Well done!
Is there going to be a new release (5.2.2?) with this dependency fix? 😁

@sergio-tao
Good question!
Actually, everything about this is covered in PR #6969 — you can check the details there.

Hello! Is there a 4.x release planned that will include this fix soon? Thanks!

Could we please have a patch version for express containing this?

@serhalp @jaenster
Speaking for myself, I'm not currently planning a patch release specifically for this.

A fresh npm install already resolves to secure versions, and a patch release wouldn't change your remediation steps or silence Dependabot alerts. You'd still need to update your lockfile either way.

To update: npm update qs body-parser

(The body-parser update may not be needed depending on your version, but older versions of body-parser had qs pinned so it's good to include.)

It occurs to me though that I may be too used to managing dependencies this way to understand why others want to solve it with a patch release. Why do you ask for a patch release? Is there something causing you pain here that a patch would solve? Tooling yelling at you?