Release: 1.20.4

[UlisesGascon]

What's included in the HISTORY.md

* Security fix for [GHSA-wqch-xfxh-vrr4](https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4)
* refactor: move common request validation to read function
* deps: 
  * type-is@^2.0.1
  * iconv-lite@^0.7.0
    * Handle split surrogate pairs when encoding UTF-8
    * Avoid false positives in `encodingExists` by using prototype-less objects 
  * raw-body@^3.0.1
  * debug@^4.4.3

What's Changed

• Remove redundant depth check by @blakeembrey in Remove redundant depth check #538
• ci: add support for Node.js v23 by @Phillip9587 in ci: add support for Node.js v23 #553

Full Changelog: 1.20.3...1.x

[Phillip9587]

@UlisesGascon This is not needed at least from the security perspective: https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4#advisory-comment-143780

[UlisesGascon]

Thanks for the update @Phillip9587!

[pwlnpro]

This needs to be reopened.

There is a disconnect between Repository Advisory, and Git Advisory.
Resources:

• GHSA-wqch-xfxh-vrr4
• GHSA-wqch-xfxh-vrr4

Repository advisory marks version 2.2.0 as Vulnerable.
Github advisory marks any version below 2.2.1 as Vulnerable.

Solutions:

• Fix advisory version on Github (if that is incorrect)
• Fix advisory version on Repository (if that is incorrect), and implement this PR.

Thanks!

Edit:
This is needed by everyone who still uses express@4xx. 1.20.3 is still the most used version, and is now marked vulnerable.

[bjohansebas]

Hey, the team has already been informed. The correct range is the one in GHSA-wqch-xfxh-vrr4, the only affected version was 2.2.0

[jonchurch]

We don't know how what we published was not what github propogated to the global registry, we have a PR open against their global registry to fix the affected version string to be exact.

github/advisory-database#6470
Thanks for your patience folks