Important: Security

• Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #737
• chore: group github actions updates by @Phillip9587 in #743
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #745
• test: fix 'presist' typo in test descriptions by @maxtaran2010 in #749
• docs: include security fix in 2.3.0 changes by @UlisesGascon in #748
• fix: avoid mutating read options when reading body by @Phillip9587 in #742
• refactor: move getCharset helper to only usage by @Phillip9587 in #707
• build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in #753
• refactor: switch to neostandard by @Phillip9587 in #751
• perf(json): avoid first-char regex for direct JSON bodies by @Phillip9587 in #744
• docs: fix entity verify error description by @Rawal27 in #755
• feat: zstandard support by @Phillip9587 in #586
• test: remove unused experimentalZstd option by @Phillip9587 in #757
• ci: run tests on windows and macos matrix by @kilisamemarisaaa in #759
• deps: qs@^6.16.0 by @krzysdz in #762
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #763
• ci: trigger npm publish on release published and set dist-tag by @UlisesGascon in #768
• build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #771
• fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @saadkhantareen in #773
• perf: inline content stream setup by @Phillip9587 in #750
• docs: note that req.body may be undefined in v2 by @Hashim1999164 in #752
• docs: fix strict option description by @Rawal27 in #756
• docs: fix depth error description by @johnnyhuirilef in #776
• chore: update dependencies by @Phillip9587 in #778
• Release: 2.4.0 by @UlisesGascon in #777

New Contributors

• @maxtaran2010 made their first contribution in #749
• @Rawal27 made their first contribution in #755
• @kilisamemarisaaa made their first contribution in #759
• @saadkhantareen made their first contribution in #773
• @Hashim1999164 made their first contribution in #752
• @johnnyhuirilef made their first contribution in #776

Full Changelog: v2.3.0...v2.4.0

Important: Security

• Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

• Release: 1.20.9 by @UlisesGascon in #779

Full Changelog: 1.20.8...1.20.9

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

• ci: backport npm-publish workflow from master by @UlisesGascon in #769
• 1.20.8 by @UlisesGascon in #770

Full Changelog: 1.20.7...1.20.8

What's Changed

• docs: include security fix in 1.20.6 changes by @UlisesGascon in #747
• deps: qs@~6.16.0 by @krzysdz in #761
• 1.20.7 by @UlisesGascon in #767

Full Changelog: 1.20.6...1.20.7

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• fix: improve limit option validation by @Phillip9587 in #741

Full Changelog: 1.20.5...1.20.6

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #681
• build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by @dependabot[bot] in #682
• build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in #683
• build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #685
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by @dependabot[bot] in #684
• perf(urlencoded): move empty-body guard to avoid extra function closure by @Phillip9587 in #647
• Improve ESM compatibility by @Phillip9587 in #697
• docs: add recommendations for configuring payload limits by @bjohansebas in #699
• build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in #701
• build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by @dependabot[bot] in #702
• build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #700
• chore: add explicit type commonjs to package.json by @Phillip9587 in #711
• deps: update dependencies to latest versions by @Phillip9587 in #708
• build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in #712
• build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in #713
• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #714
• fix: improve limit option validation by @Phillip9587 in #698
• build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in #719
• build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in #718
• build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in #717
• perf: eliminate conditional check in json strict mode hot path by @Phillip9587 in #651
• ci: add node.js 26 to text matrix by @Phillip9587 in #726
• build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in #725
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #724
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in #723
• Upgrade "content-type" by @blakeembrey in #728
• refactor: switch to const/let and enable eslint no-var rule by @Phillip9587 in #729
• Update outdated reference to MDN docs by @krzysdz in #730
• build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @dependabot[bot] in #731
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #732
• chore: updated deps to latest by @Phillip9587 in #733
• 2.3.0 by @UlisesGascon in #735

New Contributors

• @krzysdz made their first contribution in #730

Full Changelog: v2.2.2...v2.3.0

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (#716)

• refactor(json): simplify strict mode error string construction by @jonchurch in #692
• fix: correct off-by-one error in parameterCount by @abhu85 in #716
• deps(qs): bump qs to 6.15.1 by @jonchurch in #722
• Release: 1.20.5 by @jonchurch in #721

