Update body-parser dependency in https://github.com/expressjs/express/tree/4.x/ to `1.20.4`

[paulchen5]

Currently at 1.20.3 containing malicious qs module version

[krzysdz]

It may be worth changing it, because it will force npm install express@4 in an existing install to update dependencies, which people seem to have trouble with (#6972 (comment)).

Small clarification - qs < 16.4.1 is not malicious, but vulnerable (or at least marked as such, the exact status is complicated).

[paulchen5]

is not malicious, but vulnerable

yeah sorry, didn't get the word into my head I typed it 😅

[paulchen5]

It may be worth changing it, because it will force npm install express@4 in an existing install to update dependencies, which people seem to have trouble with (#6972 (comment)).

Small clarification - qs < 16.4.1 is not malicious, but vulnerable (or at least marked as such, the exact status is complicated).

That's basically my problem. I am using a dependency which is using expres which is using body-parser which is using qs

[suuuuuuminnnnnn]

Hi! I’d like to work on this. I’ll prepare a PR that updates the 4.x dependency to the requested version and add/adjust tests if needed.

[GroophyLifefor]

Issue was resolved by #7021