chore(deps): update dependency qs to v6.15.3#6310
Conversation
thomhurst
added
dependencies
thomhurst
had a problem deploying
to
Pull Requests
GitHub Actions
Failure
Up to standards ✅🟢 Issues
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency Update Review: qs 6.15.2 → 6.15.3
This is a straightforward Renovate-generated patch bump for the qs package (used in docs/), along with cascading lockfile updates to side-channel, side-channel-list, and object-inspect.
What changed
qs6.15.3 includes several robustness and security-adjacent fixes:- Enforces
arrayLimiton cumulative array growth viacombine/merge(prevents DoS via oversized arrays) - Avoids invoking
__proto__setter when copying own properties (prototype pollution hardening) - Fixes surrogate pair encoding across chunks
- Makes
compactO(n) instead of O(n²)
- Enforces
side-channel→ 1.1.1 andside-channel-list→ 1.0.1 are minor patch updates pulled in transitivelyes-define-propertyis a new transitive dependency ofqs6.15.3 (replaces internal ad-hoc property definition)
Assessment
The changes are scoped entirely to docs/package.json and docs/yarn.lock — no production .NET code is touched. The qs package is used only in the documentation site tooling, not in TUnit's core library or test runner. The patch includes meaningful robustness improvements (prototype pollution guard, array limit enforcement) that are worth taking.
The lockfile diff is consistent with the package.json change: all version pins align, integrity hashes are present, and no unexpected packages were added beyond the new es-define-property transitive dep.
No concerns — safe to merge.
2 participants
This PR contains the following updates:
6.15.2→6.15.3Release Notes
ljharb/qs (qs)
v6.15.3Compare Source
parse: enforcethrowOnLimitExceededfor cumulative array growth viacombine/mergeutils: respect encoding of surrogate pairs across chunks (#559)parse: throw thearrayLimiterror before splitting oversized comma valuesutils.merge/utils.assign: avoid invoking__proto__setter when copying own propertiesutils: enforcearrayLimitconsistently acrossmerge's array pathsutils: makecompactO(n) via a side-channel visited-set instead ofArray.indexOfside-channeleslint,mock-property,tapeparse: characterize current lenient handling of unbalanced bracket keys (#558)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.