qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 2.4.2 to 3.0.0
1 release in betweenevery note read
The note of 3.0.0 lists no breaking change or deprecation, which is rare for a major.
- ?
- changes to make
- 0
- advisories fixed
- 0
- new
- 0
- fixes
Security
4 advisories still affect 3.0.0
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
- Prototype Pollution Protection Bypass in qshigh · GHSA-gqgv-6jq5-jjj9
- qs vulnerable to Prototype Pollutionhigh · GHSA-hrpp-h998-j3pp
Upgrading to 6.16.0 clears them.
10 other lines we could not sort, mostly version bumps
- 3.0.0
#80 qs.parse silently drops properties
- 3.0.0
#77 Perf boost
- 3.0.0
#60 Add explicit option to disable array parsing
- 3.0.0
#74 Bad parse when turning array into object
- 3.0.0
#81 Add a
filteroption - 3.0.0
#68 Fixed issue with recursion and passing strings into objects.
- 3.0.0
#66 Add mixed array and object dot notation support Closes
- 3.0.0
#76 RFC 3986
- 3.0.0
#85 No equal sign
- 3.0.0
#84 update license attribute