qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.5.5 to 6.6.0
1 release in betweenevery note read
- 0
- changes to make
- 0
- advisories fixed
- 2
- new
- 0
- fixes
Security
3 advisories still affect 6.6.0
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
- qs vulnerable to Prototype Pollutionhigh · GHSA-hrpp-h998-j3pp
Upgrading to 6.16.0 clears them.
Release by release
- new
Add support for iso-8859-1, utf8 "sentinel" and numeric entities
- new
Add missing defaults
- new
11 other lines we could not sort, mostly version bumps
- 6.6.0
Move two-value combine to a
utilsfunction - 6.6.0
stringify: fix a crash withstrictNullHandlingand a customfilter/serializeDate - 6.6.0
When
parseArraysis false, properly handle keys ending in `` - 6.6.0
stringify: do not crash in an obscure combo ofinterpretNumericEntities, a bad customdecoder, &iso-8859-1 - 6.6.0
utils:merge: fix crash whensourceis a truthy primitive & no options are provided - 6.6.0
stringify: Avoid arr = arr.concat(...), push to the existing instance - 6.6.0
parse: only need to reassign the var once - 6.6.0
parse/stringify: clean upcharsetoptions checking; fix defaults - 6.6.0
parse: one lessconcatcall - 6.6.0
utils:compactQueue: make it explicitly side-effecting
1 internal line (docs, tests, tooling) left out.