[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: body-parser.

Updates body-parser from 2.2.1 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

• Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in expressjs/body-parser#737
• chore: group github actions updates by @​Phillip9587 in expressjs/body-parser#743
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#745
• test: fix 'presist' typo in test descriptions by @​maxtaran2010 in expressjs/body-parser#749
• docs: include security fix in 2.3.0 changes by @​UlisesGascon in expressjs/body-parser#748
• fix: avoid mutating read options when reading body by @​Phillip9587 in expressjs/body-parser#742
• refactor: move getCharset helper to only usage by @​Phillip9587 in expressjs/body-parser#707
• build(deps): bump the github-actions group with 7 updates by @​dependabot[bot] in expressjs/body-parser#753
• refactor: switch to neostandard by @​Phillip9587 in expressjs/body-parser#751
• perf(json): avoid first-char regex for direct JSON bodies by @​Phillip9587 in expressjs/body-parser#744
• docs: fix entity verify error description by @​Rawal27 in expressjs/body-parser#755
• feat: zstandard support by @​Phillip9587 in expressjs/body-parser#586
• test: remove unused experimentalZstd option by @​Phillip9587 in expressjs/body-parser#757
• ci: run tests on windows and macos matrix by @​kilisamemarisaaa in expressjs/body-parser#759
• deps: qs@^6.16.0 by @​krzysdz in expressjs/body-parser#762
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#763
• ci: trigger npm publish on release published and set dist-tag by @​UlisesGascon in expressjs/body-parser#768
• build(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in expressjs/body-parser#771
• fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @​saadkhantareen in expressjs/body-parser#773
• perf: inline content stream setup by @​Phillip9587 in expressjs/body-parser#750
• docs: note that req.body may be undefined in v2 by @​Hashim1999164 in expressjs/body-parser#752
• docs: fix strict option description by @​Rawal27 in expressjs/body-parser#756
• docs: fix depth error description by @​johnnyhuirilef in expressjs/body-parser#776
• chore: update dependencies by @​Phillip9587 in expressjs/body-parser#778
• Release: 2.4.0 by @​UlisesGascon in expressjs/body-parser#777

New Contributors

• @​maxtaran2010 made their first contribution in expressjs/body-parser#749
• @​Rawal27 made their first contribution in expressjs/body-parser#755
• @​kilisamemarisaaa made their first contribution in expressjs/body-parser#759
• @​saadkhantareen made their first contribution in expressjs/body-parser#773
• @​Hashim1999164 made their first contribution in expressjs/body-parser#752
• @​johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

v2.3.0

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @​dependabot[bot] in expressjs/body-parser#681

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.4.0

• Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)
• feat: add zstd content-encoding support (#586)
  • Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies
• fix: avoid mutating the parser options and the request object while reading the body (#742, #750)
• perf(json): avoid first-char regex for direct JSON bodies (#744)
• deps:
  • content-type@^2.1.0
  • iconv-lite^0.7.3
  • qs@^6.16.1

2.3.0

• Security fix for GHSA-v422-hmwv-36x6
• fix: use static exports instead of lazy getters to improve ESM compatibility
• feat: add subpath exports for individual parsers
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit
• deps:
  • content-type@^2.0.0
  • http-errors@^2.0.1
  • iconv-lite^0.7.2
  • qs@^6.15.2
  • raw-body@^3.0.2
  • type-is@^2.1.0

2.2.2

• deps: qs@^6.14.1
• refactor(json): simplify strict mode error string construction

Commits

• b4744d7 2.4.0 (#777)
• f7075ea fix: prevent process crash from trailing bytes after a compressed body
• 185ff1d chore: update dependencies (#778)
• 73713f7 docs: fix depth error description (#776)
• 2dcc826 docs: improve readability (#756)
• 402dbdc docs: note that req.body may be undefined in v2 (#752)
• 9883a1e perf: inline content stream setup (#750)
• 02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
• 822a0fd build(deps): bump the github-actions group with 3 updates (#771)
• aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

[Copilot]

🟡 Changes recommended

The title and description advertise only a body-parser security update but omit broader workspace dependency upgrades, including the major tsup 8-to-9 change.

1 open issue

• Document or separate the unrelated dependency upgrades · New

What changed in this PR

The supplied changes refresh build tooling and runtime dependencies across Bot Framework Web Chat’s workspace packages.

Changes:

• Upgrade tsup from 8.5.1 to 9.0.0 in the root and five workspace manifests.
• Update Valibot dependencies and peer requirements to 1.5.0.
• Update UUID to 14.0.2 and root minimatch to 11.0.2.

File	Description
packages/​test/​web-server/​package.json	Upgrade tsup for test-server builds.
packages/​styles/​package.json	Upgrade tsup for styles builds.
packages/​redux-store/​package.json	Update tsup and Valibot.
packages/​react-valibot/​package.json	Update tsup and Valibot peer requirement.
packages/​fluent-theme/​package.json	Update tsup and Valibot.
packages/​core/​package.json	Update UUID and Valibot.
packages/​core-graph/​package.json	Update UUID peer requirement and Valibot.
packages/​component/​package.json	Update Valibot.
packages/​bundle/​package.json	Update UUID and Valibot.
packages/​base/​package.json	Raise Valibot peer requirement.
packages/​api/​package.json	Update Valibot.
packages/​api-middleware/​package.json	Update Valibot.
packages/​api-graph/​package.json	Update Valibot.
package.json	Update shared tsup tooling and minimatch.

_{Review effort: Balanced}