Skip to content

build(deps): bump qs, express, @cypress/request, node-red and body-parser#2136

Merged
hardillb merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-0c4752fcc8
Jun 8, 2026
Merged

build(deps): bump qs, express, @cypress/request, node-red and body-parser#2136
hardillb merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-0c4752fcc8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps qs to 6.15.2 and updates ancestor dependencies qs, express, @cypress/request, node-red and body-parser. These dependencies need to be updated together.

Updates qs from 6.14.2 to 6.15.2

Changelog

Sourced from qs's changelog.

6.15.2

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
  • [Fix] parse: handle nested bracket groups and add regression tests (#530)
  • [readme] fix grammar (#550)
  • [Dev Deps] update @ljharb/eslint-config
  • [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
  • [Deps] update @ljharb/eslint-config
  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
  • [Tests] increase coverage

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)
Commits
  • 9aca407 v6.15.2
  • 5e33d33 [Dev Deps] update @ljharb/eslint-config
  • 21f80b3 [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + `e...
  • a0a81ea [Fix] stringify: use configured delimiter after charsetSentinel
  • e3062f7 [Fix] stringify: apply formatter to encoded key under strictNullHandling
  • 0c180a4 [Fix] stringify: skip null/undefined filter-array entries instead of crashi...
  • 3a8b94a [Tests] add regression tests for keys containing percent-encoded bracket text
  • 96755ab [readme] fix grammar
  • a419ce5 [Fix] parse: handle nested bracket groups and add regression tests
  • 3f5e1c5 v6.15.1
  • Additional commits viewable in compare view

Updates express from 4.22.1 to 4.22.2

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: expressjs/express@v4.22.1...v4.22.2

Changelog

Sourced from express's changelog.

4.22.2 / 2026-05-011

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
Commits

Updates @cypress/request from 4.0.0 to 4.0.1

Release notes

Sourced from @​cypress/request's releases.

v4.0.1

4.0.1 (2026-05-28)

Bug Fixes

Commits

Updates node-red from 4.1.10 to 4.1.11

Release notes

Sourced from node-red's releases.

4.1.11: Maintenance Release

What's Changed

New Contributors

Full Changelog: node-red/node-red@4.1.10...4.1.11

Changelog

Sourced from node-red's changelog.

4.1.11: Maintenance Release

Commits
  • 74a5cf8 Merge pull request #5781 from node-red/rel4111
  • b6af72a Bump for 4.1.11 release
  • 3957596 Merge pull request #5779 from node-red/5778-monaco-search-controls
  • a8a224a Add styles to prevent controls wrapping in find bar
  • 37f5719 Merge pull request #5775 from node-red/update-mermaid
  • 3c4e315 Update mermaid
  • 3b23e0a Merge pull request #5772 from node-red/update-deps
  • 4cdc5b4 Update dependencies
  • 872c0d2 Merge pull request #5770 from node-red/5766-palette-overrides
  • a5bff63 Merge branch 'master' into 5766-palette-overrides
  • Additional commits viewable in compare view

Updates body-parser from 1.20.4 to 1.20.5

Release notes

Sourced from body-parser's releases.

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

New Contributors

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

Changelog

Sourced from body-parser's changelog.

1.20.5 / 2026-04-24

  • refactor(json): simplify strict mode error string construction
  • fix: extended urlencoded parsing of arrays with >100 elements (#716)
  • deps: qs@~6.15.1
Commits
Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for body-parser since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 8, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-0c4752fcc8 branch from 0970846 to 7bc756d Compare June 8, 2026 08:52
@hardillb

hardillb commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
build(deps): bump qs, express, @cypress/request, node-red and body-pa…
0c13164 
…rser

Bumps [qs](https://github.com/ljharb/qs) to 6.15.2 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [express](https://github.com/expressjs/express), [@cypress/request](https://github.com/cypress-io/request), [node-red](https://github.com/node-red/node-red) and [body-parser](https://github.com/expressjs/body-parser). These dependencies need to be updated together.


Updates `qs` from 6.14.2 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.2...v6.15.2)

Updates `express` from 4.22.1 to 4.22.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md)
- [Commits](expressjs/express@v4.22.1...v4.22.2)

Updates `@cypress/request` from 4.0.0 to 4.0.1
- [Release notes](https://github.com/cypress-io/request/releases)
- [Changelog](https://github.com/cypress-io/request/blob/master/CHANGELOG.md)
- [Commits](cypress-io/request@v4.0.0...v4.0.1)

Updates `node-red` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/node-red/node-red/releases)
- [Changelog](https://github.com/node-red/node-red/blob/master/CHANGELOG.md)
- [Commits](node-red/node-red@4.1.10...4.1.11)

Updates `body-parser` from 1.20.4 to 1.20.5
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.5/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.4...1.20.5)

---
updated-dependencies:
- dependency-name: "@cypress/request"
  dependency-version: 4.0.1
  dependency-type: indirect
- dependency-name: body-parser
  dependency-version: 1.20.5
  dependency-type: indirect
- dependency-name: express
  dependency-version: 4.22.2
  dependency-type: direct:production
- dependency-name: node-red
  dependency-version: 4.1.11
  dependency-type: direct:development
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-0c4752fcc8 branch from 7bc756d to 0c13164 Compare June 8, 2026 16:39
@hardillb hardillb merged commit ee395a4 into main Jun 8, 2026
4 checks passed
@hardillb hardillb deleted the dependabot/npm_and_yarn/multi-0c4752fcc8 branch June 8, 2026 17:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hardillb hardillb hardillb approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hardillb