🚨 [security] [boilerplate/ts/infra/rest/express] Update body-parser 1.20.1 → 1.20.3 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ body-parser (1.20.1 → 1.20.3) · Repo · Changelog

Security Advisories 🚨

🚨 body-parser vulnerable to denial of service when url encoding is enabled

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References

Release Notes

1.20.2

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: [email protected]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 28 commits:

• 1.20.3
• chore: linter (#534)
• Merge commit from fork
• add scorecard to readme (#531)
• deps: [email protected] (#521)
• fix: pin to [email protected]
• ci: fix errors in ci github action for node 8 and 9 (#523)
• chore: add support for OSSF scorecard reporting (#522)
• 1.20.2
• Fix strict json error message on Node.js 19+
• deps: [email protected]
• build: [email protected]
• build: [email protected]
• build: [email protected]
• deps: content-type@~1.0.5
• build: [email protected]
• build: [email protected]
• build: [email protected]
• build: [email protected]
• build: [email protected]
• build: [email protected]
• docs: switch badges to badgen
• build: [email protected]
• build: actions/download-artifact@v3
• build: use $GITHUB_OUTPUT for environment list
• build: actions/upload-artifact@v3
• build: actions/checkout@v3
• build: [email protected]

↗️ @​bitloops/bl-boilerplate-core (indirect, 0.1.0 → 0.1.1) · Repo

Sorry, we couldn't find anything useful about this release.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)