From 021184c23fd6189037be829a589092f82977aaac Mon Sep 17 00:00:00 2001 From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 13:39:02 +0000 Subject: [PATCH 1/2] chore: upgrade body-parser to ^2.3.0/^1.20.6 to address CVE-2026-12590 Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1568/sourcebot-devsourcebot-cve-2026-12590-body-parser-body-parser-vulnerable-to-denial#agent-session-26ce05b3) Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com> --- package.json | 3 +- yarn.lock | 112 ++++++++++++++++++++++++++++++--------------------- 2 files changed, 67 insertions(+), 48 deletions(-) diff --git a/package.json b/package.json index ed846875f..4e78bd6a5 100644 --- a/package.json +++ b/package.json @@ -61,6 +61,7 @@ "uuid": "^14.0.0", "fast-uri@npm:^3.0.1": "^3.1.2", "shell-quote@npm:1.8.3": "^1.8.4", - "ws@npm:~8.20.1": "^8.21.0" + "ws@npm:~8.20.1": "^8.21.0", + "body-parser@npm:1.20.3": "^1.20.6" } } diff --git a/yarn.lock b/yarn.lock index 54653dc8d..48bce1715 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11786,40 +11786,40 @@ __metadata: languageName: node linkType: hard -"body-parser@npm:1.20.3": - version: 1.20.3 - resolution: "body-parser@npm:1.20.3" +"body-parser@npm:^1.20.6": + version: 1.20.6 + resolution: "body-parser@npm:1.20.6" dependencies: - bytes: "npm:3.1.2" + bytes: "npm:~3.1.2" content-type: "npm:~1.0.5" debug: "npm:2.6.9" depd: "npm:2.0.0" - destroy: "npm:1.2.0" - http-errors: "npm:2.0.0" - iconv-lite: "npm:0.4.24" - on-finished: "npm:2.4.1" - qs: "npm:6.13.0" - raw-body: "npm:2.5.2" + destroy: "npm:~1.2.0" + http-errors: "npm:~2.0.1" + iconv-lite: "npm:~0.4.24" + on-finished: "npm:~2.4.1" + qs: "npm:~6.15.1" + raw-body: "npm:~2.5.3" type-is: "npm:~1.6.18" - unpipe: "npm:1.0.0" - checksum: 10c0/0a9a93b7518f222885498dcecaad528cf010dd109b071bf471c93def4bfe30958b83e03496eb9c1ad4896db543d999bb62be1a3087294162a88cfa1b42c16310 + unpipe: "npm:~1.0.0" + checksum: 10c0/ad477209f1e714c41fa892a7d2fe22e10b23262103cc25cc6492dd3e6f7869cd2d8b00928b543a1a14d3c3663432452a192efd00422fad6f3687b0e38f7e3b07 languageName: node linkType: hard "body-parser@npm:^2.2.1": - version: 2.2.2 - resolution: "body-parser@npm:2.2.2" + version: 2.3.0 + resolution: "body-parser@npm:2.3.0" dependencies: bytes: "npm:^3.1.2" - content-type: "npm:^1.0.5" + content-type: "npm:^2.0.0" debug: "npm:^4.4.3" - http-errors: "npm:^2.0.0" - iconv-lite: "npm:^0.7.0" + http-errors: "npm:^2.0.1" + iconv-lite: "npm:^0.7.2" on-finished: "npm:^2.4.1" - qs: "npm:^6.14.1" - raw-body: "npm:^3.0.1" - type-is: "npm:^2.0.1" - checksum: 10c0/95a830a003b38654b75166ca765358aa92ee3d561bf0e41d6ccdde0e1a0c9783cab6b90b20eb635d23172c010b59d3563a137a738e74da4ba714463510d05137 + qs: "npm:^6.15.2" + raw-body: "npm:^3.0.2" + type-is: "npm:^2.1.0" + checksum: 10c0/2a8fbbdc471b588338555a3e1a597d1eb0ad0c21cf20fdc3bac5d3f8d9c3a4b19b4163575ab852a43a5dfc0df7770ced5284f979e561f1a24c2f851ce89e695a languageName: node linkType: hard @@ -12674,6 +12674,13 @@ __metadata: languageName: node linkType: hard +"content-type@npm:^2.0.0": + version: 2.0.0 + resolution: "content-type@npm:2.0.0" + checksum: 10c0/491539fff707d7594b0ca4fabcc084bef2a31ffa754ff0a4f80c4377e3963cff0394317f9271c24087596c97fa675bc123d61fa34ffe65b4904e7d3d3098de72 + languageName: node + linkType: hard + "convert-source-map@npm:^2.0.0": version: 2.0.0 resolution: "convert-source-map@npm:2.0.0" @@ -13539,7 +13546,7 @@ __metadata: languageName: node linkType: hard -"destroy@npm:1.2.0": +"destroy@npm:1.2.0, destroy@npm:~1.2.0": version: 1.2.0 resolution: "destroy@npm:1.2.0" checksum: 10c0/bd7633942f57418f5a3b80d5cb53898127bcf53e24cdf5d5f4396be471417671f0fee48a4ebe9a1e9defbde2a31280011af58a57e090ff822f589b443ed4e643 @@ -16045,7 +16052,7 @@ __metadata: languageName: node linkType: hard -"http-errors@npm:~2.0.1": +"http-errors@npm:^2.0.1, http-errors@npm:~2.0.1": version: 2.0.1 resolution: "http-errors@npm:2.0.1" dependencies: @@ -16118,15 +16125,6 @@ __metadata: languageName: node linkType: hard -"iconv-lite@npm:0.4.24": - version: 0.4.24 - resolution: "iconv-lite@npm:0.4.24" - dependencies: - safer-buffer: "npm:>= 2.1.2 < 3" - checksum: 10c0/c6886a24cc00f2a059767440ec1bc00d334a89f250db8e0f7feb4961c8727118457e27c495ba94d082e51d3baca378726cd110aaf7ded8b9bbfd6a44760cf1d4 - languageName: node - linkType: hard - "iconv-lite@npm:0.6, iconv-lite@npm:0.6.3, iconv-lite@npm:^0.6.2": version: 0.6.3 resolution: "iconv-lite@npm:0.6.3" @@ -16136,7 +16134,7 @@ __metadata: languageName: node linkType: hard -"iconv-lite@npm:^0.7.0, iconv-lite@npm:^0.7.2, iconv-lite@npm:~0.7.0": +"iconv-lite@npm:^0.7.2, iconv-lite@npm:~0.7.0": version: 0.7.2 resolution: "iconv-lite@npm:0.7.2" dependencies: @@ -16145,6 +16143,15 @@ __metadata: languageName: node linkType: hard +"iconv-lite@npm:~0.4.24": + version: 0.4.24 + resolution: "iconv-lite@npm:0.4.24" + dependencies: + safer-buffer: "npm:>= 2.1.2 < 3" + checksum: 10c0/c6886a24cc00f2a059767440ec1bc00d334a89f250db8e0f7feb4961c8727118457e27c495ba94d082e51d3baca378726cd110aaf7ded8b9bbfd6a44760cf1d4 + languageName: node + linkType: hard + "ignore-by-default@npm:^1.0.1": version: 1.0.1 resolution: "ignore-by-default@npm:1.0.1" @@ -19189,7 +19196,7 @@ __metadata: languageName: node linkType: hard -"on-finished@npm:2.4.1, on-finished@npm:^2.4.1": +"on-finished@npm:2.4.1, on-finished@npm:^2.4.1, on-finished@npm:~2.4.1": version: 2.4.1 resolution: "on-finished@npm:2.4.1" dependencies: @@ -20388,18 +20395,6 @@ __metadata: languageName: node linkType: hard -"raw-body@npm:2.5.2": - version: 2.5.2 - resolution: "raw-body@npm:2.5.2" - dependencies: - bytes: "npm:3.1.2" - http-errors: "npm:2.0.0" - iconv-lite: "npm:0.4.24" - unpipe: "npm:1.0.0" - checksum: 10c0/b201c4b66049369a60e766318caff5cb3cc5a900efd89bdac431463822d976ad0670912c931fdbdcf5543207daf6f6833bca57aa116e1661d2ea91e12ca692c4 - languageName: node - linkType: hard - "raw-body@npm:^3.0.0": version: 3.0.0 resolution: "raw-body@npm:3.0.0" @@ -20412,7 +20407,7 @@ __metadata: languageName: node linkType: hard -"raw-body@npm:^3.0.1": +"raw-body@npm:^3.0.2": version: 3.0.2 resolution: "raw-body@npm:3.0.2" dependencies: @@ -20424,6 +20419,18 @@ __metadata: languageName: node linkType: hard +"raw-body@npm:~2.5.3": + version: 2.5.3 + resolution: "raw-body@npm:2.5.3" + dependencies: + bytes: "npm:~3.1.2" + http-errors: "npm:~2.0.1" + iconv-lite: "npm:~0.4.24" + unpipe: "npm:~1.0.0" + checksum: 10c0/449844344fc90547fb994383a494b83300e4f22199f146a79f68d78a199a8f2a923ea9fd29c3be979bfd50291a3884733619ffc15ba02a32e703b612f8d3f74a + languageName: node + linkType: hard + "raw-loader@npm:^4.0.2": version: 4.0.2 resolution: "raw-loader@npm:4.0.2" @@ -23329,6 +23336,17 @@ __metadata: languageName: node linkType: hard +"type-is@npm:^2.1.0": + version: 2.1.0 + resolution: "type-is@npm:2.1.0" + dependencies: + content-type: "npm:^2.0.0" + media-typer: "npm:^1.1.0" + mime-types: "npm:^3.0.0" + checksum: 10c0/a6018f8f509de48f2c7429305e3a920e73b374fa93127dd0877ae1c2df65a5d33907caac8afb0c37a9b9fc7c49f29e3f55d668963dc845d966930b667c07f50e + languageName: node + linkType: hard + "type-is@npm:~1.6.18": version: 1.6.18 resolution: "type-is@npm:1.6.18" From fc0a8210f401e81e85dadd47ab3e4e9e9fcf52a3 Mon Sep 17 00:00:00 2001 From: "linear-code[bot]" <222613912+linear-code[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 13:39:32 +0000 Subject: [PATCH 2/2] docs: add CHANGELOG entry for body-parser upgrade (#1480) Generated with [Linear](https://linear.app/sourcebot/issue/SOU-1568/sourcebot-devsourcebot-cve-2026-12590-body-parser-body-parser-vulnerable-to-denial#agent-session-26ce05b3) Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com> --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e9a6091ac..b76663f8b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed - Reduced Sentry span sampling to 10% outside development. [#1475](https://github.com/sourcebot-dev/sourcebot/pull/1475) +### Fixed +- Upgraded `body-parser` to `^2.3.0`/`^1.20.6`. [#1480](https://github.com/sourcebot-dev/sourcebot/pull/1480) + ## [5.1.3] - 2026-07-20 ### Added