Bump qs from 6.15.2 to 6.16.0 #51

Closed

dependabot[bot] wants to merge 1 commit from dependabot/npm_and_yarn/qs-6.16.0 into master

dependabot[bot] commented

2026-09-03 05:32:40 +00:00

(Migrated from github.com)

Bumps qs from 6.15.2 to 6.16.0.

Changelog

Sourced from qs's changelog.

6.16.0

[New] stringify: add a depth option to bound recursion depth (default Infinity)

[Fix] stringify: serialize Date values when a filter is provided

[Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set

[Fix] parse: flatten a collection appended to an overflowed array (#571)

[Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer

[Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties

[Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)

[Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded

[Docs] clarify arrayLimit is a representation threshold, not an element-count cap

[Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit

[Tests] stringify: pin current encodeDotInKeys separator-dot behavior

[Dev Deps] update @ljharb/eslint-config, eslint

[Dev Deps] update eslint, evalmd

6.15.3

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge

[Fix] utils: respect encoding of surrogate pairs across chunks (#559)

[Robustness] parse: throw the arrayLimit error before splitting oversized comma values

[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties

[Robustness] utils: enforce arrayLimit consistently across merge's array paths

[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf

[Deps] update side-channel

[Dev Deps] update eslint, mock-property, tape

[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

Commits

bb9379e v6.16.0
62fd254 [Fix] stringify: serialize Date values when a filter is provided
8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
d56f48c [Fix] parse: flatten a collection appended to an overflowed array
e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
9a76af2 [Dev Deps] update eslint, evalmd
3a890d4 [Dev Deps] update eslint, evalmd
b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
Additional commits viewable in compare view

Bumps [qs](https://github.com/ljharb/qs) from 6.15.2 to 6.16.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's changelog</a>.</em></p> <blockquote> <h2><strong>6.16.0</strong></h2> <ul> <li>[New] <code>stringify</code>: add a <code>depth</code> option to bound recursion depth (default <code>Infinity</code>)</li> <li>[Fix] stringify: serialize Date values when a filter is provided</li> <li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on comma groups under <code>[]=</code> when <code>throwOnLimitExceeded</code> is set</li> <li>[Fix] <code>parse</code>: flatten a collection appended to an overflowed array (<a href="https://redirect.github.com/ljharb/qs/issues/571">#571</a>)</li> <li>[Fix] <code>utils</code>: <code>isBuffer</code>: do not invoke a non-callable <code>constructor.isBuffer</code></li> <li>[Fix] <code>stringify</code>: do not let <code>allowEmptyArrays</code> skip cycle detection (or drop own keys) on an empty array with own properties</li> <li>[Fix] <code>stringify</code>: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (<a href="https://redirect.github.com/ljharb/qs/issues/562">#562</a>)</li> <li>[Docs] threat model: clarify <code>stringify</code> deep-nesting DoS is caller-bounded</li> <li>[Docs] clarify <code>arrayLimit</code> is a representation threshold, not an element-count cap</li> <li>[Tests] <code>parse</code>: remove a test that pinned <code>[]=</code> comma groups escaping <code>arrayLimit</code></li> <li>[Tests] <code>stringify</code>: pin current <code>encodeDotInKeys</code> separator-dot behavior</li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>eslint</code></li> <li>[Dev Deps] update <code>eslint</code>, <code>evalmd</code></li> </ul> <h2><strong>6.15.3</strong></h2> <ul> <li>[Fix] <code>parse</code>: enforce <code>throwOnLimitExceeded</code> for cumulative array growth via <code>combine</code>/<code>merge</code></li> <li>[Fix] <code>utils</code>: respect encoding of surrogate pairs across chunks (<a href="https://redirect.github.com/ljharb/qs/issues/559">#559</a>)</li> <li>[Robustness] <code>parse</code>: throw the <code>arrayLimit</code> error before splitting oversized comma values</li> <li>[Robustness] <code>utils.merge</code> / <code>utils.assign</code>: avoid invoking <code>__proto__</code> setter when copying own properties</li> <li>[Robustness] <code>utils</code>: enforce <code>arrayLimit</code> consistently across <code>merge</code>'s array paths</li> <li>[Perf] <code>utils</code>: make <code>compact</code> O(n) via a side-channel visited-set instead of <code>Array.indexOf</code></li> <li>[Deps] update <code>side-channel</code></li> <li>[Dev Deps] update <code>eslint</code>, <code>mock-property</code>, <code>tape</code></li> <li>[Tests] <code>parse</code>: characterize current lenient handling of unbalanced bracket keys (<a href="https://redirect.github.com/ljharb/qs/issues/558">#558</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/qs/commit/bb9379e01fad04c601478acd6152143cb20c984b"><code>bb9379e</code></a> v6.16.0</li> <li><a href="https://github.com/ljharb/qs/commit/62fd25480b0b0d9c0a667ee67e13608a363f5d0e"><code>62fd254</code></a> [Fix] stringify: serialize Date values when a filter is provided</li> <li><a href="https://github.com/ljharb/qs/commit/8859c37470e11b42b547b275e4e9bd0bc8cc5464"><code>8859c37</code></a> [Fix] <code>parse</code>: enforce <code>arrayLimit</code> on comma groups under <code>[]=</code> when `throwOn...</li> <li><a href="https://github.com/ljharb/qs/commit/8079adc7e7cf84b8289898d1b18877160de67d40"><code>8079adc</code></a> [Tests] <code>parse</code>: remove a test that pinned <code>[]=</code> comma groups escaping `array...</li> <li><a href="https://github.com/ljharb/qs/commit/d56f48ca137b1bf6385da749b1044246ae142f19"><code>d56f48c</code></a> [Fix] <code>parse</code>: flatten a collection appended to an overflowed array</li> <li><a href="https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"><code>e83d321</code></a> [Fix] <code>utils</code>: <code>isBuffer</code>: do not invoke a non-callable <code>constructor.isBuffer</code></li> <li><a href="https://github.com/ljharb/qs/commit/7e87a07c2c62301dd8fc2e099ac38227bc96c74c"><code>7e87a07</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code>, <code>eslint</code></li> <li><a href="https://github.com/ljharb/qs/commit/9a76af21604a4ece315e58ba251b93cf0fd944f2"><code>9a76af2</code></a> [Dev Deps] update <code>eslint</code>, <code>evalmd</code></li> <li><a href="https://github.com/ljharb/qs/commit/3a890d4ecd3deb72a45d90be36f4f8c5970467c7"><code>3a890d4</code></a> [Dev Deps] update <code>eslint</code>, <code>evalmd</code></li> <li><a href="https://github.com/ljharb/qs/commit/b433a9b1633e1c3348aa53c513589a5bfe47f113"><code>b433a9b</code></a> [Fix] <code>stringify</code>: do not let <code>allowEmptyArrays</code> skip cycle detection (or dro...</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/qs/compare/v6.15.2...v6.16.0">compare view</a></li> </ul> </details> <br />

dependabot[bot] commented

2026-10-08 21:11:53 +00:00

(Migrated from github.com)

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`. If you change your mind, just re-open this PR and I'll resolve any conflicts on it.