qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.6.3 to 6.7.0
1 release in betweenevery note read
- 0
- changes to make
- 0
- advisories fixed
- 0
- new
- 0
- fixes
Security
5 advisories still affect 6.7.0
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
- qs's arrayLimit bypass in comma parsing allows denial of servicelow · GHSA-w7fw-mjwx-w883
Upgrading to 6.16.1 clears them.
9 other lines we could not sort, mostly version bumps
- 6.7.0
stringify/parse: addcommaas anarrayFormatoption (#276, #219) - 6.7.0
Correctly parse nested arrays
- 6.7.0
utils.merge: avoid a crash with a null target and a truthy non-array source, also with an array source - 6.7.0
stringify: cacheObject.prototype.hasOwnProperty - 6.7.0
utils:isBuffer: small tweak; add tests - 6.7.0
Use cached
Array.isArray - 6.7.0
parse/stringify: make a function to normalize the options - 6.7.0
utils: reduce observable [[Get]]s - 6.7.0
stringify/utils: cacheArray.isArray
3 internal lines (docs, tests, tooling) left out.