chore(deps): update dependency body-parser to v2.2.1 [security] #499

renovate · 2025-11-25T21:00:17Z

This PR contains the following updates:

Package	Change	Age	Confidence
body-parser	`2.2.0` -> `2.2.1`

GitHub Vulnerability Alerts

CVE-2025-13466

Impact

body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.

Patches

This issue is addressed in version 2.2.1.

Release Notes

expressjs/body-parser (body-parser)

`v2.2.1`

Compare Source

=========================

Security fix for GHSA-wqch-xfxh-vrr4
deps:
- type-is@^2.0.1
- iconv-lite@^0.7.0
  - Handle split surrogate pairs when encoding UTF-8
  - Avoid false positives in encodingExists by using prototype-less objects
- raw-body@^3.0.1
- debug@^4.4.3

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2025-11-25T21:00:21Z

⚠️ No Changeset found

Latest commit: a9d8bc7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2025-11-25T21:00:28Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Note

Free review on us!

CodeRabbit is offering free reviews until Wed Dec 17 2025 to showcase some of the refinements we've made.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nx-cloud · 2025-11-25T21:01:11Z

View your CI Pipeline Execution ↗ for commit af11117

Command	Status	Duration	Result
`nx run-many -t build --no-agents`	✅ Succeeded	<1s	View ↗
`nx affected -t build lint test e2e-ci`	✅ Succeeded	2m 36s	View ↗

☁️ Nx Cloud last updated this comment at 2025-12-10 21:48:47 UTC

pkg-pr-new · 2025-11-25T21:04:20Z

Open in StackBlitz

@forgerock/davinci-client

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/davinci-client@499

@forgerock/device-client

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/device-client@499

@forgerock/journey-client

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/journey-client@499

@forgerock/oidc-client

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/oidc-client@499

@forgerock/protect

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/protect@499

@forgerock/sdk-types

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/sdk-types@499

@forgerock/sdk-utilities

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/sdk-utilities@499

@forgerock/iframe-manager

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/iframe-manager@499

@forgerock/sdk-logger

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/sdk-logger@499

@forgerock/sdk-oidc

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/sdk-oidc@499

@forgerock/sdk-request-middleware

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/sdk-request-middleware@499

@forgerock/storage

pnpm add https://pkg.pr.new/ForgeRock/ping-javascript-sdk/@forgerock/storage@499

commit: af11117

github-actions · 2025-11-25T21:04:46Z

Deployed 1ab71db to https://ForgeRock.github.io/ping-javascript-sdk/pr-499/1ab71dbd1347eacd96c1659920ef53bf8d5b1caa branch gh-pages in ForgeRock/ping-javascript-sdk

github-actions · 2025-11-25T21:04:53Z

📦 Bundle Size Analysis

🚨 Significant Changes

🔻 @forgerock/journey-client - 0.0 KB (-82.4 KB, -100.0%)

📊 Minor Changes

📉 @forgerock/journey-client - 82.4 KB (-0.0 KB)

➖ No Changes

➖ @forgerock/device-client - 9.2 KB
➖ @forgerock/oidc-client - 23.4 KB
➖ @forgerock/protect - 150.1 KB
➖ @forgerock/sdk-utilities - 7.5 KB
➖ @forgerock/sdk-types - 8.0 KB
➖ @forgerock/storage - 1.4 KB
➖ @forgerock/sdk-logger - 1.6 KB
➖ @forgerock/iframe-manager - 2.4 KB
➖ @forgerock/sdk-request-middleware - 4.5 KB
➖ @forgerock/sdk-oidc - 2.6 KB
➖ @forgerock/davinci-client - 39.5 KB

13 packages analyzed • Baseline from latest main build

Legend

🆕 New package
🔺 Size increased
🔻 Size decreased
➖ No change

ℹ️ How bundle sizes are calculated

Current Size: Total gzipped size of all files in the package's dist directory
Baseline: Comparison against the latest build from the main branch
Files included: All build outputs except source maps and TypeScript build cache
Exclusions: .map, .tsbuildinfo, and .d.ts.map files

_{🔄 Updated automatically on each push to this PR}

codecov-commenter · 2025-11-25T21:06:39Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 18.81%. Comparing base (b89ad58) to head (af11117).
⚠️ Report is 17 commits behind head on main.

