chore(deps): bump the npm_and_yarn group across 9 directories with 2 updates by dependabot[bot] · Pull Request #6396 · daggerstuff/pixelated

dependabot · 2026-10-26T06:58:19Z

Bumps the npm_and_yarn group with 2 updates in the /agents/advisor-agent directory: zod and body-parser.
Bumps the npm_and_yarn group with 2 updates in the /agents/content-agent directory: zod and body-parser.
Bumps the npm_and_yarn group with 2 updates in the /agents/eve-agent directory: zod and body-parser.
Bumps the npm_and_yarn group with 2 updates in the /agents/intake-agent directory: zod and body-parser.
Bumps the npm_and_yarn group with 2 updates in the /agents/pipeline-agent directory: zod and body-parser.
Bumps the npm_and_yarn group with 2 updates in the /agents/qa-agent directory: zod and body-parser.
Bumps the npm_and_yarn group with 2 updates in the /agents/session-agent directory: zod and body-parser.
Bumps the npm_and_yarn group with 2 updates in the /agents/supervisor-agent directory: zod and body-parser.
Bumps the npm_and_yarn group with 1 update in the /infra/docker/alert-receiver directory: body-parser.

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Updates body-parser from 2.3.0 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#737

chore: group github actions updates by @Phillip9587 in expressjs/body-parser#743

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#745

test: fix 'presist' typo in test descriptions by @maxtaran2010 in expressjs/body-parser#749

docs: include security fix in 2.3.0 changes by @UlisesGascon in expressjs/body-parser#748

fix: avoid mutating read options when reading body by @Phillip9587 in expressjs/body-parser#742

refactor: move getCharset helper to only usage by @Phillip9587 in expressjs/body-parser#707

build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in expressjs/body-parser#753

refactor: switch to neostandard by @Phillip9587 in expressjs/body-parser#751

perf(json): avoid first-char regex for direct JSON bodies by @Phillip9587 in expressjs/body-parser#744

docs: fix entity verify error description by @Rawal27 in expressjs/body-parser#755

feat: zstandard support by @Phillip9587 in expressjs/body-parser#586

test: remove unused experimentalZstd option by @Phillip9587 in expressjs/body-parser#757

ci: run tests on windows and macos matrix by @kilisamemarisaaa in expressjs/body-parser#759

deps: qs@^6.16.0 by @krzysdz in expressjs/body-parser#762

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#763

ci: trigger npm publish on release published and set dist-tag by @UlisesGascon in expressjs/body-parser#768

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#771

fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @saadkhantareen in expressjs/body-parser#773

perf: inline content stream setup by @Phillip9587 in expressjs/body-parser#750

docs: note that req.body may be undefined in v2 by @Hashim1999164 in expressjs/body-parser#752

docs: fix strict option description by @Rawal27 in expressjs/body-parser#756

docs: fix depth error description by @johnnyhuirilef in expressjs/body-parser#776

chore: update dependencies by @Phillip9587 in expressjs/body-parser#778

Release: 2.4.0 by @UlisesGascon in expressjs/body-parser#777

New Contributors

@maxtaran2010 made their first contribution in expressjs/body-parser#749

@Rawal27 made their first contribution in expressjs/body-parser#755

@kilisamemarisaaa made their first contribution in expressjs/body-parser#759

@saadkhantareen made their first contribution in expressjs/body-parser#773

@Hashim1999164 made their first contribution in expressjs/body-parser#752

@johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)

feat: add zstd content-encoding support (#586)

Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies

fix: avoid mutating the parser options and the request object while reading the body (#742, #750)

perf(json): avoid first-char regex for direct JSON bodies (#744)

deps:

content-type@^2.1.0

iconv-lite^0.7.3

qs@^6.16.1

Commits

b4744d7 2.4.0 (#777)
f7075ea fix: prevent process crash from trailing bytes after a compressed body
185ff1d chore: update dependencies (#778)
73713f7 docs: fix depth error description (#776)
2dcc826 docs: improve readability (#756)
402dbdc docs: note that req.body may be undefined in v2 (#752)
9883a1e perf: inline content stream setup (#750)
02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
822a0fd build(deps): bump the github-actions group with 3 updates (#771)
aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Updates body-parser from 2.3.0 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#737

chore: group github actions updates by @Phillip9587 in expressjs/body-parser#743

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#745

test: fix 'presist' typo in test descriptions by @maxtaran2010 in expressjs/body-parser#749

docs: include security fix in 2.3.0 changes by @UlisesGascon in expressjs/body-parser#748

fix: avoid mutating read options when reading body by @Phillip9587 in expressjs/body-parser#742

refactor: move getCharset helper to only usage by @Phillip9587 in expressjs/body-parser#707

build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in expressjs/body-parser#753

refactor: switch to neostandard by @Phillip9587 in expressjs/body-parser#751

perf(json): avoid first-char regex for direct JSON bodies by @Phillip9587 in expressjs/body-parser#744

docs: fix entity verify error description by @Rawal27 in expressjs/body-parser#755

feat: zstandard support by @Phillip9587 in expressjs/body-parser#586

test: remove unused experimentalZstd option by @Phillip9587 in expressjs/body-parser#757

ci: run tests on windows and macos matrix by @kilisamemarisaaa in expressjs/body-parser#759

deps: qs@^6.16.0 by @krzysdz in expressjs/body-parser#762

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#763

ci: trigger npm publish on release published and set dist-tag by @UlisesGascon in expressjs/body-parser#768

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#771

fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @saadkhantareen in expressjs/body-parser#773

perf: inline content stream setup by @Phillip9587 in expressjs/body-parser#750

docs: note that req.body may be undefined in v2 by @Hashim1999164 in expressjs/body-parser#752

docs: fix strict option description by @Rawal27 in expressjs/body-parser#756

docs: fix depth error description by @johnnyhuirilef in expressjs/body-parser#776

chore: update dependencies by @Phillip9587 in expressjs/body-parser#778

Release: 2.4.0 by @UlisesGascon in expressjs/body-parser#777

New Contributors

@maxtaran2010 made their first contribution in expressjs/body-parser#749

@Rawal27 made their first contribution in expressjs/body-parser#755

@kilisamemarisaaa made their first contribution in expressjs/body-parser#759

@saadkhantareen made their first contribution in expressjs/body-parser#773

@Hashim1999164 made their first contribution in expressjs/body-parser#752

@johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)

feat: add zstd content-encoding support (#586)

Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies

fix: avoid mutating the parser options and the request object while reading the body (#742, #750)

perf(json): avoid first-char regex for direct JSON bodies (#744)

deps:

content-type@^2.1.0

iconv-lite^0.7.3

qs@^6.16.1

Commits

b4744d7 2.4.0 (#777)
f7075ea fix: prevent process crash from trailing bytes after a compressed body
185ff1d chore: update dependencies (#778)
73713f7 docs: fix depth error description (#776)
2dcc826 docs: improve readability (#756)
402dbdc docs: note that req.body may be undefined in v2 (#752)
9883a1e perf: inline content stream setup (#750)
02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
822a0fd build(deps): bump the github-actions group with 3 updates (#771)
aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Updates body-parser from 2.3.0 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#737

chore: group github actions updates by @Phillip9587 in expressjs/body-parser#743

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#745

test: fix 'presist' typo in test descriptions by @maxtaran2010 in expressjs/body-parser#749

docs: include security fix in 2.3.0 changes by @UlisesGascon in expressjs/body-parser#748

fix: avoid mutating read options when reading body by @Phillip9587 in expressjs/body-parser#742

refactor: move getCharset helper to only usage by @Phillip9587 in expressjs/body-parser#707

build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in expressjs/body-parser#753

refactor: switch to neostandard by @Phillip9587 in expressjs/body-parser#751

perf(json): avoid first-char regex for direct JSON bodies by @Phillip9587 in expressjs/body-parser#744

docs: fix entity verify error description by @Rawal27 in expressjs/body-parser#755

feat: zstandard support by @Phillip9587 in expressjs/body-parser#586

test: remove unused experimentalZstd option by @Phillip9587 in expressjs/body-parser#757

ci: run tests on windows and macos matrix by @kilisamemarisaaa in expressjs/body-parser#759

deps: qs@^6.16.0 by @krzysdz in expressjs/body-parser#762

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#763

ci: trigger npm publish on release published and set dist-tag by @UlisesGascon in expressjs/body-parser#768

