Bump body-parser in /samples/demo

[dependabot]

Bumps and body-parser. These dependencies needed to be updated together.
Updates body-parser from 1.20.5 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• fix: improve limit option validation by @​Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

• Security fix for GHSA-v422-hmwv-36x6
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit

Commits

• 5cc4fb8 1.20.6 (#746)
• 3492672 fix: improve limit option validation (#741)
• See full diff in compare view

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• fix: improve limit option validation by @​Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

• Security fix for GHSA-v422-hmwv-36x6
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit

Commits

• 5cc4fb8 1.20.6 (#746)
• 3492672 fix: improve limit option validation (#741)
• See full diff in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/body-parser	1.20.6	🟢 8	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 19 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 12/15 approved changesets -- score normalized to 8 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Packaging ⚠️ -1 packaging workflow not detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST 🟢 9 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected CI-Tests 🟢 9 29 out of 30 merged PRs checked by a CI test -- score normalized to 9 Contributors 🟢 10 project has 32 contributing companies or organizations
npm/body-parser	2.3.0	🟢 8	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 19 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 8 Found 12/15 approved changesets -- score normalized to 8 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Packaging ⚠️ -1 packaging workflow not detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST 🟢 9 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected CI-Tests 🟢 9 29 out of 30 merged PRs checked by a CI test -- score normalized to 9 Contributors 🟢 10 project has 32 contributing companies or organizations
npm/content-type	2.0.0	🟢 6.3	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 2 1 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 2 Code-Review 🟢 4 Found 14/30 approved changesets -- score normalized to 4 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 3 dependency not pinned by hash detected -- score normalized to 3 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 8 SAST tool detected but not run on all commits
npm/qs	6.15.3	🟢 5.4	Details Check Score Reason Code-Review ⚠️ 2 Found 7/30 approved changesets -- score normalized to 2 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 21 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices 🟢 5 badge detected: Passing Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/side-channel	1.1.1	🟢 4.4	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 SAST ⚠️ 0 no SAST tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 5 5 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected
npm/side-channel-list	1.0.1	Unknown	Unknown
npm/type-is	2.1.0	🟢 6.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 Code-Review 🟢 7 Found 9/12 approved changesets -- score normalized to 7 Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 5 3 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 5 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found SAST 🟢 7 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed Dependency-Update-Tool 🟢 10 update tool detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 9 security policy file detected CI-Tests 🟢 4 10 out of 23 merged PRs checked by a CI test -- score normalized to 4 Contributors 🟢 10 project has 25 contributing companies or organizations

Scanned Files

• samples/demo/package-lock.json

[lakshmimsft]

@dependabot recreate