❌ Your project status has failed because the head coverage (18.81%) is below the target coverage (40.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #499      +/-   ##
==========================================
+ Coverage   18.79%   18.81%   +0.02%     
==========================================
  Files         140      140              
  Lines       27640    27647       +7     
  Branches      980      981       +1     
==========================================
+ Hits         5195     5202       +7     
  Misses      22445    22445

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

nx-cloud

Important

A new CI pipeline execution was requested that may update the conclusion below...

Nx Cloud has identified a possible root cause for your failed CI:

Our investigation shows these e2e test failures are pre-existing in the main branch and unrelated to the body-parser security update. The similar-task-failure-detector confirmed identical authentication flow timeouts exist in main, indicating an environmental issue with the DaVinci authentication service or test infrastructure configuration rather than a problem introduced by this PR.

No code changes were suggested for this issue.

View detailed reasoning on Nx Cloud ↗

_{🎓 Learn more about Self-Healing CI on nx.dev}

renovate bot added the UPDATE-PATCH label Nov 25, 2025

renovate-approve bot approved these changes Nov 25, 2025

View reviewed changes

renovate bot force-pushed the renovate/npm-body-parser-vulnerability branch from 2adad26 to 5c0cce0 Compare December 2, 2025 19:20

nx-cloud bot reviewed Dec 2, 2025

View reviewed changes

renovate bot force-pushed the renovate/npm-body-parser-vulnerability branch 2 times, most recently from bd9b334 to af11117 Compare December 10, 2025 21:44

chore(deps): update dependency body-parser to v2.2.1 [security]

a9d8bc7

renovate bot force-pushed the renovate/npm-body-parser-vulnerability branch from af11117 to a9d8bc7 Compare December 15, 2025 22:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency body-parser to v2.2.1 [security] #499

chore(deps): update dependency body-parser to v2.2.1 [security] #499

Uh oh!

renovate bot commented Nov 25, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented Nov 25, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Nov 25, 2025 •

edited

Loading

Review skipped

Free review on us!

Uh oh!

nx-cloud bot commented Nov 25, 2025 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Nov 25, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 25, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 25, 2025 •

edited

Loading

Uh oh!

codecov-commenter commented Nov 25, 2025 •

edited

Loading

Uh oh!

nx-cloud bot left a comment •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

chore(deps): update dependency body-parser to v2.2.1 [security] #499

Are you sure you want to change the base?

chore(deps): update dependency body-parser to v2.2.1 [security] #499

Uh oh!

Conversation

renovate bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2025-13466

Impact

Patches

Release Notes

v2.2.1

Configuration

Uh oh!

changeset-bot bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Free review on us!

Uh oh!

nx-cloud bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Bundle Size Analysis

📦 Bundle Size Analysis

🚨 Significant Changes

Legend

Uh oh!

codecov-commenter commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nx-cloud bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Nx Cloud has identified a possible root cause for your failed CI:

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

renovate bot commented Nov 25, 2025 •

edited

Loading

`v2.2.1`

changeset-bot bot commented Nov 25, 2025 •

edited

Loading

coderabbitai bot commented Nov 25, 2025 •

edited

Loading

nx-cloud bot commented Nov 25, 2025 •

edited

Loading

pkg-pr-new bot commented Nov 25, 2025 •

edited

Loading

github-actions bot commented Nov 25, 2025 •

edited

Loading

github-actions bot commented Nov 25, 2025 •

edited

Loading

codecov-commenter commented Nov 25, 2025 •

edited

Loading

nx-cloud bot left a comment •

edited

Loading