: http-errors@\~1.6.3 - deps: depd@\~1.1.2 - deps: setprototypeof\@1.1.0 - deps: statuses@'>= 1.3.1 < 2' - deps: iconv-lite\@0.4.23 - Fix loading encoding with year appended - Fix deprecation warnings on Node.js 10+ - deps: qs\@6.5.2 - deps: raw-body\@2.3.3 - deps: http-errors\@1.6.3 - deps: iconv-lite\@0.4.23 - deps: type-is@\~1.6.16 - deps: mime-types@\~2.1.18 ### [`v1.18.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1182) [Compare Source](https://github.com/expressjs/body-parser/compare/1.18.1...1.18.2) \====== - deps: debug\@2.6.9 - perf: remove argument reassignment ### [`v1.18.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1181) [Compare Source](https://github.com/expressjs/body-parser/compare/1.18.0...1.18.1) \====== - deps: content-type@\~1.0.4 - perf: remove argument reassignment - perf: skip parameter parsing when no parameters - deps: iconv-lite\@0.4.19 - Fix ISO-8859-1 regression - Update Windows-1255 - deps: qs\@6.5.1 - Fix parsing & compacting very deep objects - deps: raw-body\@2.3.2 - deps: iconv-lite\@0.4.19 ### [`v1.18.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1180) [Compare Source](https://github.com/expressjs/body-parser/compare/1.17.2...1.18.0) \====== - Fix JSON strict violation error to match native parse error - Include the `body` property on verify errors - Include the `type` property on all generated errors - Use `http-errors` to set status code on errors - deps: bytes\@3.0.0 - deps: debug\@2.6.8 - deps: depd@\~1.1.1 - Remove unnecessary `Buffer` loading - deps: http-errors@\~1.6.2 - deps: depd\@1.1.1 - deps: iconv-lite\@0.4.18 - Add support for React Native - Add a warning if not loaded as utf-8 - Fix CESU-8 decoding in Node.js 8 - Improve speed of ISO-8859-1 encoding - deps: qs\@6.5.0 - deps: raw-body\@2.3.1 - Use `http-errors` for standard emitted errors - deps: bytes\@3.0.0 - deps: iconv-lite\@0.4.18 - perf: skip buffer decoding on overage chunk - perf: prevent internal `throw` when missing charset ### [`v1.17.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1172) [Compare Source](https://github.com/expressjs/body-parser/compare/1.17.1...1.17.2) \====== - deps: debug\@2.6.7 - Fix `DEBUG_MAX_ARRAY_LENGTH` - deps: ms\@2.0.0 - deps: type-is@\~1.6.15 - deps: mime-types@\~2.1.15 ### [`v1.17.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1171) [Compare Source](https://github.com/expressjs/body-parser/compare/1.17.0...1.17.1) \====== - deps: qs\@6.4.0 - Fix regression parsing keys starting with `[` ### [`v1.17.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1170) [Compare Source](https://github.com/expressjs/body-parser/compare/1.16.1...1.17.0) \====== - deps: http-errors@\~1.6.1 - Make `message` property enumerable for `HttpError`s - deps: setprototypeof\@1.0.3 - deps: qs\@6.3.1 - Fix compacting nested arrays ### [`v1.16.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1161) [Compare Source](https://github.com/expressjs/body-parser/compare/1.16.0...1.16.1) \====== - deps: debug\@2.6.1 - Fix deprecation messages in WebStorm and other editors - Undeprecate `DEBUG_FD` set to `1` or `2` ### [`v1.16.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1160) [Compare Source](https://github.com/expressjs/body-parser/compare/1.15.2...1.16.0) \====== - deps: debug\@2.6.0 - Allow colors in workers - Deprecated `DEBUG_FD` environment variable - Fix error when running under React Native - Use same color for same namespace - deps: ms\@0.7.2 - deps: http-errors@\~1.5.1 - deps: inherits\@2.0.3 - deps: setprototypeof\@1.0.2 - deps: statuses@'>= 1.3.1 < 2' - deps: iconv-lite\@0.4.15 - Added encoding MS-31J - Added encoding MS-932 - Added encoding MS-936 - Added encoding MS-949 - Added encoding MS-950 - Fix GBK/GB18030 handling of Euro character - deps: qs\@6.2.1 - Fix array parsing from skipping empty values - deps: raw-body@\~2.2.0 - deps: iconv-lite\@0.4.15 - deps: type-is@\~1.6.14 - deps: mime-types@\~2.1.13 ### [`v1.15.