chore(deps): bump body-parser from 1.20.5 to 1.20.6 - #7872
chore(deps): bump body-parser from 1.20.5 to 1.20.6#7872dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
javascript
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b6ef45678
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| resolution: "@accruals-gateway/domains@link:./domains::locator=%40app%2Faccruals-gateway%40workspace%3Aapps%2Faccruals-gateway" | ||
| languageName: node | ||
| linkType: soft | ||
|
|
||
| "@address-service/domains@link:./domains::locator=%40app%2Faddress-service%40workspace%3Aapps%2Faddress-service": |
There was a problem hiding this comment.
This lockfile now only contains the five checked-in app workspaces and drops submodule workspaces such as @app/accruals-gateway, @app/pos-integration, and @app/resident-app. The main CI workflow checks out submodules recursively before running yarn install --immutable (.github/workflows/nodejs.condo.ci.yml:146-150,285-288), and Yarn 4.17.0 help says --immutable aborts if the lockfile would be modified; with submodule package.json files present, Yarn will need to add these workspace/link resolutions back and fail the install. Regenerate the lockfile with recursive submodules checked out, or restore the deleted workspace sections.
AGENTS.md reference: AGENTS.md:L117-L119
Useful? React with 👍 / 👎.
| "body-parser@npm:^1.19.0, body-parser@npm:~1.20.5": | ||
| version: 1.20.5 | ||
| resolution: "body-parser@npm:1.20.5" |
There was a problem hiding this comment.
This leaves the descriptors used by Express and Keystone transitive paths resolving to body-parser 1.20.5 while adding a separate direct 1.20.6 copy. Because ^1.19.0 and ~1.20.5 can also resolve to 1.20.6, any service using Express's built-in parsers can still install the vulnerable 1.20.5 package, so this security bump will not clear the vulnerable version from production installs or scanners. Please update/dedupe this existing lock entry to 1.20.6 instead of keeping a second copy.
Useful? React with 👍 / 👎.
Bumps [body-parser](https://github.com/expressjs/body-parser) from 1.20.5 to 1.20.6. - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) --- updated-dependencies: - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
4b6ef45 to
d731e59
Compare
|
|
Dependabot can't resolve your JavaScript dependency files. Because of this, Dependabot cannot update this pull request. |
1 similar comment
|
Dependabot can't resolve your JavaScript dependency files. Because of this, Dependabot cannot update this pull request. |
Bumps body-parser from 1.20.5 to 1.20.6.
Release notes
Sourced from body-parser's releases.
Changelog
Sourced from body-parser's changelog.
Commits
5cc4fb81.20.6 (#746)3492672fix: improve limit option validation (#741)