Qs is a popular npm package designed for parsing and stringifying URL query strings, offering robust support for nested objects and arrays. Versions 6.9.5 and 6.9.6 share the same core functionality, both providing a versatile solution for handling complex querystring data. The core description, license (BSD-3-Clause), repository and funding options remain identical. The small dependency and devDependency set also remain the same.
However, subtle distinctions exist. Examining the dist object reveals that version 6.9.6 introduces a minor increase in the package's unpacked size (164609 bytes compared to 6.9.5's 138396 bytes) and file count (18 vs 17), suggesting internal changes. Most importantly, version 6.9.6 was released on January 14, 2021 while version 6.9.5 was released on January 13, 2021. This one day difference in release date between the versions indicates that version 6.9.6 likely addresses bug fixes and other small improvements relative to a release within the same week.
Developers considering Qs for their projects can rely on its established capabilities for parsing and stringifying complex querystrings. While version 6.9.6 doesn't introduce groundbreaking new features, its updated release date suggests a potentially more refined and stable experience due to the bug fixes and stability improvements between the 2 versions. For projects prioritizing absolute stability and receiving active updates, checking the changelog for specific fixes implemented in 6.9.6, while evaluating the specific use-case will give developers insight on upgrade impact.
All the vulnerabilities related to the version 6.9.6 of the package
qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__
key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000
. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.