From 8335478d243d0c10a67bbfb65d0267e2a3ea33c0 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Fri, 8 May 2026 15:57:33 -0400 Subject: [PATCH 1/3] deps(qs): bump qs to ~6.15.1 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index a6819557aaf..54d0e09aaa8 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,7 @@ "parseurl": "~1.3.3", "path-to-regexp": "~0.1.12", "proxy-addr": "~2.0.7", - "qs": "~6.14.1", + "qs": "~6.15.1", "range-parser": "~1.2.1", "safe-buffer": "5.2.1", "send": "~0.19.0", From 81b315dcb2dbb2666fd7aff7fe60f0318d5b5662 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Fri, 8 May 2026 17:08:29 -0400 Subject: [PATCH 2/3] deps: bump body-parser to ~1.20.5 this allows us to align qs semver in both express and body-parser --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 54d0e09aaa8..fab5f2484cf 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,7 @@ "dependencies": { "accepts": "~1.3.8", "array-flatten": "1.1.1", - "body-parser": "~1.20.4", + "body-parser": "~1.20.5", "content-disposition": "~0.5.4", "content-type": "~1.0.4", "cookie": "~0.7.1", From c16927d88dab50580cc0893fa31d9afb475a5dc3 Mon Sep 17 00:00:00 2001 From: Jon Church Date: Fri, 8 May 2026 17:09:28 -0400 Subject: [PATCH 3/3] docs: update History.md --- History.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/History.md b/History.md index f27f4d73643..2567fea9074 100644 --- a/History.md +++ b/History.md @@ -1,3 +1,11 @@ +unreleased +========== + +* fix: restore >20 array parsing for req.query repeated keys (8d09bfe6) + * This also unifies array-cap behavior across notations. Indexed notation (`a[0]=...`) was historically capped at qs's default `arrayLimit` of 20 even in older qs versions; after this change it also allows up to 1000 items. +* deps: qs@~6.15.1 +* deps: body-parser@~1.20.5 + 4.22.1 / 2025-12-01 ==========