[pkaminski]

Update Karma's transitive Body Parser from 1.20.1 to the verified security backport 1.20.9, preserving every package.json specification and the library version. The Corepack/Yarn 4 migration (#19) is merged; this PR targets reviewable-master and changes only yarn.lock.

Body Parser's advisory explicitly identifies 1.20.9 and 2.4.0 as fixing the same compressed-request denial of service. Karma's existing range requires the 1.x backport. All target occurrences are fixed: Body Parser is 1.20.9, Undici is already 8.12.3 in the migration baseline, and Markdown-it is absent. These are development dependencies; there are no unresolved target blockers.

Validation:

• Yarn 4.13.0 immutable install with resolution checks and refreshed registry metadata passed.
• Rollup build passed, with generated library files byte-identical to the baseline.
• All 27 newly selected package versions were checked against the five-day cooldown, allowing the explicitly requested Body Parser backport to bypass it.
• GitHub Actions passes: immutable installation, build, and all 32 browser tests. The migration baseline now fixes the missing contenteditable attribute in the browser-test fixtures; no assertions were removed and library code is unchanged. The existing rollup-plugin-sass peer warning remains.
• Native Yarn reconstruction from migration commit 1bf2704 reproduced the committed lockfile byte-for-byte.

Automated merge disposition

Subsequent outcome: @pkaminski merged this PR as d32f14c0b5bf562b5a76bc75b6e97ed3aa3980dd. The workflow run below failed before merging; native stacks still require asynchronous merge support in the automation.

Workflow outcome: run 40428664342 reconstructed the lockfile successfully, but GitHub rejected the merge: "Merging stacked PRs via this endpoint is not supported. Use the asynchronous merge endpoint instead." Migration #19 is merged and this PR targets the default branch, but GitHub still treats it as a native-stack PR. The workflow needs asynchronous merge support; this is not a dependency-validation failure.

The Corepack/Yarn migration #19 is merged, and this PR now targets the default branch. This security update changes only development dependency resolutions; direct versions remain compatible. Exact reconstruction passed with the deployed validator at b9d9784562684aca14ca7c64287d137abc6afabe from current default branch 0045204bc7335954f514f681a5cd2bcb0445c5c7 to head 0163f4926197d33754a0ae4688fab66f0342f4d1. Current CI passes, including all 32 browser tests.

Release follow-up: no library publication is required for this development-only lockfile change; the generated library output is unchanged.

schema: reviewable-dependency-updates/v1
lockfiles:
  "yarn.lock":
    "async-function@npm:^1.0.0": {from: null, to: "1.0.0"}
    "async-generator-function@npm:^1.0.0": {from: null, to: "1.0.0"}
    "body-parser@npm:^1.16.1": {from: "1.20.1", to: "1.20.9"}
    "bytes@npm:3.1.2": {from: "3.1.2", to: null}
    "bytes@npm:~3.1.2": {from: null, to: "3.1.2"}
    "call-bind-apply-helpers@npm:^1.0.1": {from: null, to: "1.0.2"}
    "call-bind-apply-helpers@npm:^1.0.2": {from: null, to: "1.0.2"}
    "call-bind@npm:^1.0.0": {from: "1.0.2", to: null}
    "call-bound@npm:^1.0.2": {from: null, to: "1.0.4"}
    "content-type@npm:~1.0.4": {from: "1.0.4", to: null}
    "content-type@npm:~1.0.5": {from: null, to: "1.0.5"}
    "depd@npm:~2.0.0": {from: null, to: "2.0.0"}
    "destroy@npm:1.2.0": {from: "1.2.0", to: null}
    "destroy@npm:~1.2.0": {from: null, to: "1.2.0"}
    "dunder-proto@npm:^1.0.1": {from: null, to: "1.0.1"}
    "es-define-property@npm:^1.0.1": {from: null, to: "1.0.1"}
    "es-errors@npm:^1.3.0": {from: null, to: "1.3.0"}
    "es-object-atoms@npm:^1.0.0": {from: null, to: "1.1.2"}
    "es-object-atoms@npm:^1.1.1": {from: null, to: "1.1.2"}
    "function-bind@npm:^1.1.2": {from: null, to: "1.1.2"}
    "generator-function@npm:^2.0.0": {from: null, to: "2.0.1"}
    "get-intrinsic@npm:^1.0.2": {from: "1.1.3", to: null}
    "get-intrinsic@npm:^1.2.5": {from: null, to: "1.3.1"}
    "get-intrinsic@npm:^1.3.0": {from: null, to: "1.3.1"}
    "get-proto@npm:^1.0.1": {from: null, to: "1.0.1"}
    "gopd@npm:^1.2.0": {from: null, to: "1.2.0"}
    "has-symbols@npm:^1.0.3": {from: "1.0.3", to: null}
    "has-symbols@npm:^1.1.0": {from: null, to: "1.1.0"}
    "hasown@npm:^2.0.2": {from: null, to: "2.0.4"}
    "http-errors@npm:2.0.0": {from: "2.0.0", to: null}
    "http-errors@npm:~2.0.1": {from: null, to: "2.0.1"}
    "iconv-lite@npm:0.4.24": {from: "0.4.24", to: null}
    "iconv-lite@npm:~0.4.24": {from: null, to: "0.4.24"}
    "inherits@npm:2.0.4": {from: "2.0.4", to: null}
    "inherits@npm:~2.0.4": {from: null, to: "2.0.4"}
    "math-intrinsics@npm:^1.1.0": {from: null, to: "1.1.0"}
    "object-inspect@npm:^1.13.3": {from: null, to: "1.13.4"}
    "object-inspect@npm:^1.13.4": {from: null, to: "1.13.4"}
    "object-inspect@npm:^1.9.0": {from: "1.12.2", to: null}
    "on-finished@npm:2.4.1": {from: "2.4.1", to: null}
    "on-finished@npm:~2.4.1": {from: null, to: "2.4.1"}
    "qs@npm:6.11.0": {from: "6.11.0", to: null}
    "qs@npm:~6.16.0": {from: null, to: "6.16.1"}
    "raw-body@npm:2.5.1": {from: "2.5.1", to: null}
    "raw-body@npm:~2.5.3": {from: null, to: "2.5.3"}
    "setprototypeof@npm:1.2.0": {from: "1.2.0", to: null}
    "setprototypeof@npm:~1.2.0": {from: null, to: "1.2.0"}
    "side-channel-list@npm:^1.0.1": {from: null, to: "1.0.1"}
    "side-channel-map@npm:^1.0.1": {from: null, to: "1.0.1"}
    "side-channel-weakmap@npm:^1.0.2": {from: null, to: "1.0.2"}
    "side-channel@npm:^1.0.4": {from: "1.0.4", to: null}
    "side-channel@npm:^1.1.1": {from: null, to: "1.1.1"}
    "statuses@npm:2.0.1": {from: "2.0.1", to: null}
    "statuses@npm:~2.0.2": {from: null, to: "2.0.2"}
    "toidentifier@npm:1.0.1": {from: "1.0.1", to: null}
    "toidentifier@npm:~1.0.1": {from: null, to: "1.0.1"}
    "unpipe@npm:1.0.0": {from: "1.0.0", to: null}

---

This change is 

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T00:47:12.978716Z	0163f49	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.