Skip to content

deps: Bump body-parser from 1.20.3 to 2.2.0#1151

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/body-parser-2.2.0
Closed

deps: Bump body-parser from 1.20.3 to 2.2.0#1151
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/body-parser-2.2.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 12, 2025 •
edited
Loading

Bumps body-parser from 1.20.3 to 2.2.0.

Release notes

Sourced from body-parser's releases.

v2.2.0

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.1.0...v2.2.0

v2.1.0

What's Changed

Full Changelog: expressjs/body-parser@2.0.1...v2.1.0

2.0.2

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.2.0 / 2025-03-27

  • refactor: normalize common options for all parsers
  • deps:
    • iconv-lite@^0.6.3

2.1.0 / 2025-02-10

  • deps:
    • type-is@^2.0.0
    • debug@^4.4.0
    • Removed destroy
  • refactor: prefix built-in node module imports
  • use the node require cache instead of custom caching

2.0.2 / 2024-10-31

  • remove unpipe package and use native unpipe() method

2.0.1 / 2024-09-10

  • Restore expected behavior extended to false

2.0.0 / 2024-09-10

Breaking Changes

  • Node.js 18 is the minimum supported version
  • req.body is no longer always initialized to {}
    • it is left undefined unless a body is parsed
  • Remove deprecated bodyParser() combination middleware
  • urlencoded parser now defaults extended to false as released, this is not the case, fixed in 2.0.1
  • urlencoded simple parser now uses qs module instead of querystring module

Features

  • Add brotli support #406
  • urlencoded: Add option to customize the depth with a default value of 32
  • urlencoded: Support iso-8859-1, utf8 sentinel, and numeric entities
  • Use on-finished to determine when body read

Dependencies

  • deps: raw-body@^3.0.0
  • deps: qs@6.12.3
  • deps: debug@3.1.0
  • deps: iconv-lite@0.5.2

... (truncated)

Commits

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot bot added dependencies Automated dependency update javascript Pull requests that update Javascript code labels Oct 12, 2025
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/body-parser-2.2.0 branch 5 times, most recently from fe75403 to c7d3303 Compare October 14, 2025 12:05
@d3xter666
Copy link
Member

d3xter666 commented Jan 5, 2026

@dependabot recreate

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/body-parser-2.2.0 branch from c7d3303 to 43df18a Compare January 5, 2026 10:17
@coveralls
Copy link

coveralls commented Jan 5, 2026 •
edited
Loading

Coverage Status

coverage: 94.691% (+0.03%) from 94.658%
when pulling ac8c869 on dependabot/npm_and_yarn/body-parser-2.2.0
into cb29ec1 on main.

@d3xter666 d3xter666 added the blocked Pull requests that are blocked label Jan 5, 2026
@d3xter666
Copy link
Member

d3xter666 commented Jan 5, 2026

Although tests are passing, the breaking changes seem with a certain amount of risk to me, especially this one:

  • req.body is no longer always initialized to {}
    • it is left undefined unless a body is parsed

We can easily break ui5-server middlewares that depend on req.body and do not do checks for undefined

@d3xter666 d3xter666 requested a review from a team January 5, 2026 11:25
@dependabot @d3xter666
deps: Bump body-parser from 1.20.3 to 2.2.0
ac8c869 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.3 to 2.2.0.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.3...v2.2.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@d3xter666 d3xter666 force-pushed the dependabot/npm_and_yarn/body-parser-2.2.0 branch from 43df18a to ac8c869 Compare January 5, 2026 13:19
@matz3
Copy link
Member

matz3 commented Jan 7, 2026

body-parser is only used within the csp middleware, so the breaking change should only be applicable there. I can't see any code that makes the middleware generally available to custom middleware.

@d3xter666 d3xter666 changed the title deps: bump body-parser from 1.20.3 to 2.2.0 deps: Bump body-parser from 1.20.3 to 2.2.0 Jan 19, 2026
@matz3
Copy link
Member

matz3 commented Jan 28, 2026

@d3xter666 any update here? In the meanwhile there is #1272.
As already stated, I this is not affecting custom middleware. And the breaking change regarding the initialization of req.body seems to be handled already:

cli/packages/server/lib/middleware/csp.js

Line 92 in 13c37ce

if (typeof req.body !== "object") {

@d3xter666
Copy link
Member

d3xter666 commented Feb 2, 2026

Clsoing this one in favour of #1151

@d3xter666 d3xter666 closed this Feb 2, 2026
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 2, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/body-parser-2.2.0 branch February 2, 2026 09:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

blocked Pull requests that are blocked dependencies Automated dependency update javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@d3xter666 @coveralls @matz3