qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.15.0 to 6.17.1
9 releases in betweenevery note read
- 0
- changes to make
- 4
- advisories fixed
- 1
- new
- 3
- fixes
Security
Fixes 4 advisories affecting 6.15.0
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
- qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setmoderate · GHSA-q8mj-m7cp-5q26
- qs array-limit bypass via bracket-key comma parsingmoderate · GHSA-x5fp-wj9c-mxmx
Release by release
60 other lines we could not sort, mostly version bumps
- 6.17.1
parse:interpretNumericEntities: decode code points above U+FFFF as surrogate pairs - 6.17.1
parse: respectplainObjectsfor `` withparseArrays: false - 6.17.1
utils:merge: count the elements of a sparse array againstarrayLimit, not its holes - 6.17.1
parse: guard bracket-wrapped prototype keys at depth 0 - 6.17.1
parse: extract wrapping-bracket stripping helper - 6.17.1
Document that
depth: 0anddepth: falsekeep keys flat - 6.17.0
stringify: addWHATWGformat - 6.17.0
stringify: do not sort the caller'sfilterarray in place - 6.17.0
parse: copy an own__proto__key as data - 6.17.0
parse: decode percent-encoded dots case-insensitively
23 internal lines (docs, tests, tooling) left out.