René's URL Explorer Experiment

Title: fix(deps): update dependency body-parser to v2 [security] - abandoned by renovate[bot] · Pull Request #240 · 142vip/JavaScriptCollection · GitHub

Open Graph Title: fix(deps): update dependency body-parser to v2 [security] - abandoned by renovate[bot] · Pull Request #240 · 142vip/JavaScriptCollection

X Title: fix(deps): update dependency body-parser to v2 [security] - abandoned by renovate[bot] · Pull Request #240 · 142vip/JavaScriptCollection

Description: This PR contains the following updates: Package Change Age Confidence body-parser 1.20.2 -> 2.2.1 WarningSome dependencies could not be looked up. Check the Dependency Dashboard for more information. GitHub Vulnerability Alerts CVE-2025-13466 Impact body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. Patches This issue is addressed in version 2.2.1. Release Notes expressjs/body-parser (body-parser) v2.2.1 Compare Source ========================= Security fix for GHSA-wqch-xfxh-vrr4 deps: type-is@^2.0.1 iconv-lite@^0.7.0 Handle split surrogate pairs when encoding UTF-8 Avoid false positives in encodingExists by using prototype-less objects raw-body@^3.0.1 debug@^4.4.3 v2.2.0 Compare Source ========================= refactor: normalize common options for all parsers deps: iconv-lite@^0.6.3 v2.1.0 Compare Source ========================= deps: type-is@^2.0.0 debug@^4.4.0 Removed destroy refactor: prefix built-in node module imports use the node require cache instead of custom caching v2.0.2 Compare Source ========================= remove unpipe package and use native unpipe() method v2.0.1 Compare Source ========================= Restore expected behavior extended to false v2.0.0 Compare Source ========================= Breaking Changes Node.js 18 is the minimum supported version req.body is no longer always initialized to {} it is left undefined unless a body is parsed Remove deprecated bodyParser() combination middleware urlencoded parser now defaults extended to false as released, this is not the case, fixed in 2.0.1 urlencoded simple parser now uses qs module instead of querystring module Features Add brotli support #​406 urlencoded: Add option to customize the depth with a default value of 32 urlencoded: Support iso-8859-1, utf8 sentinel, and numeric entities Use on-finished to determine when body read Dependencies deps: raw-body@^3.0.0 deps: qs@​6.12.3 deps: debug@​3.1.0 deps: iconv-lite@​0.5.2 v1.20.3 Compare Source =================== deps: qs@​6.13.0 add depth option to customize the depth level in the parser IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity) Configuration 📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.

Open Graph Description: This PR contains the following updates: Package Change Age Confidence body-parser 1.20.2 -> 2.2.1 WarningSome dependencies could not be looked up. Check the Dependency Dashboard for...

X Description: This PR contains the following updates: Package Change Age Confidence body-parser 1.20.2 -> 2.2.1 WarningSome dependencies could not be looked up. Check the Dependency Dashboard...

Opengraph URL: https://github.com/142vip/JavaScriptCollection/pull/240

X: @github

direct link

Domain: patch-diff.githubusercontent.com

Links:

Viewport: width=device-width