[Eugene (OEvgeny)]

Clears Dependabot alerts #2554 (GHSA-27r3-jxmh-p828, high) and #2387 (GHSA-v422-hmwv-36x6, low): the lockfile resolves body-parser@2.2.1.

Changelog Entry

Changed

• 👷🏻 Test servers: bumped body-parser@2.4.0, clearing 2 security alerts, in PR #6026, by @OEvgeny

Description

body-parser comes only from express@5.2.1 in the private test-harness and test-web-server packages, which mount no body parser. npm update body-parser moves it to 2.4.0, which express's ^2.2.1 already allows, so no package.json changes.

Design

• Lockfile only, instead of bumping express to 5.3.0 in 2 package.json files or adding overrides.
• minimatch (GHSA-g3hv-75wg-m249) is not part of this PR: it is only patched in 11.x, a rewrite that glob@10 (used by test-exclude and cldr-data) cannot use, as it no longer returns RegExp parts.

Specific Changes

• package-lock.json: body-parser 2.2.1 → 2.4.0, its iconv-lite 0.7.2 → 0.7.3, type-is 2.0.1 → 2.1.0, and content-type@2.1.0 nested under both

• I have added tests and executed them locally

• I have added .changelog/<PR#>-<slug>.md

• I have updated documentation

Review Checklist

This section is for contributors to review your work.

• Accessibility reviewed (tab order, content readability, alt text, color contrast)
• Browser and platform compatibilities reviewed
• CSS styles reviewed (minimal rules, no z-index)
• Documents reviewed (docs, samples, live demo)
• Internationalization reviewed (strings, unit formatting)
• package.json and package-lock.json reviewed
• Security reviewed (no data URIs, check for nonce leak)
• Tests reviewed (coverage, legitimacy)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.