Update body-parser to latest version 1.18.3

[amitzur]

The implication of this change (other than getting the changes in [email protected]) is smaller footprint in node_modules for projects which also require body-parser from its latest version.
Currently such projects will have 2 copies of body-parser.

[dougwilson]

Thanks! The original plan was to hold this for the next minor version of Express because we were going to use that to align around safer-buffer so we can not have both safe-buffer and safer-buffer in the tree.

As per your project issue, of course ideally you shouldn't need to depend on body-parser at all, since it's already bundled with Express. If you really need to, pinning it to the same Express version you're using would of course deduplicate as well.

[amitzur]

How do I use the body-parser version that's bundled with express ?
I thought this line was aimed to block it:

express/lib/express.js

Line 108 in c0136d8

throw new Error('Most middleware (like ' + name + ') is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');

[dougwilson]

It shouldn't be blocking body-parser usage, otherwise if we were blocking it, we wouldn't have a dependency on it at all. Can you demonstrate the code you are using?

Here is some docs on expressjs.com:

http://expressjs.com/en/4x/api.html#express.json
http://expressjs.com/en/4x/api.html#express.urlencoded

[amitzur]

I wanted to use express.raw but it's not available. Here's my code:

const bodyParser = require('body-parser');
...
app.put('/some-path', bodyParser.raw({type: '*/*', limit: '100mb'}), async (req, res) => {
...

[dougwilson]

Ah. I think the not exposing of raw may have just been an oversight.

[amitzur]

Thanks @dougwilson! I've opened #3708 to have raw available.
Can you shed more light on the safe-buffer/safer-buffer story?
And also when is the next minor version planned?