Release Proposal 2.2.1

[Phillip9587]

What changed

• refactor: move common request validation to read function
• deps:
  • type-is@^2.0.1
  • iconv-lite@^0.7.0
  • raw-body@^3.0.1
  • debug@^4.4.3

---

Additionally, I’d like to include #642 to update debug to ^4.4.3 to force users to update from the compromised 4.4.2 version. Edit: #642 already merged

The critical change here is the iconv-lite update to 0.7.0, which addresses important issues.

A new release is needed to deduplicate iconv-lite in our dependency tree (see npmgraph). Currently, two versions of iconv-lite are being pulled in. Since iconv-lite is pre-1.0.0, semver treats ^0.6.3 like ~0.6.3 (it matches only 0.6.x), so it won’t float to 0.7.0. Releasing with iconv-lite@^0.7.0 lets npm dedupe our tree to a single 0.7.x.

[Phillip9587]

cc @UlisesGascon @jonchurch

[jonchurch]

I was paying special attention to the iconv-lite changes in 0.7.0. The changes are for utf8 encoding and body-parser is only using decode. So no impact 👍

This RC looks good to me @Phillip9587

I'll give some time for @UlisesGascon to chime in, but this looks good to me and we can publish it asap otherwise.

[Phillip9587]

We should include #648 to avoid potential performance regressions. It was missed in #600.

[bjohansebas]

The only change that affects body-parser is pillarjs/iconv-lite#328; the rest of the changes are not important for body-parser and its support.

[Phillip9587]

Hey @jonchurch @UlisesGascon, can we please merge #648 and publish the release?