qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.14.2 to 6.17.1
11 releases in betweenevery note read
- 0
- changes to make
- 4
- advisories fixed
- 1
- new
- 3
- fixes
Security
Fixes 4 advisories affecting 6.14.2
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
- qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setmoderate · GHSA-q8mj-m7cp-5q26
- qs array-limit bypass via bracket-key comma parsingmoderate · GHSA-x5fp-wj9c-mxmx
Release by release
6.17.1nothing new or fixed in the note
- new
Add changelog acknowledgement
- fixed
Fix indentation
- fixed
Fix changelog indents
- new
6.15.3 – 6.16.25 releases, nothing new or fixed in the notes
- fixed
Fix grammar
- fixed
6.14.3 – 6.15.13 releases, nothing new or fixed in the notes
63 other lines we could not sort, mostly version bumps
- 6.17.1
parse:interpretNumericEntities: decode code points above U+FFFF as surrogate pairs - 6.17.1
parse: respectplainObjectsfor `` withparseArrays: false - 6.17.1
utils:merge: count the elements of a sparse array againstarrayLimit, not its holes - 6.17.1
parse: guard bracket-wrapped prototype keys at depth 0 - 6.17.1
parse: extract wrapping-bracket stripping helper - 6.17.1
Document that
depth: 0anddepth: falsekeep keys flat - 6.17.0
stringify: addWHATWGformat - 6.17.0
stringify: do not sort the caller'sfilterarray in place - 6.17.0
parse: copy an own__proto__key as data - 6.17.0
parse: decode percent-encoded dots case-insensitively
24 internal lines (docs, tests, tooling) left out.