[mend-for-github-com]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
body-parser	^1.19.0 → ^1.20.6

By merging this PR, the issue #395 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability	Reachability
Low	3.7	CVE-2026-12590

---

Release Notes

expressjs/body-parser (body-parser)

v1.20.6

Compare Source

===================

• Security fix for GHSA-v422-hmwv-36x6
• fix: improve limit option validation (#​698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit

v1.20.5

Compare Source

===================

• refactor(json): simplify strict mode error string construction
• fix: extended urlencoded parsing of arrays with >100 elements (#​716)
• deps: qs@~6.15.1

v1.20.4

Compare Source

===================

• deps: qs@~6.14.0
• deps: use tilde notation for dependencies
• deps: http-errors@~2.0.1
• deps: raw-body@~2.5.3

v1.20.3

Compare Source

===================

• deps: qs@​6.13.0
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

v1.20.2

Compare Source

===================

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: raw-body@​2.5.2

v1.20.1

Compare Source

===================

• deps: qs@​6.11.0
• perf: remove unnecessary object clone

v1.20.0

Compare Source

===================

• Fix error message for json parse whitespace in strict
• Fix internal error when inflated body exceeds limit
• Prevent loss of async hooks context
• Prevent hanging when request already read
• deps: depd@​2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: http-errors@​2.0.0
  • deps: depd@​2.0.0
  • deps: statuses@​2.0.1
• deps: on-finished@​2.4.1
• deps: qs@​6.10.3
• deps: raw-body@​2.5.1
  • deps: http-errors@​2.0.0

v1.19.2

Compare Source

===================

• deps: bytes@​3.1.2
• deps: qs@​6.9.7
  • Fix handling of __proto__ keys
• deps: raw-body@​2.4.3
  • deps: bytes@​3.1.2

v1.19.1

Compare Source

===================

• deps: bytes@​3.1.1
• deps: http-errors@​1.8.1
  • deps: inherits@​2.0.4
  • deps: toidentifier@​1.0.1
  • deps: setprototypeof@​1.2.0
• deps: qs@​6.9.6
• deps: raw-body@​2.4.2
  • deps: bytes@​3.1.1
  • deps: http-errors@​1.8.1
• deps: safe-buffer@​5.2.1
• deps: type-is@~1.6.18

---

• If you want to rebase/retry this PR, check this box

[vonage-ai-assistant]

AI Adoption Report

	Lines	%
AI-generated	1	100%
Human	0	0%
Total	1

💰 Cost Breakdown

Agent	Model	AI Lines	Input Tokens	Output Tokens	Cost	Source
Mend	automated	1	10	3	$0.0000	🤖 Bot (automated)

Total Estimated Cost: $0.0000

Data Sources:

• 📐 1 commits with estimated tokens (~3.5 tokens/line)

Bedrock pricing: eu-central-1 region

Per-commit breakdown (1 commits)

Commit	Message	Added	AI	Human	AI %
0b6859a	fix(deps): update dependency body-parser to ^1.20.6	1	1	0	🤖 100% (Mend)

---

_{Powered by Git AI Standard v3.0.0 — authorship data from refs/notes/ai (supports sessions-v2 format)}