Qs is a popular npm package used for parsing and stringifying URL query strings with support for nested objects and arrays. Version 6.7.1 represents a minor update from the previous stable version 6.7.0, primarily focusing on developer tooling and dependency updates. While the core functionality remains consistent, developers should note the changes in the development environment.
Specifically, version 6.7.1 upgrades several key development dependencies, including tape (testing framework), eslint (JavaScript linter), and @ljharb/eslint-config (eslint configuration). tape jumps from version 4.10.1 to ^5.0.0-next.5, indicating a significant shift in the testing framework. eslint moves from version 5.15.3 to ^6.8.0 reflecting updated linting rules and code style enforcement. The package eclint also appears to be a newly added to version 6.7.1 and the older package editorconfig-tools was removed. These changes are important for contributors and developers who want to contribute to the package. Furthermore, iconv-lite is updated from 0.4.24 to 0.5.1 and object-inspect from 1.6.0 to 1.7.0.
Users should experience no breaking changes in their application code when upgrading from 6.7.0 to 6.7.1, but updatingdevDependencies ensures a smoother development workflow and helps catch potential issues. If you are using development tools in your project which depend on qs it may be beneficial to upgrade. The sizes differences between the two versions is also relatively small, with 6.7.1 having fileCount of 20 and unpackedSize of 151905, when in comparison with 6.7.0 fileCount is 18 and unpackedSize 142918.
All the vulnerabilities related to the version 6.7.1 of the package
qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
