Skip to content

chore(deps): bump qs and body-parser - #3184

Merged
web-padawan merged 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-bb403a35dd
Oct 28, 2026
Merged

chore(deps): bump qs and body-parser#3184
web-padawan merged 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-bb403a35dd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps qs and body-parser. These dependencies needed to be updated together.
Updates qs from 6.16.0 to 6.16.1

Changelog

Sourced from qs's changelog.

6.16.1

  • [Fix] parse: do not mutate an object input
  • [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
  • [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
  • [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
  • [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
  • [Fix] stringify: ignore inherited array format names (#622)
  • [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
  • [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
  • [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
  • [Fix] parse: only treat [] as array syntax when it ends the key
  • [Perf] decode: skip decoders when there is no percent sign (#583)
  • [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
  • [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
  • [Docs] document that qs and flat parsers disagree about parameter names
  • [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
  • [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
  • [meta] fix changelog indents
  • [actions] set least-privilege cache-mode
  • [Tests] utils: decode: add missing cases
  • [Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
  • [Tests] parse: allowDots: cover stray close brackets before a dot
  • [Dev Deps] update @ljharb/eslint-config, eslint, tape
Commits
  • 2471b66 v6.16.1
  • 51f736e [Docs] document that qs and flat parsers disagree about parameter names
  • 40239f7 [Dev Deps] update tape
  • d219359 [Fix] parse: do not mutate an object input
  • 98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
  • cb075c5 [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments wi...
  • 4b89c03 [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip
  • 266527d [Perf] decode: skip decoders when there is no percent sign
  • 82c5bd0 [Tests] utils: decode: add missing cases
  • 3ee412c [Tests] parse: characterize the ]= split when an = precedes any bracket...
  • Additional commits viewable in compare view

Updates qs from 6.15.3 to 6.16.1

Changelog

Sourced from qs's changelog.

6.16.1

  • [Fix] parse: do not mutate an object input
  • [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
  • [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
  • [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
  • [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
  • [Fix] stringify: ignore inherited array format names (#622)
  • [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
  • [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
  • [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
  • [Fix] parse: only treat [] as array syntax when it ends the key
  • [Perf] decode: skip decoders when there is no percent sign (#583)
  • [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
  • [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
  • [Docs] document that qs and flat parsers disagree about parameter names
  • [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
  • [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
  • [meta] fix changelog indents
  • [actions] set least-privilege cache-mode
  • [Tests] utils: decode: add missing cases
  • [Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
  • [Tests] parse: allowDots: cover stray close brackets before a dot
  • [Dev Deps] update @ljharb/eslint-config, eslint, tape
Commits
  • 2471b66 v6.16.1
  • 51f736e [Docs] document that qs and flat parsers disagree about parameter names
  • 40239f7 [Dev Deps] update tape
  • d219359 [Fix] parse: do not mutate an object input
  • 98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
  • cb075c5 [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments wi...
  • 4b89c03 [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip
  • 266527d [Perf] decode: skip decoders when there is no percent sign
  • 82c5bd0 [Tests] utils: decode: add missing cases
  • 3ee412c [Tests] parse: characterize the ]= split when an = precedes any bracket...
  • Additional commits viewable in compare view

Updates body-parser from 1.20.5 to 1.20.9

Release notes

Sourced from body-parser's releases.

1.20.9

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.8...1.20.9

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.9

1.20.8

  • Same code base as 1.20.7. This was created to test the new release process.

1.20.7

  • deps: qs@~6.16.0

1.20.6

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 27, 2026
@changeset-bot

changeset-bot Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: ce7c75b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@dependabot
chore(deps): bump qs and body-parser
ce7c75b 
Bumps [qs](https://github.com/ljharb/qs) and [body-parser](https://github.com/expressjs/body-parser). These dependencies needed to be updated together.

Updates `qs` from 6.16.0 to 6.16.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.16.0...v6.16.1)

Updates `qs` from 6.15.3 to 6.16.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.16.0...v6.16.1)

Updates `body-parser` from 1.20.5 to 1.20.9
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.9/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.5...1.20.9)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 1.20.9
  dependency-type: indirect
- dependency-name: qs
  dependency-version: 6.16.1
  dependency-type: indirect
- dependency-name: qs
  dependency-version: 6.16.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-bb403a35dd branch from 64d76de to ce7c75b Compare October 27, 2026 17:42
@web-padawan
web-padawan merged commit a3730ff into master Oct 28, 2026
13 of 16 checks passed
@web-padawan
web-padawan deleted the dependabot/npm_and_yarn/multi-bb403a35dd branch October 28, 2026 07:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@web-padawan web-padawan web-padawan approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@web-padawan