[dependabot]

Bumps qs to 6.16.2 and updates ancestor dependencies qs, body-parser and express. These dependencies need to be updated together.

Updates qs from 6.14.2 to 6.16.2

Changelog

Sourced from qs's changelog.

6.16.2

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)
• [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
• [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
• [Docs] document that qs and flat parsers disagree about parameter names
• [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
• [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
• [meta] fix changelog indents
• [actions] set least-privilege cache-mode
• [Tests] utils: decode: add missing cases
• [Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
• [Tests] parse: allowDots: cover stray close brackets before a dot
• [Dev Deps] update @ljharb/eslint-config, eslint, tape

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

6.15.4

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update @ljharb/eslint-config, evalmd, npmignore, tape
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

... (truncated)

Commits

• 136912a v6.16.2
• 6ed1c73 [Dev Deps] update evalmd, npmignore
• a09bc29 [meta] use double quotes for better OS support
• 5d3b1b9 [Fix] stringify: encode keys when allowEmptyArrays is set
• f13ec6c [Tests] stringify: pin allowEmptyArrays output for keys that need no enco...
• 2471b66 v6.16.1
• 51f736e [Docs] document that qs and flat parsers disagree about parameter names
• 40239f7 [Dev Deps] update tape
• d219359 [Fix] parse: do not mutate an object input
• 98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
• Additional commits viewable in compare view

Updates body-parser from 1.20.6 to 1.20.9

Release notes

Sourced from body-parser's releases.

1.20.9

Important: Security

• Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

• Release: 1.20.9 by @​UlisesGascon in expressjs/body-parser#779

Full Changelog: expressjs/body-parser@1.20.8...1.20.9

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

• ci: backport npm-publish workflow from master by @​UlisesGascon in expressjs/body-parser#769
• 1.20.8 by @​UlisesGascon in expressjs/body-parser#770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

• docs: include security fix in 1.20.6 changes by @​UlisesGascon in expressjs/body-parser#747
• deps: qs@~6.16.0 by @​krzysdz in expressjs/body-parser#761
• 1.20.7 by @​UlisesGascon in expressjs/body-parser#767

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

Changelog

Sourced from body-parser's changelog.

1.20.9

• Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)

1.20.8

• Same code base as 1.20.7. This was created to test the new release process.

1.20.7

• deps: qs@~6.16.0

Commits

• a64f140 1.20.9 (#779)
• 1260c38 fix: prevent process crash from trailing bytes after a compressed body
• b4c2112 docs: fix depth error description (#776)
• 29ddb9b docs: improve readability (#756)
• ac9667a docs: improve wording (#755)
• 5c08c20 1.20.8 (#770)
• 0cea4f4 ci: backport npm-publish workflow from master (#769)
• 0f0f0d7 1.20.7 (#767)
• 355eb04 deps: qs@~6.16.0 (#761)
• 8be369a docs: include security fix in 1.20.6 changes
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates express from 4.22.1 to 4.22.3

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

New Contributors

• @​suuuuuuminnnnnn made their first contribution in expressjs/express#7021
• @​SAY-5 made their first contribution in expressjs/express#7181

Full Changelog: expressjs/express@v4.22.1...v4.22.2

Changelog

Sourced from express's changelog.

4.22.3

• Allow conditional revalidation for QUERY requests
  • req.fresh now includes QUERY in the freshness check, so QUERY responses can return 304 when a validator matches
• deps: qs@~6.16.0

4.22.2

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

Commits

• 899b524 4.22.3 (#7466)
• 1fad2c3 ci: add npm staged publication with dist-tag support (#7465)
• 4138650 deps: qs@~6.16.0 (#7440)
• 61ccf2e feat: allow conditional revalidation for QUERY requests (v4) (#7377)
• 715101b Update path-to-regexp to 0.1.13 because CVE-2026-4867 (#7135)
• f472e5f docs: fix the release date format for 4.22.2
• df0abc9 4.22.2
• 836d366 4.x update qs to 6.15.1, body-parser 1.20.5 (#7224)
• 8d09bfe fix: restore array parsing for req.query repeated keys (#7181)
• d39e8ad deps: body-parser@~1.20.4 (#7021)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.