qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.10.0 to 6.16.1
35 releases in betweenevery note read
- 0
- changes to make
- 5
- advisories fixed
- 5
- new
- 11
- fixes
Security
Fixes 5 advisories affecting 6.10.0
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
- qs's arrayLimit bypass in comma parsing allows denial of servicelow · GHSA-w7fw-mjwx-w883
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
- qs vulnerable to Prototype Pollutionhigh · GHSA-hrpp-h998-j3pp
Release by release
- fixed
Fix changelog indents
- fixed
6.15.3 – 6.16.03 releases, nothing new or fixed in the notes
- fixed
Fix grammar
- fixed
6.14.3 – 6.15.13 releases, nothing new or fixed in the notes
- fixed
Avoid
.push, usevoid - fixed
Fix rebase workflow permissions
- fixed
- new
Add threat model
- new
Add workflow permissions
- fixed
Ensure
arrayLimitapplies to `` notation as well
- new
- fixed
Fix changelog formatting bug
- fixed
6.12.6 – 6.13.46 releases, nothing new or fixed in the notes
114 other lines we could not sort, mostly version bumps
- 6.16.1
parse: do not mutate an object input - 6.16.1
stringify: stop re-encoding structural separator dots whenencodeDotInKeysis set - 6.16.1
stringify:arrayFormat: 'comma': pass the full encoder arguments withencodeValuesOnly - 6.16.1
utils: encode+as%2Bin iso-8859-1 mode so values round-trip - 6.16.1
parse: Only convert top-level dots to brackets when allowDots is on
- 6.16.1
stringify: ignore inherited array format names - 6.16.1
stringify:arrayFormat: 'comma': do not throw on elements with no callabletoString - 6.16.1
utils:merge: seed an overflow container's index from its own keys, not just the source - 6.16.1
utils:merge: keep astrictMergeconflict container's index andarrayLimitcorrect - 6.16.1
parse: only treat `` as array syntax when it ends the key
31 internal lines (docs, tests, tooling) left out.