qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.2.3 to 6.2.4
1 release in betweenevery note read
- 0
- changes to make
- 1
- advisory fixed
- 1
- new
- 1
- fix
Security
2 advisories still affect 6.2.4
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
Upgrading to 6.16.0 clears them.
Fixes 1 advisory affecting 6.2.3
- qs vulnerable to Prototype Pollutionhigh · GHSA-hrpp-h998-j3pp
Release by release
- new
Add FUNDING.yml
- fixed
Fix README.md
- new
10 other lines we could not sort, mostly version bumps
- 6.2.4
parse: ignore__proto__keys - 6.2.4
utils.merge: avoid a crash with a null target and an array source - 6.2.4
utils.merge: avoid a crash with a null target and a truthy non-array source - 6.2.4
utils:merge: fix crash whensourceis a truthy primitive & no options are provided - 6.2.4
When
parseArraysis false, properly handle keys ending in `` - 6.2.4
stringify: avoid relying on a globalundefined - 6.2.4
Use cached
Array.isArray - 6.2.4
Clean up license text so it’s properly detected as BSD-3-Clause
- 6.2.4
Backport actions from main
- 6.2.4
Backport from main
3 internal lines (docs, tests, tooling) left out.