[dependabot]

Bumps body-parser from 1.20.3 to 1.20.9.

Release notes

Sourced from body-parser's releases.

1.20.9

Important: Security

• Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

• Release: 1.20.9 by @​UlisesGascon in expressjs/body-parser#779

Full Changelog: expressjs/body-parser@1.20.8...1.20.9

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

• ci: backport npm-publish workflow from master by @​UlisesGascon in expressjs/body-parser#769
• 1.20.8 by @​UlisesGascon in expressjs/body-parser#770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

• docs: include security fix in 1.20.6 changes by @​UlisesGascon in expressjs/body-parser#747
• deps: qs@~6.16.0 by @​krzysdz in expressjs/body-parser#761
• 1.20.7 by @​UlisesGascon in expressjs/body-parser#767

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• fix: improve limit option validation by @​Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

• refactor(json): simplify strict mode error string construction by @​jonchurch in expressjs/body-parser#692

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.9

• Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)

1.20.8

• Same code base as 1.20.7. This was created to test the new release process.

1.20.7

• deps: qs@~6.16.0

1.20.6

• Security fix for GHSA-v422-hmwv-36x6
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit

1.20.5

• refactor(json): simplify strict mode error string construction
• fix: extended urlencoded parsing of arrays with >100 elements (#716)
• deps: qs@~6.15.1

1.20.4

• deps: qs@~6.14.0
• deps: use tilde notation for dependencies
• deps: http-errors@~2.0.1
• deps: raw-body@~2.5.3

Commits

• a64f140 1.20.9 (#779)
• 1260c38 fix: prevent process crash from trailing bytes after a compressed body
• b4c2112 docs: fix depth error description (#776)
• 29ddb9b docs: improve readability (#756)
• ac9667a docs: improve wording (#755)
• 5c08c20 1.20.8 (#770)
• 0cea4f4 ci: backport npm-publish workflow from master (#769)
• 0f0f0d7 1.20.7 (#767)
• 355eb04 deps: qs@~6.16.0 (#761)
• 8be369a docs: include security fix in 1.20.6 changes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

[Vladimir Morozov (vmoroz)]

Dependabot (@dependabot) recreate

[Vladimir Morozov (vmoroz)]

Dependabot (@dependabot) recreate