[zahin-mohammad]

Description

Upgrade body-parser from 1.20.6 to the patched 1.20.9 release through the root Yarn resolution, npm override, and lockfile.

This remediates GHSA-27r3-jxmh-p828 / CVE-2026-111181. The vulnerable HTTP request-body middleware can terminate the process when a compressed request contains trailing bytes.

Issue

WCN-3811

Type of change

• Bug fix: non-breaking dependency security update

Verification

• Frozen Yarn install passed.
• yarn check-deps passed.
• The upstream malformed-gzip reproduction returned HTTP 200 and the process remained alive with body-parser@1.20.9.
• All 1,978 BitGo Express unit tests passed on Node.js 24.22.1.
• OSV Scanner 2.3.8 found 42 advisory groups after configured exclusions and zero groups at or above the release-blocking CVSS 7.0 threshold.
• git diff --check passed.

Release impact

This removes the only advisory currently at or above the BitGoJS beta release threshold. The remaining 42 OSV advisory groups are below CVSS 7.0 and do not block the release gate.

[linear-code]

WCN-3811

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[zahin-mohammad]

@claude review

[github-actions]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

• 🟡 yarn.lock — Running a plain yarn install after merging will rewrite yarn.lock, because the qs entry still lists the old body-parser range and not the new one. body-parser now requires qs "~6.16.0" (yarn.lock:8154). The qs key at yarn.lock:17539 still lists qs@~6.15.1 and has no qs@~6.16.0. Nothing else in the lockfile requests ~6.15.1. Fix: regenerate the lockfile with yarn install so the key swaps qs@~6.15.1 for qs@~6.16.0 and still resolves to 6.16.0. Then commit the result.

  Why this was flagged

  In yarn.lock:8154, the body-parser 1.20.9 entry declares qs "~6.16.0". The only qs entry key, at yarn.lock:17539, lists qs@~6.15.1 and has no qs@~6.16.0 pattern. A grep shows no other entry depends on qs "~6.15.1", so that pattern is now orphaned and the new one is missing. The root resolutions pin "qs": "6.16.0" (package.json:69) is why the resolved version is still right. Yarn 1.22.22 (packageManager) still records the requested pattern in the entry key, so the key is stale. A developer running yarn install gets an unexpected yarn.lock diff that the base branch does not produce. CI jobs that run --frozen-lockfile / --with-frozen-lockfile (ci.yml:112, npmjs-release.yml:267) may fail with yarn's lockfile-outdated error. That depends on how yarn's frozen check treats a nested pattern rewritten by a resolution. The PR says a frozen install passed, but the lockfile is still not what yarn would generate.

  Verification: The trigger is any developer running the plain yarn install that CLAUDE.md documents. The diff changes the body-parser entry's dependency to qs "~6.16.0" (yarn.lock:8154), but it leaves the only qs entry key unchanged (yarn.lock:17539). CI uses yarn install --with-frozen-lockfile (.github/workflows/ci.yml:112), so CI does not catch this. Nothing breaks at runtime.