qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 4.0.0 to 6.16.0
100 releases in betweennotes for 26
- ?
- changes to make
- 4
- advisories fixed
- 12+
- new
- 16+
- fixes
Counted from 26 of 100 release notes. Advisories are counted from the advisory database, in full.
Security
1 advisory still affects 6.16.0
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
Upgrading to 6.16.1 clears it.
Fixes 4 advisories affecting 4.0.0
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
- Prototype Pollution Protection Bypass in qshigh · GHSA-gqgv-6jq5-jjj9
- qs vulnerable to Prototype Pollutionhigh · GHSA-hrpp-h998-j3pp
Release by release
6.15.3 – 6.16.03 releases, nothing new or fixed in the notes
- fixed
Fix grammar
- fixed
6.14.3 – 6.15.13 releases, nothing new or fixed in the notes
- fixed
Avoid
.push, usevoid - fixed
Fix rebase workflow permissions
- fixed
- new
Add threat model
- new
Add workflow permissions
- fixed
Ensure
arrayLimitapplies to `` notation as well
- new
- fixed
Fix changelog formatting bug
- fixed
6.12.1 – 6.13.411 releases, nothing new or fixed; 8 without a note
- new
Add
sideEffectsflag - fixed
Fix line wrapping
- new
112 other lines we could not sort, mostly version bumps
- 6.16.0
stringify: add adepthoption to bound recursion depth (defaultInfinity) - 6.16.0
stringify: Serialize Date values when a filter is provided
- 6.16.0
parse: enforcearrayLimiton comma groups under=whenthrowOnLimitExceededis set - 6.16.0
parse: flatten a collection appended to an overflowed array - 6.16.0
utils:isBuffer: do not invoke a non-callableconstructor.isBuffer - 6.16.0
stringify: do not letallowEmptyArraysskip cycle detection (or drop own keys) on an empty array with own properties - 6.16.0
stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set - 6.16.0
Update
@ljharb/eslint-config,eslint - 6.16.0
Update
eslint,evalmd - 6.15.4
stringify: encode keys whenallowEmptyArraysis set
41 internal lines (docs, tests, tooling) left out.