qs is a widely-used npm package for parsing and stringifying URL query strings, offering robust support for complex data structures like nested objects and arrays. Comparing versions 6.9.2 and 6.9.1 reveals subtle but important updates for developers. Version 6.9.2, released in March 2020, features some updates in the dependencies, showing enhancements in tooling and testing infrastructure. Specifically, tape was updated to version ^5.0.0-next.5 from ^4.11.0, eslint was updated to version ^6.8.0 from ^6.6.0, @ljharb/eslint-config was updated to version ^16.0.0 from ^15.0.0 and object-inspect was updated to version ^1.7.0 from ^1.6.0. The iconv-lite was also updated to version 0.5.1 from 0.4.24 and has-symbols was updated to version ^1.0.1 from ^1.0.0. Also, safe-publish-latest has been upgraded to version ^1.1.4 from ^1.1.3.
While the core functionality remains consistent, these dependency updates often bring performance improvements, bug fixes, and enhanced security features within the development environment. Developers upgrading to 6.9.2 can expect a smoother development experience due to the updated linting and testing tools. Also it can be expected that there will be better support for unicode characters since iconv-lite library was updated. Furthermore, the small increase in unpacked size, from 154259 to 156197, indicates that the newer version may contain minor enhancements. Both versions maintain the BSD-3-Clause license and are hosted on GitHub under the ljharb/qs repository, reflecting the package's commitment to open-source principles. Consider upgrading to 6.9.2 for the latest refinements and long-term support.
All the vulnerabilities related to the version 6.9.2 of the package
qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
