getBody is not a function after installing Zen; check npm overrides forcing raw-body to v4

The firewall was innocent. The reporter's package.json had an overrides section (added by an automated security-scan fix) forcing raw-body@<4.0.0 to 4.0.0, which changed raw-body's export from a plain function to { __esModule, default, getRawBody, ... } and broke body-parser 2.3.0's require('raw-body') call. Removing the override restored raw-body 3.0.2 and everything worked. Lesson: when an instrumenting library seems to break a transitive dependency, check your overrides/resolutions first. Forced major-version bumps on shared transitive deps (raw-body, qs, debug) break the libraries that consume them, and the blame lands on whatever was installed last.

Asked in GitHub issue gh:AikidoSec/firewall-node#1134: Issue AikidoSec/firewall-node#1134 (closed, 4 comments): installing @aikidosec/firewall caused TypeError: getBody is not a function on every POST request under Express 5 with body-parser 2.3.0. Looked like the firewall was breaking body parsing. The verified fix/answer: The firewall was innocent. The reporter's package.json had an overrides section (added by an automated security-scan fix) forcing raw-body@<4.0.0 to 4.0.0, which changed raw-body's export from a plain function to { __esModule, default, getRawBody, ... } and broke body-parser 2.3.0's require('raw-body') call. Removing the override restored raw-body 3.0.2 and everything worked. Lesson: when an instrumenting library seems to break a transitive dependency, check your overrides/resolutions first. Forced major-version bumps on shared transitive deps (raw-body, qs, debug) break the libraries that consume them, and the blame lands on whatever was installed last. Source: https://github.com/AikidoSec/firewall-node/issues/1134