chore(deps): bump body-parser from 1.20.5 to 1.20.6 - #7872
chore(deps): bump body-parser from 1.20.5 to 1.20.6#7872dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.5 to 1.20.6. - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) --- updated-dependencies: - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
javascript
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b6ef45678
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| resolution: "@accruals-gateway/domains@link:./domains::locator=%40app%2Faccruals-gateway%40workspace%3Aapps%2Faccruals-gateway" | ||
| languageName: node | ||
| linkType: soft | ||
|
|
||
| "@address-service/domains@link:./domains::locator=%40app%2Faddress-service%40workspace%3Aapps%2Faddress-service": |
There was a problem hiding this comment.
This lockfile now only contains the five checked-in app workspaces and drops submodule workspaces such as @app/accruals-gateway, @app/pos-integration, and @app/resident-app. The main CI workflow checks out submodules recursively before running yarn install --immutable (.github/workflows/nodejs.condo.ci.yml:146-150,285-288), and Yarn 4.17.0 help says --immutable aborts if the lockfile would be modified; with submodule package.json files present, Yarn will need to add these workspace/link resolutions back and fail the install. Regenerate the lockfile with recursive submodules checked out, or restore the deleted workspace sections.
AGENTS.md reference: AGENTS.md:L117-L119
Useful? React with 👍 / 👎.
| "body-parser@npm:^1.19.0, body-parser@npm:~1.20.5": | ||
| version: 1.20.5 | ||
| resolution: "body-parser@npm:1.20.5" |
There was a problem hiding this comment.
This leaves the descriptors used by Express and Keystone transitive paths resolving to body-parser 1.20.5 while adding a separate direct 1.20.6 copy. Because ^1.19.0 and ~1.20.5 can also resolve to 1.20.6, any service using Express's built-in parsers can still install the vulnerable 1.20.5 package, so this security bump will not clear the vulnerable version from production installs or scanners. Please update/dedupe this existing lock entry to 1.20.6 instead of keeping a second copy.
Useful? React with 👍 / 👎.
|
Bumps body-parser from 1.20.5 to 1.20.6.
Release notes
Sourced from body-parser's releases.
Changelog
Sourced from body-parser's changelog.
Commits
5cc4fb81.20.6 (#746)3492672fix: improve limit option validation (#741)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.