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#771

fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @saadkhantareen in expressjs/body-parser#773

perf: inline content stream setup by @Phillip9587 in expressjs/body-parser#750

docs: note that req.body may be undefined in v2 by @Hashim1999164 in expressjs/body-parser#752

docs: fix strict option description by @Rawal27 in expressjs/body-parser#756

docs: fix depth error description by @johnnyhuirilef in expressjs/body-parser#776

chore: update dependencies by @Phillip9587 in expressjs/body-parser#778

Release: 2.4.0 by @UlisesGascon in expressjs/body-parser#777

New Contributors

@maxtaran2010 made their first contribution in expressjs/body-parser#749

@Rawal27 made their first contribution in expressjs/body-parser#755

@kilisamemarisaaa made their first contribution in expressjs/body-parser#759

@saadkhantareen made their first contribution in expressjs/body-parser#773

@Hashim1999164 made their first contribution in expressjs/body-parser#752

@johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)

feat: add zstd content-encoding support (#586)

Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies

fix: avoid mutating the parser options and the request object while reading the body (#742, #750)

perf(json): avoid first-char regex for direct JSON bodies (#744)

deps:

content-type@^2.1.0

iconv-lite^0.7.3

qs@^6.16.1

Commits

b4744d7 2.4.0 (#777)
f7075ea fix: prevent process crash from trailing bytes after a compressed body
185ff1d chore: update dependencies (#778)
73713f7 docs: fix depth error description (#776)
2dcc826 docs: improve readability (#756)
402dbdc docs: note that req.body may be undefined in v2 (#752)
9883a1e perf: inline content stream setup (#750)
02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
822a0fd build(deps): bump the github-actions group with 3 updates (#771)
aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Updates body-parser from 2.3.0 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#737

chore: group github actions updates by @Phillip9587 in expressjs/body-parser#743

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#745

test: fix 'presist' typo in test descriptions by @maxtaran2010 in expressjs/body-parser#749

docs: include security fix in 2.3.0 changes by @UlisesGascon in expressjs/body-parser#748

fix: avoid mutating read options when reading body by @Phillip9587 in expressjs/body-parser#742

refactor: move getCharset helper to only usage by @Phillip9587 in expressjs/body-parser#707

build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in expressjs/body-parser#753

refactor: switch to neostandard by @Phillip9587 in expressjs/body-parser#751

perf(json): avoid first-char regex for direct JSON bodies by @Phillip9587 in expressjs/body-parser#744

docs: fix entity verify error description by @Rawal27 in expressjs/body-parser#755

feat: zstandard support by @Phillip9587 in expressjs/body-parser#586

test: remove unused experimentalZstd option by @Phillip9587 in expressjs/body-parser#757

ci: run tests on windows and macos matrix by @kilisamemarisaaa in expressjs/body-parser#759

deps: qs@^6.16.0 by @krzysdz in expressjs/body-parser#762

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#763

ci: trigger npm publish on release published and set dist-tag by @UlisesGascon in expressjs/body-parser#768

