[katsugtgz]

Updates body-parser to 1.20.9 in demos/embeddings to address GHSA-27r3-jxmh-p828 and GHSA-v422-hmwv-36x6.

Evidence:

• demos/embeddings/package-lock.json referenced body-parser 1.20.4 (transitive of express ~1.20.3)
• osv-scanner reported GHSA-27r3-jxmh-p828 and GHSA-v422-hmwv-36x6 for body-parser 1.20.4 before the update
• updated version: 1.20.9

Validation:

• osv-scanner no longer reports body-parser advisories after the update
• npm ci --dry-run resolves the updated lock cleanly

Scope: package-lock.json only, package.json ranges unchanged. The nested qs 6.16.1 entry and the side-channel 1.1.1 and side-channel-list 1.0.1 updates follow from body-parser 1.20.9 dependency ranges (standard npm resolution, no hand edits).

Note: osv-scanner still reports separate pre-existing advisories for qs 6.14.1 (GHSA-4mjr-xmp4-gh2g, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883). express pins qs ~6.14.0, so the root qs pin is untouched by this patch and those advisories need a separate change.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Fixed security issues:

• body-parser (link)

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[Copilot]

🟢 Approval recommended

The focused lockfile update satisfies the existing dependency ranges, with no blocking issues identified.

Copilot wasn't able to review any files in this pull request.

1 file not reviewed

• demos/embeddings/package-lock.json: Generated file

[ericcurtin]

Thanks! This is identical to #1094, which is now merged, so please close this one. model-runner is being deprecated in favour of https://github.com/llmmanorg/llmman, so please open PRs and issues there instead.

[Copilot]

🟢 Approval recommended

The scoped lockfile update satisfies the recorded dependency ranges, with no identified blocking issues.

Copilot wasn't able to review any files in this pull request.

1 file not reviewed

• demos/embeddings/package-lock.json: Generated file

[Copilot]

🟢 Approval recommended

The narrow lockfile update satisfies the recorded dependency constraints, with no blocking issues identified.

Copilot wasn't able to review any files in this pull request.

1 file not reviewed

• demos/embeddings/package-lock.json: Generated file

[ericcurtin]

Thanks! Already on main via #1094, so nothing left to merge. Setting to draft, please close. Please open PRs and issues at https://github.com/llmmanorg/llmman instead, as model-runner is being deprecated in favour of it.