[ChiragAgg5k]

Fixes Dependabot alert GHSA-27r3-jxmh-p828 (high): body-parser < 1.20.9, pulled in transitively by express.

express 4.22.3 is already the latest 4.x release and depends on `body-parser ~1.20.5`, which admits the patched 1.20.9. So this only refreshes the lockfile (`npm update body-parser --package-lock-only`): body-parser 1.20.8 -> 1.20.9. No overrides and no express 5 major bump (the alternative in #137).

Verification: `npm ls body-parser` shows only `express@4.22.3 -> body-parser@1.20.9`, `npm audit` reports 0 vulnerabilities, and an `npm ci` install served a JSON POST through `express.json()` correctly.

[hansi-codes]

🟢 Tier S · Ready to merge

npm ci and the CI server smoke test pass, and npm audit reports no vulnerabilities.

The lockfile updates the transitive body-parser dependency from 1.20.8 to 1.20.9, within Express 4.22.3's existing dependency range. This release includes the fix for GHSA-27r3-jxmh-p828.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 1

File	Change
package-lock.json	Refreshes both lockfile entries for body-parser to version 1.20.9.

---

_{Reviewed 0d14965 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary