Packages

qs

6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed

Upgrading qs from 2.4.2 to 6.17.1

107 releases in betweennotes for 30

Other targets from 2.4.2Clears its 4 advisories6.16.0
5.0.0, 4.0.0, 3.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below. The note of 6.0.0 lists no breaking change or deprecation, which is rare for a major.
?
changes to make
4
advisories fixed
13+
new
18+
fixes

Counted from 30 of 107 release notes. Advisories are counted from the advisory database, in full.

Security

Fixes 4 advisories affecting 2.4.2

Release by release

  1. 6.17.1nothing new or fixed in the note

  2. 6.17.0

    27 Oct 20261 new · 2 fixes
    • new

      Add changelog acknowledgement

    • fixed

      Fix indentation

    • fixed

      Fix changelog indents

  3. 6.15.3 – 6.16.25 releases, nothing new or fixed in the notes

  4. 6.15.2

    16 May 20261 fix
    • fixed

      Fix grammar

  5. 6.14.3 – 6.15.13 releases, nothing new or fixed in the notes

  6. 6.14.2

    11 Feb 20262 fixes
    • fixed

      Avoid .push, use void

    • fixed

      Fix rebase workflow permissions

  7. 6.14.1

    29 Dec 20252 new · 1 fix
    • new

      Add threat model

    • new

      Add workflow permissions

    • fixed

      Ensure arrayLimit applies to `` notation as well

  8. 6.14.0

    14 Jan 20251 fix
    • fixed

      Fix changelog formatting bug

144 other lines we could not sort, mostly version bumps

  • parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs

    6.17.1

  • parse: respect plainObjects for `` with parseArrays: false

    6.17.1

  • utils: merge: count the elements of a sparse array against arrayLimit, not its holes

    6.17.1

  • parse: guard bracket-wrapped prototype keys at depth 0

    6.17.1

  • parse: extract wrapping-bracket stripping helper

    6.17.1

  • Document that depth: 0 and depth: false keep keys flat

    6.17.1

  • stringify: add WHATWG format

    6.17.0

  • stringify: do not sort the caller's filter array in place

    6.17.0

  • parse: copy an own __proto__ key as data

    6.17.0

  • parse: decode percent-encoded dots case-insensitively

    6.17.0

56 internal lines (docs, tests, tooling) left out.