diff --git a/js/flow/package.json b/js/flow/package.json
index 4025609852..1895f67bd8 100644
--- a/js/flow/package.json
+++ b/js/flow/package.json
@@ -30,7 +30,7 @@
     "@google-cloud/firestore": "^7.6.0",
     "@opentelemetry/api": "^1.9.0",
     "@types/cors": "^2.8.17",
-    "body-parser": "^1.20.2",
+    "body-parser": "^1.20.3",
     "cors": "^2.8.5",
     "express": "^4.21.0",
     "firebase-admin": "^12.1.0",
diff --git a/js/pnpm-lock.yaml b/js/pnpm-lock.yaml
index c6b897d9d0..5039874f43 100644
--- a/js/pnpm-lock.yaml
+++ b/js/pnpm-lock.yaml
@@ -134,8 +134,8 @@ importers:
         specifier: ^2.8.17
         version: 2.8.17
       body-parser:
-        specifier: ^1.20.2
-        version: 1.20.2
+        specifier: ^1.20.3
+        version: 1.20.3
       cors:
         specifier: ^2.8.5
         version: 2.8.5
@@ -4657,10 +4657,6 @@ packages:
     resolution: {integrity: sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==}
     engines: {node: '>=0.6'}
 
-  qs@6.12.0:
-    resolution: {integrity: sha512-trVZiI6RMOkO476zLGaBIzszOdFPnCCXHPG9kn0yuS1uz6xdVxPfZdB3vUig9pxPFDM9BRAgz/YUIVQ1/vuiUg==}
-    engines: {node: '>=0.6'}
-
   qs@6.13.0:
     resolution: {integrity: sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==}
     engines: {node: '>=0.6'}
@@ -7707,7 +7703,7 @@ snapshots:
       extend: 3.0.2
       gaxios: 6.3.0(encoding@0.1.13)
       google-auth-library: 9.14.1(encoding@0.1.13)
-      qs: 6.12.0
+      qs: 6.13.0
       url-template: 2.0.8
       uuid: 9.0.1
     transitivePeerDependencies:
@@ -8696,10 +8692,6 @@ snapshots:
     dependencies:
       side-channel: 1.0.6
 
-  qs@6.12.0:
-    dependencies:
-      side-channel: 1.0.6
-
   qs@6.13.0:
     dependencies:
       side-channel: 1.0.6