getBody is not a function after installing Zen; check npm overrides forcing raw-body to v4

TL;DR: call. The firewall was innocent. The reporter's package.json had an

Fix

1. call. Expected: this specific failure stops.

2. Lesson: when an instrumenting library seems to break a transitive dependency, check your. Expected: this specific failure stops.

Details

The firewall was innocent. The reporter's package.json had an overrides section (added by an automated security-scan fix) forcing raw-body@<4.0.0 to 4.0.0 , which changed raw-body's export from a plain function to { __esModule, default, getRawBody, ... } and broke body-parser 2.3.0's require('raw-body') Removing the override restored raw-body 3.0.2 and everything worked. overrides / resolutions first. Forced major-version bumps on shared transitive deps (raw-body, qs, debug) break the libraries that consume them, and the blame lands on whatever was installed last.

When to use

You hit exactly this: getBody is not a function after installing Zen; check npm overrides forcing raw-body to v4 in getBody.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

getBody (versions mentioned here: 4.0.0, 2.3.0, 3.0.2).

Asked in GitHub issue gh:AikidoSec/firewall-node#1134: Issue AikidoSec/firewall-node#1134 (closed, 4 comments): installing @aikidosec/firewall caused TypeError: getBody is not a function on every POST request under Express 5 with body-parser 2.3.0. Looked like the firewall was breaking body parsing. The verified fix/answer: The firewall was innocent. The reporter's package.json had an overrides section (added by an automated security-scan fix) forcing raw-body@<4.0.0 to 4.0.0, which changed raw-body's export from a plain function to { __esModule, default, getRawBody, ... } and broke body-parser 2.3.0's require('raw-body') call. Removing the override restored raw-body 3.0.2 and everything worked. Lesson: when an instrumenting library seems to break a transitive dependency, check your overrides/resolutions first. Forced major-version bumps on shared transitive deps (raw-body, qs, debug) break the libraries that consume them, and the blame lands on whatever was installed last. Source: https://github.com/AikidoSec/firewall-node/issues/1134