Bump qs and express in /blog by dependabot[bot] · Pull Request #382 · caffeinelabs/mops

dependabot · 2026-02-12T19:27:59Z

Bumps qs and express. These dependencies needed to be updated together.
Updates qs from 6.11.0 to 6.14.2

Changelog

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

6.14.1

[Fix] ensure arrayLimit applies to [] notation as well

[Fix] parse: when a custom decoder returns null for a key, ignore that key

[Refactor] parse: extract key segment splitting helper

[meta] add threat model

[actions] add workflow permissions

[Tests] stringify: increase coverage

[Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

6.14.0

[New] parse: add throwOnParameterLimitExceeded option (#517)

[Refactor] parse: use utils.combine more

[patch] parse: add explicit throwOnLimitExceeded default

[actions] use shared action; re-add finishers

[meta] Fix changelog formatting bug

[Deps] update side-channel

[Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols

[Tests] increase coverage

6.13.1

[Fix] stringify: avoid a crash when a filter key is null

[Fix] utils.merge: functions should not be stringified into keys

[Fix] parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset

[Fix] stringify: ensure a non-string filter does not crash

[Refactor] use __proto__ syntax instead of Object.create for null objects

[Refactor] misc cleanup

[Tests] utils.merge: add some coverage

[Tests] fix a test case

[actions] split out node 10-20, and 20+

[Dev Deps] update es-value-fixtures, mock-property, object-inspect, tape

6.13.0

[New] parse: add strictDepth option (#511)

[Tests] use npm audit instead of aud

6.12.3

[Fix] parse: properly account for strictNullHandling when allowEmptyArrays

... (truncated)

Commits

bdcf0c7 v6.14.2
294db90 [readme] document that addQueryPrefix does not add ? to empty output
5c308e5 [readme] clarify parseArrays and arrayLimit documentation
6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
1b9a8b4 [actions] fix rebase workflow permissions
2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
Additional commits viewable in compare view

Updates express from 4.19.2 to 4.22.1

Release notes

Sourced from express's releases.

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Release: 4.22.1 by @UlisesGascon in expressjs/express#6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

Refactor: improve readability by @sazk07 in expressjs/express#6190

ci: add support for Node.js@23.0 by @UlisesGascon in expressjs/express#6080

Method functions with no path should error by @wesleytodd in expressjs/express#5957

ci: updated github actions ci workflow by @Phillip9587 in expressjs/express#6323

ci: reorder npm i steps to fix ci for older node versions by @Phillip9587 in expressjs/express#6336

Backport: ci: add node.js 24 to test matrix by @Phillip9587 in expressjs/express#6506

chore(4.x): wider range for query test skip by @jonchurch in expressjs/express#6513

use tilde notation for certain dependencies by @UlisesGascon in expressjs/express#6905

deps: qs@6.14.0 by @UlisesGascon in expressjs/express#6909

deps: use tilde notation for qs by @Phillip9587 in expressjs/express#6919

Release: 4.22.0 by @UlisesGascon in expressjs/express#6921

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Add funding field (v4) by @bjohansebas in expressjs/express#6065

deps: path-to-regexp@0.1.11 by @blakeembrey in expressjs/express#5956

deps: bump path-to-regexp@0.1.12 by @jonchurch in expressjs/express#6209

Release: 4.21.2 by @UlisesGascon in expressjs/express#6094

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in expressjs/express#6029

Release: 4.21.1 by @UlisesGascon in expressjs/express#6031

Full Changelog: expressjs/express@4.21.0...4.21.1

... (truncated)

Changelog

Sourced from express's changelog.

4.22.1 / 2025-12-01

Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

4.22.0 / 2025-12-01

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

deps: use tilde notation for dependencies

deps: qs@6.14.0

4.21.2 / 2024-11-06

deps: path-to-regexp@0.1.12

Fix backtracking protection

deps: path-to-regexp@0.1.11

Throws an error on invalid path values

4.21.1 / 2024-10-08

Backported a fix for CVE-2024-47764

4.21.0 / 2024-09-11

Deprecate res.location("back") and res.redirect("back") magic string

deps: serve-static@1.16.2

includes send@0.19.0

deps: finalhandler@1.3.1

deps: qs@6.13.0

4.20.0 / 2024-09-10

deps: serve-static@0.16.0

Remove link renderization in html while redirecting

deps: send@0.19.0

Remove link renderization in html while redirecting

deps: body-parser@0.6.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: path-to-regexp@0.1.10

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

... (truncated)