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1152) [Compare Source](https://github.com/expressjs/body-parser/compare/1.15.1...1.15.2) \====== - deps: bytes\@2.4.0 - deps: content-type@\~1.0.2 - perf: enable strict mode - deps: http-errors@\~1.5.0 - Use `setprototypeof` module to replace `__proto__` setting - deps: statuses@'>= 1.3.0 < 2' - perf: enable strict mode - deps: qs\@6.2.0 - deps: raw-body@\~2.1.7 - deps: bytes\@2.4.0 - perf: remove double-cleanup on happy path - deps: type-is@\~1.6.13 - deps: mime-types@\~2.1.11 ### [`v1.15.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1151) [Compare Source](https://github.com/expressjs/body-parser/compare/1.15.0...1.15.1) \====== - deps: bytes\@2.3.0 - Drop partial bytes on all parsed units - Fix parsing byte string that looks like hex - deps: raw-body@\~2.1.6 - deps: bytes\@2.3.0 - deps: type-is@\~1.6.12 - deps: mime-types@\~2.1.10 ### [`v1.15.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1150) [Compare Source](https://github.com/expressjs/body-parser/compare/1.14.2...1.15.0) \====== - deps: http-errors@\~1.4.0 - Add `HttpError` export, for `err instanceof createError.HttpError` - deps: inherits\@2.0.1 - deps: statuses@'>= 1.2.1 < 2' - deps: qs\@6.1.0 - deps: type-is@\~1.6.11 - deps: mime-types@\~2.1.9 ### [`v1.14.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1142) [Compare Source](https://github.com/expressjs/body-parser/compare/1.14.1...1.14.2) \====== - deps: bytes\@2.2.0 - deps: iconv-lite\@0.4.13 - deps: qs\@5.2.0 - deps: raw-body@\~2.1.5 - deps: bytes\@2.2.0 - deps: iconv-lite\@0.4.13 - deps: type-is@\~1.6.10 - deps: mime-types@\~2.1.8 ### [`v1.14.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1141) [Compare Source](https://github.com/expressjs/body-parser/compare/1.14.0...1.14.1) \====== - Fix issue where invalid charset results in 400 when `verify` used - deps: iconv-lite\@0.4.12 - Fix CESU-8 decoding in Node.js 4.x - deps: raw-body@\~2.1.4 - Fix masking critical errors from `iconv-lite` - deps: iconv-lite\@0.4.12 - deps: type-is@\~1.6.9 - deps: mime-types@\~2.1.7 ### [`v1.14.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1140) [Compare Source](https://github.com/expressjs/body-parser/compare/1.13.3...1.14.0) \====== - Fix JSON strict parse error to match syntax errors - Provide static `require` analysis in `urlencoded` parser - deps: depd@\~1.1.0 - Support web browser loading - deps: qs\@5.1.0 - deps: raw-body@\~2.1.3 - Fix sync callback when attaching data listener causes sync read - deps: type-is@\~1.6.8 - Fix type error when given invalid type to match against - deps: mime-types@\~2.1.6 ### [`v1.13.3`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1133) [Compare Source](https://github.com/expressjs/body-parser/compare/1.13.2...1.13.3) \====== - deps: type-is@\~1.6.6 - deps: mime-types@\~2.1.4 ### [`v1.13.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1132) [Compare Source](https://github.com/expressjs/body-parser/compare/1.13.1...1.13.2) \====== - deps: iconv-lite\@0.4.11 - deps: qs\@4.0.0 - Fix dropping parameters like `hasOwnProperty` - Fix user-visible incompatibilities from 3.1.0 - Fix various parsing edge cases - deps: raw-body@\~2.1.2 - Fix error stack traces to skip `makeError` - deps: iconv-lite\@0.4.11 - deps: type-is@\~1.6.4 - deps: mime-types@\~2.1.2 - perf: enable strict mode - perf: remove argument reassignment ### [`v1.13.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1131) [Compare Source](https://github.com/expressjs/body-parser/compare/1.13.0...1.13.1) \====== - deps: qs\@2.4.2 - Downgraded from 3.1.0 because of user-visible incompatibilities ### [`v1.13.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1130) [Compare Source](https://github.com/expressjs/body-parser/compare/1.12.4...1.13.0) \====== - Add `statusCode` property on `Error`s, in addition to `status` - Change `type` default to `application/json` for JSON parser - Change `type` default to `application/x-www-form-urlencoded` for urlencoded parser - Provide static `require` analysis - Use the `http-errors` module to generate errors - deps: bytes\@2.1.0 - Slight optimizations - deps: iconv-lite\@0.4.10 - The encoding UTF-16 without BOM now defaults to UTF-16LE when detection fails - Leading BOM is now removed when decoding - deps: on-finished@\~2.3.0 - Add defined behavior for HTTP `CONNECT` requests - Add defined behavior for HTTP `Upgrade` requests - deps: ee-first\@1.1.1 - deps: qs\@3.1.0 - Fix dropping parameters like `hasOwnProperty` - Fix various parsing edge cases - Parsed object now has `null` prototype - deps: raw-body@\~2.1.1 - Use `unpipe` module for unpiping requests - deps: iconv-lite\@0.4.10 - deps: type-is@\~1.6.3 - deps: mime-types@\~2.1.1 - perf: reduce try block size - perf: remove bitwise operations - perf: enable strict mode - perf: remove argument reassignment - perf: remove delete call ### [`v1.12.4`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1124) [Compare Source](https://github.com/expressjs/body-parser/compare/1.12.3...1.12.4) \====== - deps: debug@\~2.2.0 - deps: qs\@2.4.2 - Fix allowing parameters like `constructor` - deps: on-finished@\~2.2.1 - deps: raw-body@\~2.0.1 - Fix a false-positive when unpiping in Node.js 0.8 - deps: bytes\@2.0.1 - deps: type-is@\~1.6.2 - deps: mime-types@\~2.0.11 ### [`v1.12.3`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1123) [Compare Source](https://github.com/expressjs/body-parser/compare/1.12.2...1.12.3) \====== - Slight efficiency improvement when not debugging - deps: depd@\~1.0.1 - deps: iconv-lite\@0.4.8 - Add encoding alias UNICODE-1-1-UTF-7 - deps: raw-body\@1.3.4 - Fix hanging callback if request aborts during read - deps: iconv-lite\@0.4.8 ### [`v1.12.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1122) [Compare Source](https://github.com/expressjs/body-parser/compare/1.12.1...1.12.2) \====== - deps: qs\@2.4.1 - Fix error when parameter `hasOwnProperty` is present ### [`v1.12.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1121) [Compare Source](https://github.com/expressjs/body-parser/compare/1.12.0...1.12.1) \====== - deps: debug@\~2.1.3 - Fix high intensity foreground color for bold - deps: ms\@0.7.0 - deps: type-is@\~1.6.1 - deps: mime-types@\~2.0.10 ### [`v1.12.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1120) [Compare Source](https://github.com/expressjs/body-parser/compare/1.11.0...1.12.0) \====== - add `debug` messages - accept a function for the `type` option - use `content-type` to parse `Content-Type` headers - deps: iconv-lite\@0.4.7 - Gracefully support enumerables on `Object.prototype` - deps: raw-body\@1.3.3 - deps: iconv-lite\@0.4.7 - deps: type-is@\~1.6.0 - fix argument reassignment - fix false-positives in `hasBody` `Transfer-Encoding` check - support wildcard for both type and subtype (`*/*`) - deps: mime-types@\~2.0.9 ### [`v1.11.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1110) [Compare Source](https://github.com/expressjs/body-parser/compare/1.10.2...1.11.0) \====== - make internal `extended: true` depth limit infinity - deps: type-is@\~1.5.6 - deps: mime-types@\~2.0.8 ### [`v1.10.2`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1102) [Compare Source](https://github.com/expressjs/body-parser/compare/1.10.1...1.10.2) \====== - deps: iconv-lite\@0.4.6 - Fix rare aliases of single-byte encodings - deps: raw-body\@1.3.2 - deps: iconv-lite\@0.4.6 ### [`v1.10.1`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1101) [Compare Source](https://github.com/expressjs/body-parser/compare/1.10.0...1.10.1) \====== - deps: on-finished@\~2.2.0 - deps: type-is@\~1.5.5 - deps: mime-types@\~2.0.7 ### [`v1.10.0`](https://github.com/expressjs/body-parser/blob/HEAD/HISTORY.md#1100) [Compare Source](https://github.com/expressjs/body-parser/compare/1.9.3...1.10.0) \====== - make internal `extended: true` array limit dynamic </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate added 1 commit

2026-10-26 21:20:14 +00:00

Update dependency body-parser to ~1.20.0 a96528eedc

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin "renovate/body-parser-1.x:renovate/body-parser-1.x"

git switch "renovate/body-parser-1.x"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "master"

git merge --no-ff "renovate/body-parser-1.x"

git switch "renovate/body-parser-1.x"

git rebase "master"

git switch "master"

git merge --ff-only "renovate/body-parser-1.x"

git switch "renovate/body-parser-1.x"

git rebase "master"

git switch "master"

git merge --no-ff "renovate/body-parser-1.x"

git switch "master"

git merge --squash "renovate/body-parser-1.x"