qs
6.17.1 · 28 Oct 2026BSD-3-Clause214.6M / weekRepositorynpmAtom feed
Upgrading qs from 6.9.7 to 6.17.1
41 releases in betweennotes for 20
- ?
- changes to make
- 4
- advisories fixed
- 4+
- new
- 10+
- fixes
Counted from 20 of 41 release notes. Advisories are counted from the advisory database, in full.
Security
Fixes 4 advisories affecting 6.9.7
- qs: Denial of Service via Attacker Controlled isBuffermoderate · GHSA-4mjr-xmp4-gh2g
- qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)moderate · GHSA-6pq8-jhm2-2vcw
- qs's arrayLimit bypass in comma parsing allows denial of servicelow · GHSA-w7fw-mjwx-w883
- qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionmoderate · GHSA-6rw7-vpxm-498p
Release by release
6.17.1nothing new or fixed in the note
- new
Add changelog acknowledgement
- fixed
Fix indentation
- fixed
Fix changelog indents
- new
6.15.3 – 6.16.25 releases, nothing new or fixed in the notes
- fixed
Fix grammar
- fixed
6.14.3 – 6.15.13 releases, nothing new or fixed in the notes
- fixed
Avoid
.push, usevoid - fixed
Fix rebase workflow permissions
- fixed
- new
Add threat model
- new
Add workflow permissions
- fixed
Ensure
arrayLimitapplies to `` notation as well
- new
- fixed
Fix changelog formatting bug
- fixed
100 other lines we could not sort, mostly version bumps
- 6.17.1
parse:interpretNumericEntities: decode code points above U+FFFF as surrogate pairs - 6.17.1
parse: respectplainObjectsfor `` withparseArrays: false - 6.17.1
utils:merge: count the elements of a sparse array againstarrayLimit, not its holes - 6.17.1
parse: guard bracket-wrapped prototype keys at depth 0 - 6.17.1
parse: extract wrapping-bracket stripping helper - 6.17.1
Document that
depth: 0anddepth: falsekeep keys flat - 6.17.0
stringify: addWHATWGformat - 6.17.0
stringify: do not sort the caller'sfilterarray in place - 6.17.0
parse: copy an own__proto__key as data - 6.17.0
parse: decode percent-encoded dots case-insensitively
37 internal lines (docs, tests, tooling) left out.