Commits

12fae14 4.22.1
5ddf311 Revert "sec: security patch for CVE-2024-51999"
49744ab 4.22.0 (#6921)
6e97452 sec: security patch for CVE-2024-51999
6a23d34 deps: use tilde notation for qs (#6919)
8c12cdf deps: qs@6.14.0 (#6909)
7fea74f deps: use tilde notation for certain dependencies (#6905)
dac7a04 chore: wider range for query test skip (#6513)
997919b ci: add node.js 24 to test matrix (#6506)
36fb59c fix(ci): reorder npm i steps to fix ci for older node versions (#6336)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [qs](https://github.com/ljharb/qs) and [express](https://github.com/expressjs/express). These dependencies needed to be updated together. Updates `qs` from 6.11.0 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.11.0...v6.14.2) Updates `express` from 4.19.2 to 4.22.1 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.1/History.md) - [Commits](expressjs/express@4.19.2...v4.22.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect - dependency-name: express dependency-version: 4.22.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-02-12T19:36:36Z

Benchmark Results

bench/1-buffer-vector-add.bench.mo $({\color{green}-8.22\%})$

Add (second)

Add items one-by-one (second)

Instructions: ${\color{green}-8.22\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

	10	10000	1000000
Buffer	9_557 $({\color{green}-29.67\%})$	5_687_594 $({\color{green}-8.33\%})$	525_783_888 $({\color{green}-8.25\%})$
Vector	13_525 $({\color{red}+18.47\%})$	4_378_612 $({\color{green}-10.82\%})$	417_864_498 $({\color{green}-10.74\%})$

Heap

	10	10000	1000000
Buffer	272 B $({\color{gray}0\%})$	272 B $({\color{gray}0\%})$	272 B $({\color{gray}0\%})$
Vector	272 B $({\color{gray}0\%})$	272 B $({\color{gray}0\%})$	272 B $({\color{gray}0\%})$

Garbage Collection

	10	10000	1000000
Buffer	1.09 KiB $({\color{gray}0\%})$	143.28 KiB $({\color{gray}0\%})$	12.02 MiB $({\color{gray}0\%})$
Vector	1.09 KiB $({\color{gray}0\%})$	45.65 KiB $({\color{gray}0\%})$	3.86 MiB $({\color{gray}0\%})$

bench/2-vector-buffer-add.bench.mo $({\color{green}-10.02\%})$

Add

Add items one-by-one

Instructions: ${\color{green}-10.02\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

	10	10000	1000000
Vector	13_525 $({\color{green}-12.27\%})$	4_378_966 $({\color{green}-10.82\%})$	417_886_092 $({\color{green}-10.74\%})$
Buffer	9_557 $({\color{green}-9.75\%})$	5_686_886 $({\color{green}-8.33\%})$	525_781_056 $({\color{green}-8.25\%})$

Heap

	10	10000	1000000
Vector	272 B $({\color{gray}0\%})$	272 B $({\color{gray}0\%})$	272 B $({\color{gray}0\%})$
Buffer	272 B $({\color{gray}0\%})$	272 B $({\color{gray}0\%})$	272 B $({\color{gray}0\%})$

Garbage Collection

	10	10000	1000000
Vector	1.09 KiB $({\color{gray}0\%})$	45.65 KiB $({\color{gray}0\%})$	3.86 MiB $({\color{gray}0\%})$
Buffer	1.09 KiB $({\color{gray}0\%})$	143.28 KiB $({\color{gray}0\%})$	12.02 MiB $({\color{gray}0\%})$

bench/array.bench.mo $({\color{green}-17.47\%})$

Array

arr arr

Instructions: ${\color{green}-17.47\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

	100k x1	reset1	100k x3	reset2	100k x4	reset3
Array	13_502_096 $({\color{green}-10.00\%})$	3_335 $({\color{green}-25.14\%})$	27_003_270 $({\color{green}-10.00\%})$	3_809 $({\color{green}-24.92\%})$	54_004_127 $({\color{green}-10.00\%})$	4_283 $({\color{green}-24.74\%})$

Heap

	100k x1	reset1	100k x3	reset2	100k x4	reset3
Array	390.9 KiB $({\color{gray}0\%})$	-390.37 KiB $({\color{gray}0\%})$	390.9 KiB $({\color{gray}0\%})$	-390.37 KiB $({\color{gray}0\%})$	390.9 KiB $({\color{gray}0\%})$	-390.37 KiB $({\color{gray}0\%})$

Garbage Collection

	100k x1	reset1	100k x3	reset2	100k x4	reset3
Array	360 B $({\color{gray}0\%})$	390.97 KiB $({\color{gray}0\%})$	391 KiB $({\color{gray}0\%})$	390.97 KiB $({\color{gray}0\%})$	1.14 MiB $({\color{gray}0\%})$	390.97 KiB $({\color{gray}0\%})$

No previous results found "/home/runner/work/mops/mops/.bench/prng.bench.json"

bench/prng.bench.mo $({\color{gray}0\%})$

Prng

Benchmark N next calls for different PRNGs

Instructions: ${\color{gray}0\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

	10	100	1000	10000
Seiran128	1_694	15_194	150_194	1_500_194
SFC64	2_802	28_962	288_557	2_882_655
SFC32	2_383	23_825	237_026	2_379_333

Heap

	10	100	1000	10000
Seiran128	272 B	272 B	272 B	272 B
SFC64	308 B	272 B	272 B	272 B
SFC32	280 B	280 B	272 B	272 B

Garbage Collection

	10	100	1000	10000
Seiran128	296 B	296 B	296 B	296 B
SFC64	536 B	4.98 KiB	47.16 KiB	469.04 KiB
SFC32	376 B	1.78 KiB	15.39 KiB	156.11 KiB

bench/removeLast.bench.mo $({\color{green}-10.90\%})$

Remove items using `removeLast`

Vector and buffer are initialized with 100k items and then 70k items are removed one-by-one.