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#771

fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @saadkhantareen in expressjs/body-parser#773

perf: inline content stream setup by @Phillip9587 in expressjs/body-parser#750

docs: note that req.body may be undefined in v2 by @Hashim1999164 in expressjs/body-parser#752

docs: fix strict option description by @Rawal27 in expressjs/body-parser#756

docs: fix depth error description by @johnnyhuirilef in expressjs/body-parser#776

chore: update dependencies by @Phillip9587 in expressjs/body-parser#778

Release: 2.4.0 by @UlisesGascon in expressjs/body-parser#777

New Contributors

@maxtaran2010 made their first contribution in expressjs/body-parser#749

@Rawal27 made their first contribution in expressjs/body-parser#755

@kilisamemarisaaa made their first contribution in expressjs/body-parser#759

@saadkhantareen made their first contribution in expressjs/body-parser#773

@Hashim1999164 made their first contribution in expressjs/body-parser#752

@johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)

feat: add zstd content-encoding support (#586)

Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies

fix: avoid mutating the parser options and the request object while reading the body (#742, #750)

perf(json): avoid first-char regex for direct JSON bodies (#744)

deps:

content-type@^2.1.0

iconv-lite^0.7.3

qs@^6.16.1

Commits

b4744d7 2.4.0 (#777)
f7075ea fix: prevent process crash from trailing bytes after a compressed body
185ff1d chore: update dependencies (#778)
73713f7 docs: fix depth error description (#776...
Description has been truncated

vercel · 2026-10-26T06:58:22Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 26, 2026 7:29am UTC

github-actions · 2026-10-26T06:59:31Z

px Advisor Review

Risk: unknown

No summary available

No findings.

github-actions · 2026-10-26T07:02:52Z

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

lhr-1792998078922
lhr-1792998090762
lhr-1792998102000
lhr-1792998112800
lhr-1792998123526
lhr-1792998134317
lhr-1792998145014
lhr-1792998155770
lhr-1792998166701

Reports are also available as workflow artifacts

github-actions · 2026-10-26T07:30:09Z

px Advisor Review

Risk: unknown

No summary available

No findings.

github-actions · 2026-10-26T07:33:35Z

Lighthouse CI Results

Routes audited: /, /dashboard?perf=1, /training-session

Thresholds: Performance ≥90 | Accessibility ≥90 | Best Practices ≥85

Reports

lhr-1792999921404
lhr-1792999933455
lhr-1792999945020
lhr-1792999955935
lhr-1792999966639
lhr-1792999977346
lhr-1792999988124
lhr-1792999998958
lhr-1793000009725

Reports are also available as workflow artifacts

dependabot Bot requested a review from daggerstuff as a code owner October 26, 2026 06:58

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 26, 2026

dependabot Bot added the javascript Pull requests that update javascript code label Oct 26, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/agents/advisor-agent/npm_and_yarn-685b8bf1c3 branch from 3afc341 to 841f381 Compare October 26, 2026 07:29

daggerstuff merged commit 8c353b4 into staging Oct 26, 2026
40 of 42 checks passed

daggerstuff deleted the dependabot/npm_and_yarn/agents/advisor-agent/npm_and_yarn-685b8bf1c3 branch October 26, 2026 07:36

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 9 directories with 2 updates - #6396

chore(deps): bump the npm_and_yarn group across 9 directories with 2 updates#6396
daggerstuff merged 1 commit into
stagingfrom
dependabot/npm_and_yarn/agents/advisor-agent/npm_and_yarn-685b8bf1c3

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.6.6

Commits:

v2.4.0

Important: Security

What's Changed

New Contributors

2.4.0

v4.6.6

Commits:

v2.4.0

Important: Security

What's Changed

New Contributors

2.4.0

v4.6.6

Commits:

v2.4.0

Important: Security

What's Changed

New Contributors

2.4.0

v4.6.6

Commits:

v2.4.0

Important: Security

What's Changed

New Contributors

2.4.0

Uh oh!

vercel Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026

px Advisor Review

Uh oh!

github-actions Bot commented Oct 26, 2026

Lighthouse CI Results

Reports

Uh oh!

github-actions Bot commented Oct 26, 2026

px Advisor Review

Uh oh!

github-actions Bot commented Oct 26, 2026

Lighthouse CI Results

Reports

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

vercel Bot commented Oct 26, 2026 •

edited

Loading