chore(deps): bump body-parser from 1.20.2 to 1.20.6

[dependabot]

Bumps body-parser from 1.20.2 to 1.20.6.

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• fix: improve limit option validation by @​Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

• refactor(json): simplify strict mode error string construction by @​jonchurch in expressjs/body-parser#692
• fix: correct off-by-one error in parameterCount by @​abhu85 in expressjs/body-parser#716
• deps(qs): bump qs to 6.15.1 by @​jonchurch in expressjs/body-parser#722
• Release: 1.20.5 by @​jonchurch in expressjs/body-parser#721

New Contributors

• @​abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

1.20.4

What's Changed

• Remove redundant depth check by @​blakeembrey in expressjs/body-parser#538
• ci: add support for Node.js v23 by @​Phillip9587 in expressjs/body-parser#553
• ci: restore CI for 1.x branch by @​bjohansebas in expressjs/body-parser#665
• deps: qs@^6.14.0 by @​bjohansebas in expressjs/body-parser#664
• deps: use tilde notation and update certain dependencies by @​Phillip9587 in expressjs/body-parser#668
• chore: remove SECURITY.md by @​Phillip9587 in expressjs/body-parser#669
• ci: add CodeQL (SAST) by @​Phillip9587 in expressjs/body-parser#670
• Release: 1.20.4 by @​UlisesGascon in expressjs/body-parser#672

Full Changelog: expressjs/body-parser@1.20.3...1.20.4

1.20.3

What's Changed

Important

• deps: qs@6.13.0
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

• Security fix for GHSA-v422-hmwv-36x6
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit

1.20.5 / 2026-04-24

• refactor(json): simplify strict mode error string construction
• fix: extended urlencoded parsing of arrays with >100 elements (#716)
• deps: qs@~6.15.1

1.20.4 / 2025-12-01

• deps: qs@~6.14.0
• deps: use tilde notation for dependencies
• deps: http-errors@~2.0.1
• deps: raw-body@~2.5.3

1.20.3 / 2024-09-10

• deps: qs@6.13.0
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Commits

• 5cc4fb8 1.20.6 (#746)
• 3492672 fix: improve limit option validation (#741)
• 0defdbe release(patch): 1.20.5
• cd0e7a0 deps(qs): bump qs to 6.15.1
• 6f24d7e fix: correct off-by-one error in parameterCount (#716)
• b849bd5 deps: qs@~6.14.1 (#690)
• 2c55e2f refactor(json): simplify strict mode error string construction (#692)
• 7db202c 1.20.4 (#672)
• d8f8adb ci: add CodeQL (SAST) (#670)
• 6d133c1 chore: remove SECURITY.md (#669)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

[cursor]

PR Summary

Medium Risk
Touches request-body parsing on every API route; the security and limit-validation changes are beneficial but warrant a quick smoke test of JSON/urlencoded endpoints. Lockfile scope is large though the application code change is only the version bump.

Overview
Bumps the backend’s direct body-parser dependency from 1.20.2 to 1.20.6 and refreshes pnpm-lock.yaml so the resolved tree matches.

1.20.6 includes a security fix (CVE-2026-12590 / GHSA-v422-hmwv-36x6) and stricter limit validation: invalid limits now throw instead of being ignored (which could disable size caps). The API already passes explicit 5mb limits in backend/src/api/index.ts, so behavior should stay the same for normal startup.

The lockfile also picks up transitive updates tied to that bump (e.g. qs, raw-body, http-errors) plus unrelated resolution churn (Express 5 / MCP stack, AWS SDK client peer wiring, Clearbit needle git URL format).

^{Reviewed by Cursor Bugbot for commit abf0fb5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit afe3f87. Configure here.}

[cursor]

Needle lockfile uses SSH git

Medium Severity

Updating body-parser rewrote clearbit's needle dependency from an HTTPS GitHub tarball to a type: git resolution with repo: git@github.com:.... CI runs pnpm i --frozen-lockfile and will try an SSH clone, which fails without GitHub SSH keys even though the repo is public.

Additional Locations (1)

• pnpm-lock.yaml#L15675-L15676

 

^{Reviewed by Cursor Bugbot for commit afe3f87. Configure here.}