qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.4.1 to 6.16.0
69 releases in betweenevery note read
- 0
- changes to make
- 2
- advisories fixed
- 17
- new
- 19
- fixes
Security
1 advisory still affects 6.16.0
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
Upgrading to 6.16.1 clears it.
Fixes 2 advisories affecting 6.4.1
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
Release by release
6.15.3 – 6.16.03 releases, nothing new or fixed in the notes
- fixed
Fix grammar
- fixed
6.14.3 – 6.15.13 releases, nothing new or fixed in the notes
- fixed
Avoid
.push, usevoid - fixed
Fix rebase workflow permissions
- fixed
- new
Add threat model
- new
Add workflow permissions
- fixed
Ensure
arrayLimitapplies to `` notation as well
- new
- fixed
Fix changelog formatting bug
- fixed
6.12.6 – 6.13.46 releases, nothing new or fixed in the notes
- fixed
Fix regressions from robustness refactor
- fixed
167 other lines we could not sort, mostly version bumps
- 6.16.0
stringify: add adepthoption to bound recursion depth (defaultInfinity) - 6.16.0
stringify: Serialize Date values when a filter is provided
- 6.16.0
parse: enforcearrayLimiton comma groups under=whenthrowOnLimitExceededis set - 6.16.0
parse: flatten a collection appended to an overflowed array - 6.16.0
utils:isBuffer: do not invoke a non-callableconstructor.isBuffer - 6.16.0
stringify: do not letallowEmptyArraysskip cycle detection (or drop own keys) on an empty array with own properties - 6.16.0
stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set - 6.16.0
Update
@ljharb/eslint-config,eslint - 6.16.0
Update
eslint,evalmd - 6.15.4
stringify: encode keys whenallowEmptyArraysis set
73 internal lines (docs, tests, tooling) left out.