New Contributors

• @abhu85 made their first contribution in #716

Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: 1.20.4...1.20.5

What's Changed

• docs: update README links by @efekrskl in #673
• docs: release notes for the v1.20.4 release by @Phillip9587 in #674
• docs: update URL-encoded parser description to include ISO-8859-1 encoding support by @Phillip9587 in #679
• docs: use standard jsdoc tags everywhere by @Phillip9587 in #677
• deps: qs@^6.14.1 by @UlisesGascon in #689
• refactor(json): simplify strict mode error string construction by @jonchurch in #693
• Release: 2.2.2 by @UlisesGascon in #691

New Contributors

• @efekrskl made their first contribution in #673

Full Changelog: v2.2.1...v2.2.2

What's Changed

• Remove redundant depth check by @blakeembrey in #538
• ci: add support for Node.js v23 by @Phillip9587 in #553
• ci: restore CI for 1.x branch by @bjohansebas in #665
• deps: qs@^6.14.0 by @bjohansebas in #664
• deps: use tilde notation and update certain dependencies by @Phillip9587 in #668
• chore: remove SECURITY.md by @Phillip9587 in #669
• ci: add CodeQL (SAST) by @Phillip9587 in #670
• Release: 1.20.4 by @UlisesGascon in #672

Full Changelog: 1.20.3...1.20.4

Important: Security

• Security fix for CVE-2025-13466 (GHSA-wqch-xfxh-vrr4)

What's Changed

• ci: add dependabot by @Phillip9587 in #593
• ci: use full SHAs for github action versions by @Phillip9587 in #594
• deps: type-is@^2.0.1 by @Phillip9587 in #599
• build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by @dependabot[bot] in #609
• build(deps): bump github/codeql-action from 3.28.13 to 3.28.15 by @dependabot[bot] in #610
• build(deps-dev): bump eslint-plugin-promise from 6.1.1 to 6.6.0 by @dependabot[bot] in #611
• build(deps-dev): bump eslint-plugin-import from 2.27.5 to 2.31.0 by @dependabot[bot] in #613
• build(deps-dev): bump eslint-plugin-markdown from 3.0.0 to 3.0.1 by @dependabot[bot] in #612
• ci: add codeql github workflows scanning by @Phillip9587 in #614
• ci: update CodeQL config to ignore the test directory by @Phillip9587 in #615
• build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @dependabot[bot] in #620
• build(deps): bump github/codeql-action from 3.28.15 to 3.28.16 by @dependabot[bot] in #619
• chore(deps): unpin devDependencies by @Phillip9587 in #616
• ci: add node.js 24 to test matrix by @Phillip9587 in #621
• build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by @dependabot[bot] in #623
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #624
• chore: add funding to package.json by @Phillip9587 in #617
• build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @dependabot[bot] in #625
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in #630
• refactor: move common request validation to read function by @Phillip9587 in #600
• deps: bump iconv-lite by @bjohansebas in #631
• doc: pull beta changelog forward into 2.0.0 by @jonchurch in #629
• refactor: optimize raw and text parsers with shared passthrough function by @Phillip9587 in #634
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #640
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #639
• build(deps): bump actions/setup-node from 4.4.0 to 5.0.0 by @dependabot[bot] in #636
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #637
• build(deps): bump github/codeql-action from 3.29.7 to 3.30.5 by @dependabot[bot] in #638
• deps: raw-body@^3.0.1 by @Phillip9587 in #641
• deps: debug@^4.4.3 by @Phillip9587 in #642
• docs: add iconv-lite 0.7.0 changes to history entry by @Phillip9587 in #645
• ci: add node.js 25 to test matrix by @Phillip9587 in #650
• perf: move read options outside parser middlewares by @Phillip9587 in #648
• test(json): add RFC 7159 whitespace edge cases by @Ayoub-Mabrouk in #653
• test: add test for urlencoded invalid defaultCharset by @Phillip9587 in #643
• build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #657
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in #656
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #655
• build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #654
• ci: also test on first supported node.js version by @Phillip9587 in #646
• chore: switch badges from badgen.net to shields.io by @Phillip9587 in #661
• Remove history.md from being packaged on publish by @bjohansebas in #660
• Release: 2.2.1 by @UlisesGascon in #659

New Contributors

• @dependabot[bot] made their first contribution in #609
• @jonchurch made their first contribution in #629
• @Ayoub-Mabrouk made their first contribution in #653

Full Changelog: v2.2.0...v2.2.1