Instructions: ${\color{green}-10.90\%}$
Heap: ${\color{gray}0\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{gray}0\%}$

Instructions

	remove 70k
Vector	27_707_716 $({\color{green}-13.98\%})$
Buffer	29_236_977 $({\color{green}-7.82\%})$

Heap

	remove 70k
Vector	-136.8 KiB $({\color{gray}0\%})$
Buffer	-269.76 KiB $({\color{gray}0\%})$

Garbage Collection

	remove 70k
Vector	139.45 KiB $({\color{gray}0\%})$
Buffer	540.43 KiB $({\color{gray}0\%})$

bench/stable-memory.bench.mo $({\color{green}-134.03\%})$

Stable Memory and Region

Grow Region and store blobs in it

Instructions: ${\color{green}-66.97\%}$
Heap: ${\color{green}-6.10\%}$
Stable Memory: ${\color{gray}0\%}$
Garbage Collection: ${\color{green}-60.97\%}$

Instructions

	Region (fill 1/100)	Region (fill 1/50)	StableMemory
10 pages	2_627_021 $({\color{green}-95.97\%})$	10_496_358 $({\color{green}-95.97\%})$	2_693 $({\color{green}-5.87\%})$
100 pages	52_467_049 $({\color{green}-95.97\%})$	104_914_762 $({\color{green}-95.97\%})$	2_698 $({\color{green}-8.67\%})$
256 pages	134_273_582 $({\color{green}-95.97\%})$	268_574_767 $({\color{green}-95.97\%})$	3_246 $({\color{green}-12.37\%})$

Heap

	Region (fill 1/100)	Region (fill 1/50)	StableMemory
10 pages	272 B $({\color{green}-8.11\%})$	272 B $({\color{gray}0\%})$	276 B $({\color{gray}0\%})$
100 pages	272 B $({\color{green}-11.69\%})$	272 B $({\color{green}-11.69\%})$	272 B $({\color{gray}0\%})$
256 pages	272 B $({\color{green}-11.69\%})$	272 B $({\color{green}-11.69\%})$	276 B $({\color{gray}0\%})$

Garbage Collection

	Region (fill 1/100)	Region (fill 1/50)	StableMemory
10 pages	208.34 KiB $({\color{green}-91.44\%})$	832.38 KiB $({\color{green}-91.45\%})$	336 B $({\color{gray}0\%})$
100 pages	4.06 MiB $({\color{green}-91.46\%})$	8.13 MiB $({\color{green}-91.46\%})$	340 B $({\color{gray}0\%})$
256 pages	10.4 MiB $({\color{green}-91.46\%})$	20.8 MiB $({\color{green}-91.46\%})$	340 B $({\color{gray}0\%})$

Stable Memory

	Region (fill 1/100)	Region (fill 1/50)	StableMemory
10 pages	8 MiB $({\color{gray}0\%})$	8 MiB $({\color{gray}0\%})$	8 MiB $({\color{gray}0\%})$
100 pages	8 MiB $({\color{gray}0\%})$	8 MiB $({\color{gray}0\%})$	0 B $({\color{gray}0\%})$
256 pages	16 MiB $({\color{gray}0\%})$	16 MiB $({\color{gray}0\%})$	16 MiB $({\color{gray}0\%})$

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 12, 2026

dependabot bot requested a review from a team as a code owner February 12, 2026 19:28

dependabot bot mentioned this pull request Feb 12, 2026

Bump qs and express in /blog #356

Closed

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 12, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump qs and express in /blog#382

Bump qs and express in /blog#382
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/blog/multi-a07fd7252a

dependabot bot commented on behalf of github Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Add (second)

Add

Array

Prng

Remove items using `removeLast`

Stable Memory and Region

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Feb 12, 2026

6.14.2

6.14.1

6.14.0

6.13.1

6.13.0

6.12.3

v4.22.1

What's Changed

4.22.0

Important: Security

What's Changed

4.21.2

What's Changed

4.21.1

What's Changed

4.22.1 / 2025-12-01

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

4.20.0 / 2024-09-10

Uh oh!

github-actions bot commented Feb 12, 2026

Benchmark Results

Add (second)

Add

Array

Prng

Remove items using removeLast

Stable Memory and Region

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Remove items using `removeLast`