qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.15.4 to 6.16.1
2 releases in betweenevery note read
- 0
- changes to make
- 3
- advisories fixed
- 0
- new
- 1
- fix
Security
Fixes 3 advisories affecting 6.15.4
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
- qs array-limit bypass via bracket-key comma parsingmoderate · GHSA-x5fp-wj9c-mxmx
Release by release
- fixed
Fix changelog indents
- fixed
6.16.0nothing new or fixed in the note
24 other lines we could not sort, mostly version bumps
- 6.16.1
parse: do not mutate an object input - 6.16.1
stringify: stop re-encoding structural separator dots whenencodeDotInKeysis set - 6.16.1
stringify:arrayFormat: 'comma': pass the full encoder arguments withencodeValuesOnly - 6.16.1
utils: encode+as%2Bin iso-8859-1 mode so values round-trip - 6.16.1
parse: Only convert top-level dots to brackets when allowDots is on
- 6.16.1
stringify: ignore inherited array format names - 6.16.1
stringify:arrayFormat: 'comma': do not throw on elements with no callabletoString - 6.16.1
utils:merge: seed an overflow container's index from its own keys, not just the source - 6.16.1
utils:merge: keep astrictMergeconflict container's index andarrayLimitcorrect - 6.16.1
parse: only treat `` as array syntax when it ends the key
10 internal lines (docs, tests, tooling) left out.