[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce?

Bug fix. This change upgrades body-parser and zod to patched releases.

Packages

• body-parser 2.3.0 -> 2.4.0
  • GHSA-27r3-jxmh-p828 / CVE-2026-111181 (High). A compressed request with trailing bytes can crash the process. body-parser 2.4.0 fixes this.
• zod 4.6.5 -> 4.6.7
  • GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404 (High). A large array, set, or map can exhaust memory. The fix starts in zod 4.6.6. This lockfile uses zod 4.6.7.

body-parser 2.4.0 also moves these dependencies:

• qs 6.15.3 -> 6.16.1. body-parser 2.4.0 requires qs ^6.16.1. express still uses qs 6.14.0. This move has no advisory in this change.
• content-type 2.1.0 is new for body-parser. content-type 2.0.0 stays for other packages. This move has no advisory in this change.
• raw-body now uses iconv-lite 0.7.3. That version was already in the lockfile. iconv-lite 0.7.0 is gone.

Why these versions

cacheable-request depends on body-parser. The specifier moves from ^2.3.0 to ^2.4.0.
express 5.2.1 accepts body-parser ^2.2.1. The lockfile now resolves 2.4.0 for express too. No override is required.

writr 6.1.6 accepts zod ^4.5.4. The ai packages accept zod ^3.25.76 or ^4.1.8. The lockfile now resolves zod 4.6.7. No override is required.

Release age

body-parser 2.4.0 was published on 2026-10-22. minimumReleaseAge is 10080 minutes, and strict mode is on. The install adds an exact exclude for body-parser@2.4.0.

Needs Jared's sign-off

zod 4.6.7 was published on 2026-10-12. That release is older than 7 days. The cooldown accepts it.

These packages stay on the current versions:

• markdown-it 15.0.2
• http-cache-semantics 4.2.0

Verification

• pnpm install --frozen-lockfile passed the supply-chain policy.
• pnpm build passed.
• node scripts/test-build.mjs passed.
• pnpm test:ci passed. Each package Biome check passed. Vitest passed with Redis and mock HTTP.

Test audit

This pull request does not add, change, or delete a test. The change is a dependency update. The current tests cover the public packages.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T14:27:30.600019Z	19f9139	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	body-parser@​2.3.0 ⏵ 2.4.0	+1	+16	+1

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (bfada02) to head (19f9139).

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #1748   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           29        29           
  Lines         3620      3620           
  Branches       811       811           
=========================================
  Hits          3620      3620           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.