[dependabot]

Bumps body-parser from 2.3.0 to 2.4.0.

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

• Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in expressjs/body-parser#737
• chore: group github actions updates by @​Phillip9587 in expressjs/body-parser#743
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#745
• test: fix 'presist' typo in test descriptions by @​maxtaran2010 in expressjs/body-parser#749
• docs: include security fix in 2.3.0 changes by @​UlisesGascon in expressjs/body-parser#748
• fix: avoid mutating read options when reading body by @​Phillip9587 in expressjs/body-parser#742
• refactor: move getCharset helper to only usage by @​Phillip9587 in expressjs/body-parser#707
• build(deps): bump the github-actions group with 7 updates by @​dependabot[bot] in expressjs/body-parser#753
• refactor: switch to neostandard by @​Phillip9587 in expressjs/body-parser#751
• perf(json): avoid first-char regex for direct JSON bodies by @​Phillip9587 in expressjs/body-parser#744
• docs: fix entity verify error description by @​Rawal27 in expressjs/body-parser#755
• feat: zstandard support by @​Phillip9587 in expressjs/body-parser#586
• test: remove unused experimentalZstd option by @​Phillip9587 in expressjs/body-parser#757
• ci: run tests on windows and macos matrix by @​kilisamemarisaaa in expressjs/body-parser#759
• deps: qs@^6.16.0 by @​krzysdz in expressjs/body-parser#762
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#763
• ci: trigger npm publish on release published and set dist-tag by @​UlisesGascon in expressjs/body-parser#768
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#771
• fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @​saadkhantareen in expressjs/body-parser#773
• perf: inline content stream setup by @​Phillip9587 in expressjs/body-parser#750
• docs: note that req.body may be undefined in v2 by @​Hashim1999164 in expressjs/body-parser#752
• docs: fix strict option description by @​Rawal27 in expressjs/body-parser#756
• docs: fix depth error description by @​johnnyhuirilef in expressjs/body-parser#776
• chore: update dependencies by @​Phillip9587 in expressjs/body-parser#778
• Release: 2.4.0 by @​UlisesGascon in expressjs/body-parser#777

New Contributors

• @​maxtaran2010 made their first contribution in expressjs/body-parser#749
• @​Rawal27 made their first contribution in expressjs/body-parser#755
• @​kilisamemarisaaa made their first contribution in expressjs/body-parser#759
• @​saadkhantareen made their first contribution in expressjs/body-parser#773
• @​Hashim1999164 made their first contribution in expressjs/body-parser#752
• @​johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

• Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)
• feat: add zstd content-encoding support (#586)
  • Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies
• fix: avoid mutating the parser options and the request object while reading the body (#742, #750)
• perf(json): avoid first-char regex for direct JSON bodies (#744)
• deps:
  • content-type@^2.1.0
  • iconv-lite^0.7.3
  • qs@^6.16.1

Commits

• b4744d7 2.4.0 (#777)
• f7075ea fix: prevent process crash from trailing bytes after a compressed body
• 185ff1d chore: update dependencies (#778)
• 73713f7 docs: fix depth error description (#776)
• 2dcc826 docs: improve readability (#756)
• 402dbdc docs: note that req.body may be undefined in v2 (#752)
• 9883a1e perf: inline content stream setup (#750)
• 02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
• 822a0fd build(deps): bump the github-actions group with 3 updates (#771)
• aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

[github-actions]

👋 Friendly nudge — this PR has had no activity for 7 days.

What needs attention:

• 👀 No approving reviews yet. Request a review from a teammate.
• ⬇️ 12 commits behind dev. Rebase to pick up latest changes.

---

If this PR is abandoned, please close it. If it's blocked on something external, leave a comment so the team knows.
This is an automated check that runs on weekdays. It won't nudge the same PR more than once per week.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[github-actions]

🟢 Impact Analysis — PR #2292

Risk tier: 🟢 LOW

📊 Summary

Metric	Count
Files changed	1
Files added	0
Files modified	1
Files deleted	0
Modules touched	1

🎯 Risk Factors

• 1 files changed (≤5 → LOW)
• 1 module(s) touched (≤1 → LOW)

📦 Modules Affected

root (1 file)

• package-lock.json

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit bba3782

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	6 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	1 check(s) still running

Files Changed (1 file, +15 −13)

File	+/−
package-lock.json	+15 −13

Total: +15 −13

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.