Skip to content

build(deps): bump qs and @vue/cli-service - #1709

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-b1351c694b
Open

build(deps): bump qs and @vue/cli-service#1709
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-b1351c694b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps qs to 6.15.3 and updates ancestor dependency @vue/cli-service. These dependencies need to be updated together.

Updates qs from 6.5.3 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
  • [Deps] update side-channel
  • [Dev Deps] update eslint, mock-property, tape
  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
  • [Fix] parse: handle nested bracket groups and add regression tests (#530)
  • [readme] fix grammar (#550)
  • [Dev Deps] update @ljharb/eslint-config
  • [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
  • [Deps] update @ljharb/eslint-config
  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
  • [Tests] increase coverage

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLength → arrayLimit)
  • [actions] fix rebase workflow permissions

6.14.1

  • [Fix] ensure arrayLimit applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions

... (truncated)

Commits
  • 18d085e v6.15.3
  • c38af42 [Deps] update side-channel
  • adce539 [Dev Deps] update eslint, mock-property, tape
  • 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
  • f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
  • 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
  • 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
  • 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
  • 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
  • 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
  • Additional commits viewable in compare view

Updates @vue/cli-service from 3.12.1 to 5.0.9

Release notes

Sourced from @​vue/cli-service's releases.

v5.0.9

🐛 Bug Fix

  • @vue/cli-service
    • #7443 fix: add missing default __VUE_PROD_HYDRATION_MISMATCH_DETAILS__, fixes compatibility with vue 3.5.19 (@​bobvandevijver)

v5.0.8

🐛 Bug Fix

v5.0.7

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

v5.0.6

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

v5.0.5

🐛 Bug Fix

  • @vue/cli
    • #7167 fix(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service
  • @vue/cli-plugin-e2e-cypress
    • [697bb44] fix: should correctly resolve cypress bin path for Cypress 10 (Note that the project is still created with Cypress 9 by default, but you can upgrade to Cypress 10 on your own now)

Committers: 3

v5.0.4

🐛 Bug Fix

  • @vue/cli-service
  • @vue/cli-shared-utils, @vue/cli-ui
    • 75826d6 fix: replace node-ipc with @achrinza/node-ipc to further secure the dependency chain

... (truncated)

Changelog

Sourced from @​vue/cli-service's changelog.

5.0.9 (2025-08-21)

🐛 Bug Fix

Committers: 2

5.0.7 (2022-07-05)

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

5.0.6 (2022-06-16)

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

5.0.5 (2022-06-16)

🐛 Bug Fix

  • @vue/cli
    • #7167 feat(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service

Committers: 3

... (truncated)

Commits
  • 7eb93c1 v5.0.9
  • c21c156 fix: add missing default __VUE_PROD_HYDRATION_MISMATCH_DETAILS__ (#7443)
  • b154dbd v5.0.8
  • 0260e4d fix: add devServer.server.type to useHttps judgement (#7222)
  • 4a0655f v5.0.7
  • beffe8a fix: allow disabling progress plugin via devServer.client.progress
  • 558dea2 fix: support devServer.server option, avoid deprecation warning
  • bddd64d fix: optimize the judgment on whether HTTPS has been set in options (#7202)
  • ef08a08 v5.0.6
  • fcf27e3 fixup! fix: compatibility with Vue 2.7
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies javascript Pull requests that update Javascript code labels Jul 25, 2026
@owasp-dt-bot

owasp-dt-bot commented Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@dependabot
build(deps): bump qs and @vue/cli-service
67a09fe 
Bumps [qs](https://github.com/ljharb/qs) to 6.15.3 and updates ancestor dependency [@vue/cli-service](https://github.com/vuejs/vue-cli/tree/HEAD/packages/@vue/cli-service). These dependencies need to be updated together.


Updates `qs` from 6.5.3 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.5.3...v6.15.3)

Updates `@vue/cli-service` from 3.12.1 to 5.0.9
- [Release notes](https://github.com/vuejs/vue-cli/releases)
- [Changelog](https://github.com/vuejs/vue-cli/blob/dev/CHANGELOG.md)
- [Commits](https://github.com/vuejs/vue-cli/commits/v5.0.9/packages/@vue/cli-service)

---
updated-dependencies:
- dependency-name: "@vue/cli-service"
  dependency-version: 5.0.9
  dependency-type: direct:development
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b1351c694b branch from 0d2faff to 67a09fe Compare July 27, 2026 10:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@owasp-dt-bot