FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Release: 1.20.4 by UlisesGascon · Pull Request #662 · expressjs/body-parser · GitHub

/ body-parser Public

Release: 1.20.4 - #662

Closed
UlisesGascon wants to merge 1 commit into
1.xfrom
release/1.20.4
ConversationCommits (1)ChecksFiles changed
Closed

Release: 1.20.4#662
UlisesGascon wants to merge 1 commit into
1.xfrom
release/1.20.4

Conversation

UlisesGascon commented Nov 20, 2025

Copy link
Copy Markdown
Member

What's included in the HISTORY.md

* Security fix for [GHSA-wqch-xfxh-vrr4](https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4)
* refactor: move common request validation to read function
* deps: 
  * type-is@^2.0.1
  * iconv-lite@^0.7.0
    * Handle split surrogate pairs when encoding UTF-8
    * Avoid false positives in `encodingExists` by using prototype-less objects 
  * raw-body@^3.0.1
  * debug@^4.4.3

What's Changed

Full Changelog: 1.20.3...1.x

UlisesGascon self-assigned this Nov 20, 2025
UlisesGascon mentioned this pull request Nov 20, 2025
Open
36 tasks

Phillip9587 commented Nov 20, 2025

Copy link
Copy Markdown
Member

@UlisesGascon This is not needed at least from the security perspective: https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4#advisory-comment-143780

UlisesGascon commented Nov 20, 2025

Copy link
Copy Markdown
Member Author

Thanks for the update @Phillip9587!

pwlnpro commented Nov 25, 2025 •
edited
Loading

Copy link
Copy Markdown

This needs to be reopened.

There is a disconnect between Repository Advisory, and Git Advisory.
Resources:

Repository advisory marks version 2.2.0 as Vulnerable.
Github advisory marks any version below 2.2.1 as Vulnerable.

Solutions:

  • Fix advisory version on Github (if that is incorrect)
  • Fix advisory version on Repository (if that is incorrect), and implement this PR.

Thanks!

Edit:
This is needed by everyone who still uses express@4xx. 1.20.3 is still the most used version, and is now marked vulnerable.

bjohansebas commented Nov 25, 2025

Copy link
Copy Markdown
Member

Hey, the team has already been informed. The correct range is the one in GHSA-wqch-xfxh-vrr4, the only affected version was 2.2.0

jonchurch commented Nov 25, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

We don't know how what we published was not what github propogated to the global registry, we have a PR open against their global registry to fix the affected version string to be exact.

github/advisory-database#6470
Thanks for your patience folks

UlisesGascon deleted the release/1.20.4 branch November 26, 2025 17:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

UlisesGascon

Labels

release v1.x

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

Back | FazBrowse Home | New Git URL