The qs library, a popular querystring parser for JavaScript, saw a minor version bump from 6.8.0 to 6.8.1, bringing subtle but noteworthy changes for developers. Both versions maintain the core functionality of parsing and stringifying querystrings with support for nested objects and arrays, controlled by a depth limit to prevent security vulnerabilities. Key differences lie primarily in the development dependencies, reflecting updates in the tooling and testing environment used by the maintainers.
Version 6.8.1 incorporates newer versions of several development dependencies like tape (testing framework), eslint (JavaScript linter), and @ljharb/eslint-config (eslint configuration). Critically iconv-lite, has-symbols, object-inspect, and safe-publish-latest also see updates with iconv-lite jumping from 0.4.24 in 6.8.0 to 0.5.1 in 6.8.1. These upgrades likely address bug fixes or security improvements in the underlying tools, rather than directly impacting the public API or core functionality of qs.
The size of unpacked tarball also increased between the versions, which went from 148KB to 154KB.
For developers using qs, the upgrade to 6.8.1 generally provides a stable and reliable upgrade, assuming it still depends on the same features. While the core functionality has not changed the security features improved by the updated dependencies and the bug fixes are a good reason to update and use it. It's always advisable to review the changelog or commit history on the GitHub repository for more granular details regarding the specific changes and potential implications for your application.
All the vulnerabilities related to the version 6.8.1 of the package
qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
