fix(deps): update version lib qs#6969
Conversation
gabrieel1007
commented
Jan 2, 2026
- Issue created about this dependency vulnerability:
- The lib qs has a vulnerability.
- what has been done:
UlisesGascon
left a comment
There was a problem hiding this comment.
Hey @gabrieel1007! Thanks for contributing to Express.
We likely do not need to add additional tests here. This behavior is already well covered in qs (see: ljharb/qs@3086902), and Express does not define an arrayLimit by default.
As a result, customization is left to the user. Any related testing should ideally be handled at the application level, according to their specific configuration and requirements.
Additionally, we will probably want to open a separate PR targeting the 4.x branch to upgrade the qs version as well, since this PR is intended to apply only to the Express 5 line.
|
@UlisesGascon |
|
The tests are failing due the changes on qs (see discussion on body-parser too expressjs/body-parser#687 (comment)). cc: @expressjs/express-tc |
@UlisesGascon
|
|
These tests are basically just asserting on body-parser behavior due to the pass through, so we fix it in body-parser and take both updates at the same time we have a PR to update body-parser #6972 |
|
@jonchurch |
I think it was due to caching issues that it kept failing; I reran the tests and now they pass. |