chore(deps): bump body-parser from 2.2.2 to 2.3.0 by dependabot[bot] · Pull Request #55 · wave-av/mcp-server

dependabot · 2026-07-22T03:26:23Z

Bumps body-parser from 2.2.2 to 2.3.0.

Release notes

v2.3.0

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#681

build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by @dependabot[bot] in expressjs/body-parser#682

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/body-parser#683

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/body-parser#685

build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by @dependabot[bot] in expressjs/body-parser#684

perf(urlencoded): move empty-body guard to avoid extra function closure by @Phillip9587 in expressjs/body-parser#647

Improve ESM compatibility by @Phillip9587 in expressjs/body-parser#697

docs: add recommendations for configuring payload limits by @bjohansebas in expressjs/body-parser#699

build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in expressjs/body-parser#701

build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by @dependabot[bot] in expressjs/body-parser#702

build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in expressjs/body-parser#700

chore: add explicit type commonjs to package.json by @Phillip9587 in expressjs/body-parser#711

deps: update dependencies to latest versions by @Phillip9587 in expressjs/body-parser#708

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in expressjs/body-parser#712

build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in expressjs/body-parser#713

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#714

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#698

build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in expressjs/body-parser#719

build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in expressjs/body-parser#718

build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in expressjs/body-parser#717

perf: eliminate conditional check in json strict mode hot path by @Phillip9587 in expressjs/body-parser#651

ci: add node.js 26 to text matrix by @Phillip9587 in expressjs/body-parser#726

build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in expressjs/body-parser#725

build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in expressjs/body-parser#724

build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in expressjs/body-parser#723

Upgrade "content-type" by @blakeembrey in expressjs/body-parser#728

refactor: switch to const/let and enable eslint no-var rule by @Phillip9587 in expressjs/body-parser#729

Update outdated reference to MDN docs by @krzysdz in expressjs/body-parser#730

build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @dependabot[bot] in expressjs/body-parser#731

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in expressjs/body-parser#732

chore: updated deps to latest by @Phillip9587 in expressjs/body-parser#733

2.3.0 by @UlisesGascon in expressjs/body-parser#735

New Contributors

@krzysdz made their first contribution in expressjs/body-parser#730

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

Security fix for GHSA-v422-hmwv-36x6

fix: use static exports instead of lazy getters to improve ESM compatibility

feat: add subpath exports for individual parsers

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

deps:

content-type@^2.0.0

http-errors@^2.0.1

iconv-lite^0.7.2

qs@^6.15.2

raw-body@^3.0.2

type-is@^2.1.0

Commits

d0f2ace 2.3.0 (#735)
7d03f2f chore: updated deps to latest (#733)
8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
ff0f6b9 docs: update outdated reference to MDN docs (#730)
14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
37f36a2 deps: update content-type and type-is (#728)
e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
Additional commits viewable in compare view

dependabot · 2026-07-22T03:26:23Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

changeset-bot · 2026-07-22T03:26:29Z

⚠️ No Changeset found

Latest commit: ae3059b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

cursor

Risk: low. Approved this dependabot security patch bumping body-parser 2.2.2 to 2.3.0; CI checks passed. No reviewers assigned.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

yakimoto · 2026-07-28T13:01:12Z

Verified locally. CI can't run — Actions are refusing every job org-wide on an account-level billing lock (plan=free, locked=yes, confirmed live this morning on adk and dispatch-edge) — so this stands in for the checks until it clears.

npm ci (NODE_ENV=development)  → OK
npm run build                  → ESM ⚡️ Build success
npm run type-check             → tsc --noEmit, clean

Advisory delta, dev scope included, against main @ a199245:

	total	high	mod	low
`main`	7	3	2	2
this PR	6	3	2	1

body-parser drops out of the audit entirely. Lowest-severity of the open set (the alert is >= 2.0.0, < 2.3.0, low), and the only one of the four that moves a minor rather than a patch — worth a glance at the 2.3.0 notes before merging, though nothing in this repo's build or type-check reacted to it.

Same bump, same version, verified independently on wave-av/sdks in wave-av/sdks#48.

Caveat for anyone re-checking these numbers: npm audit here inherits omit=dev from NODE_ENV=production and silently reports 5 instead of 7, hiding the dev-scope entries. Set NODE_ENV=development explicitly.

No objection from me — ready the moment CI is available. Merges stay on hold until branch protection is verified back, not merely reported mergeable: during this outage PRs went MERGEABLE because protection vanished, which reads exactly like CI recovering.

greptile-apps · 2026-08-01T23:13:42Z

PR author is in the excluded authors list.

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.2.2 to 2.3.0. - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) --- updated-dependencies: - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

cursor Bot approved these changes Jul 22, 2026

View reviewed changes

yakimoto mentioned this pull request Jul 28, 2026

fix(deps): sdk 1.30.0 unblocks @hono/node-server 2.x, clearing the last two runtime advisories #68

Open

dependabot Bot force-pushed the dependabot/npm_and_yarn/body-parser-2.3.0 branch 2 times, most recently from 86b56c5 to bebc913 Compare August 1, 2026 23:13

devin-ai-integration Bot reviewed Aug 1, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/body-parser-2.3.0 branch from bebc913 to ae3059b Compare August 2, 2026 02:27

Navigation Menu

Uh oh!

chore(deps): bump body-parser from 2.2.2 to 2.3.0 - #55

chore(deps): bump body-parser from 2.2.2 to 2.3.0#55
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/body-parser-2.3.0

dependabot Bot commented on behalf of github Jul 22, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 22, 2026

Uh oh!

changeset-bot Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

yakimoto commented Jul 28, 2026

Uh oh!

greptile-apps Bot commented Aug 1, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.3.0

Important: Security

What's Changed

New Contributors

2.3.0 / 2026-06-15

Uh oh!

dependabot Bot commented on behalf of github Jul 22, 2026

Labels

Uh oh!

changeset-bot Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

yakimoto commented Jul 28, 2026

Uh oh!

greptile-apps Bot commented Aug 1, 2026

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 22, 2026 •

edited

Loading

changeset-bot Bot commented Jul 22, 2026 •

edited

Loading