Update dependency body-parser to v2#36
Conversation
|
Warning Review limit reached
More reviews will be available in 49 minutes and 26 seconds. Learn how PR review limits work. To continue reviewing without waiting, enable usage-based billing in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe ChangesDependency Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 42: package.json currently pins "body-parser": "2.2.2" which requires
Node >=18 while engines.node allows ">=16.0.0"; update package.json to resolve
the mismatch by either (A) raising engines.node to ">=18.0.0" (so engines.node
matches body-parser@2.2.2) or (B) replacing/downgrading "body-parser" to a
version compatible with Node 16 (e.g., a 1.x release); modify the engines.node
field or the "body-parser" dependency accordingly and run a lockfile update
(npm/yarn/pnpm) to keep manifest and lockfile consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bfea4119-4532-4d27-a101-bca6cfe47931
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json
| "@seald-io/nedb": "4.1.2", | ||
| "archiver": "7.0.1", | ||
| "body-parser": "1.20.4", | ||
| "body-parser": "2.2.2", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Project Node engine:"
jq -r '.engines.node' package.json
echo "Pinned body-parser version:"
jq -r '.dependencies["body-parser"]' package.json
echo "body-parser@2.2.2 Node engine from npm registry:"
curl -s https://registry.npmjs.org/body-parser/2.2.2 | jq -r '.engines.node'Repository: flamingo-stack/meshcentral
Length of output: 188
Fix package.json Node engine mismatch with body-parser@2.2.2.
package.json pins "body-parser": "2.2.2" (line 42), but engines.node still allows " >=16.0.0" (lines 59-60). body-parser@2.2.2 requires node >=18, so installs/runs on Node 16/17 may fail.
Suggested fix
"engines": {
- "node": ">=16.0.0"
+ "node": ">=18.0.0"
},📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "body-parser": "2.2.2", | |
| "engines": { | |
| "node": ">=18.0.0" | |
| }, |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 42, package.json currently pins "body-parser": "2.2.2"
which requires Node >=18 while engines.node allows ">=16.0.0"; update
package.json to resolve the mismatch by either (A) raising engines.node to
">=18.0.0" (so engines.node matches body-parser@2.2.2) or (B)
replacing/downgrading "body-parser" to a version compatible with Node 16 (e.g.,
a 1.x release); modify the engines.node field or the "body-parser" dependency
accordingly and run a lockfile update (npm/yarn/pnpm) to keep manifest and
lockfile consistent.
ivan-flamingo
force-pushed
the
renovate/body-parser-2.x
branch
3 times, most recently
from
101fdc1 to
4037a11
Compare
ivan-flamingo
force-pushed
the
renovate/body-parser-2.x
branch
2 times, most recently
from
80d0089 to
3b14786
Compare
ivan-flamingo
force-pushed
the
renovate/body-parser-2.x
branch
from
3b14786 to
1621c11
Compare
2 participants
This PR contains the following updates:
1.20.4→2.3.0Release Notes
expressjs/body-parser (body-parser)
v2.3.0Compare Source
========================
limitoption validation (#698)limitvalues (e.g. unparseable strings orNaN) now throw instead of being silently ignored, which previously disabled size limit enforcementnullandundefinedfall back to the default 100kb limitv2.2.2Compare Source
=========================
v2.2.1Compare Source
=========================
encodingExistsby using prototype-less objectsv2.2.0Compare Source
=========================
v2.1.0Compare Source
=========================
v2.0.2Compare Source
=========================
unpipepackage and use nativeunpipe()methodv2.0.1Compare Source
=========================
extendedtofalsev2.0.0Compare Source
=========================
Breaking Changes
req.bodyis no longer always initialized to{}undefinedunless a body is parsedbodyParser()combination middlewareurlencodedparser now defaultsextendedtofalseurlencodedsimple parser now usesqsmodule instead ofquerystringmoduleFeatures
on-finishedto determine when body readDependencies
v1.20.5Compare Source
What's Changed
The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (#716)
New Contributors
Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!
Full Changelog: expressjs/body-parser@1.20.4...1.20.5
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.