chore(deps)(deps): bump body-parser - #209
Conversation
Bumps and [body-parser](https://github.com/expressjs/body-parser). These dependencies needed to be updated together. Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) Updates `body-parser` from 1.20.5 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) --- updated-dependencies: - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security review: no high-confidence vulnerabilities found
Verdict: Approve from a security standpoint. This PR is a lockfile-only dependency refresh that patches known issues rather than introducing new attack surface.
Scope reviewed
- Files changed:
package-lock.jsononly (25 insertions, 8 deletions) - No application/runtime code changes — no new request handlers, parsers, auth logic, or user-input paths.
Dependency changes
| Package | Before | After | Context |
|---|---|---|---|
body-parser (via express / @lhci/cli) |
1.20.5 | 1.20.6 | Dev-only Lighthouse CI tooling |
body-parser (via @modelcontextprotocol/sdk → @spotlightjs/sidecar) |
2.2.2 | 2.3.0 | Dev-only Spotlight sidecar / MCP SDK |
Threat-model checklist
| Category | Result |
|---|---|
| Injection (SQL/command/template/path) | N/A — no code changes |
| Authn/authz bypass | N/A — no code changes |
| Secrets / token leakage | None — no secrets or logging changes |
| Deserialization / SSRF / XSS / CSRF | N/A — no code changes |
| Supply-chain risk | Reduced — bumps land on patched releases |
Supply-chain note (informational, not a blocker)
Both upgraded versions address CVE-2026-12590 / GHSA-v422-hmwv-36x6: invalid limit option values could silently disable body-size enforcement, enabling DoS via oversized payloads. Severity is Low (CVSS 3.1: 3.1, attack complexity High) and exploitation requires passing a misconfigured limit at parser construction time.
In this repo, body-parser appears only as a transitive dev dependency (@lhci/cli → express, @spotlightjs/sidecar → @modelcontextprotocol/sdk → express). The production Astro static site does not directly import or configure body-parser. Residual exposure is limited to local dev/CI tooling, not the deployed portfolio.
Uncertain concerns
None requiring validation before merge.
Automated security review by Cursor Automation
Sent by Cursor Automation: Find vulnerabilities
Bumps and body-parser. These dependencies needed to be updated together.
Updates
body-parserfrom 2.2.2 to 2.3.0Release notes
Sourced from body-parser's releases.
Changelog
Sourced from body-parser's changelog.
Commits
d0f2ace2.3.0 (#735)7d03f2fchore: updated deps to latest (#733)8024ba7build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)32b4ed4build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)ff0f6b9docs: update outdated reference to MDN docs (#730)14d001arefactor: switch to const/let and enable eslint no-var rule (#729)37f36a2deps: update content-type and type-is (#728)e1c244bbuild(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)e01087fbuild(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)a7698d3build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)Updates
body-parserfrom 1.20.5 to 1.20.6Release notes
Sourced from body-parser's releases.
Changelog
Sourced from body-parser's changelog.
Commits
d0f2ace2.3.0 (#735)7d03f2fchore: updated deps to latest (#733)8024ba7build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)32b4ed4build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)ff0f6b9docs: update outdated reference to MDN docs (#730)14d001arefactor: switch to const/let and enable eslint no-var rule (#729)37f36a2deps: update content-type and type-is (#728)e1c244bbuild(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)e01087fbuild(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)a7698d3build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.