Skip to content

deps: qs@^6.14.1 - #689

Merged
UlisesGascon merged 2 commits into
masterfrom
ulises/upgrade-qs-in-2.x
Jan 5, 2026
Merged

deps: qs@^6.14.1#689
UlisesGascon merged 2 commits into
masterfrom
ulises/upgrade-qs-in-2.x

Conversation

@UlisesGascon

Copy link
Copy Markdown
Member

Related to #687

UlisesGasconand others added 2 commits January 4, 2026 10:40
to preserve backcompat in the simpler parse after ljharb/qs@3086902
we need to provide an arrayLimit other than zero
input length is already capped by default, enforced by throwing a 413:
```js
// throws 413 before parsing when violated
options?.parameterLimit = 1000
```
so the default behavior is that we will parse arrays in simple mode up
to parameterLimit. Using `paramCount` because it will always be paramLimit
or lower here, and we use it in the other side of the ternary to mean
the same thing
@jonchurch

jonchurch commented Jan 5, 2026

Copy link
Copy Markdown
Member

I pushed the fix to keep backcompat with what we did in the simple mode before

fix(urlencoded): simple mode, set arrayLimit to paramCount
to preserve backcompat in the simpler parse after ljharb/qs@3086902
we need to provide an arrayLimit other than zero

input length is already capped by default, enforced by throwing a 413:

// throws 413 before parsing when violatedoptions?.parameterLimit=1000

so the default behavior is that we will parse arrays in simple mode up
to parameterLimit. Using paramCount because it will always be paramLimit
or lower here, and we use it in the other side of the ternary to mean
the same thing

}

var arrayLimit = extended ? Math.max(100, paramCount) : 0
var arrayLimit = extended ? Math.max(100, paramCount) : paramCount

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the Math.max is here for extended mode to allow sparse arrays, so far as I can tell

@jonchurch
jonchurch marked this pull request as ready for review January 5, 2026 08:56

@UlisesGasconUlisesGascon left a comment

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are amazing @jonchurch! 👏👏👏

I was going into a much more complex debug locally 😅

@UlisesGasconUlisesGascon self-assigned this Jan 5, 2026
@UlisesGasconUlisesGascon mentioned this pull request Jan 5, 2026
2 tasks
@UlisesGascon

Copy link
Copy Markdown
MemberAuthor

I included the changes in the HISTORY.md directly in the release notes (ref). @jonchurch can you approve the PR so I can merge it?

@bjohansebasbjohansebas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! good solution

@UlisesGasconUlisesGascon changed the title deps: qs@^6.14.1,deps: qs@^6.14.1Jan 5, 2026
@UlisesGascon
UlisesGascon merged commit 03f17c2 into masterJan 5, 2026
16 checks passed
@UlisesGascon
UlisesGascon deleted the ulises/upgrade-qs-in-2.x branch January 5, 2026 18:27
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@UlisesGascon@jonchurch@bjohansebas