Bump qs from 6.15.2 to 6.16.0

[dependabot]

Bumps qs from 6.15.2 to 6.16.0.

Changelog

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

Commits

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

---

Note

Low Risk
Dependency-only bump with one straightforward qs.stringify usage; behavior change risk is low unless query parsing with strict arrayLimit is used elsewhere via transitive deps.

Overview
Upgrades the qs query-string library from 6.15.2 to 6.16.0 in @chia-network/core (packages/core/package.json) and refreshes package-lock.json (including qs’s added es-define-property and updated side-channel).

In this repo, qs is only used in ErrorBoundary to stringify a small flat object for a GitHub “new issue” URL—no custom parse/stringify options. The 6.16.0 release mainly adds optional depth for stringify, tightens arrayLimit / overflow-array parsing, and fixes stringify edge cases (Dates with filters, encodeDotInKeys, empty arrays with own properties); those are unlikely to change that simple link unless you rely on the old lenient `[]=`` comma-group behavior.

^{Reviewed by Cursor Bugbot for commit 43edde9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	qs@​6.15.2 ⏵ 6.16.0		+3

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Verdict: benign

I'll review the qs 6.15.2 → 6.16.0 update against the malware checklist, starting with upstream diffs, package metadata, and local usage.

This is a normal qs 6.15.2 → 6.16.0 bump (plus 6.15.3) from the canonical ljharb/qs repo, tagged as v6.16.0. Commits are almost all Jordan Harband plus a few named bugfix contributors; the lib diffs match the changelog (arrayLimit/throwOnLimitExceeded, __proto__ assignment via es-define-property, surrogate-pair encoding, stringify depth, Date+filter, empty-array cycle detection).

Scanner status was warn, and those hits do not look like compromise:

• Confusables: fullwidth ！ in Japanese README examples.
• charCodeAt: querystring UTF-16 / surrogate handling (lib/utils.js), not hidden payload assembly.
• shell_process_spawn: RegExp.prototype.exec, not process spawn.
• network_c2_indicator: README sponsor image on raw.githubusercontent.com / numi.tech.
• obfuscation_indicator: legitimate decodeURIComponent in parse/encode; Function(...) lives in bundled dist/qs.js (browserify + get-intrinsic/bind), not new C2.

Integrity: one expected runtime dep (es-define-property) for the __proto__ robustness fix; side-channel patch bump; no install/preinstall scripts; no workflow changes in the published package. Local use is qs.stringify for a GitHub issue URL in ErrorBoundary. Safe to merge from a malware/supply-chain standpoint.

Compatibility Analysis

I'll analyze how qs is used in this repo and whether the 6.15.2 → 6.16.0 changes affect those call sites.Recommendation: merge-with-caveats

Minor 6.15.2 → 6.16.0. Public exports are still parse / stringify / formats. The new stringify depth option defaults to Infinity, so existing callers keep unbounded recursion unless they opt in.

Where qs is used

• Direct: @chia-network/core (packages/core/package.json) — only packages/core/src/components/ErrorBoundary/ErrorBoundary.tsx. It calls qs.stringify with a flat object of strings (labels, template, title, ui, logs) and no options. Builds a GitHub issue URL. No parse, no Dates, no filters, no encodeDotInKeys, no throwOnLimitExceeded, no arrays.
• Pinned globally: root package.json overrides.qs (this tree still says 6.15.2).
• Transitive (lockfile, not app source): one hoisted node_modules/qs@6.16.0. Consumers include body-parser (qs: ~6.16.0) and express 4.22.2 (qs: ~6.15.1, dev). Express is not a direct app dependency; it comes in via the webpack/dev toolchain.

Do usage sites hit changed APIs?

No for first-party code. Changelog/commits are edge-case parse limits (arrayLimit / throwOnLimitExceeded / overflow flatten), stringify Date+filter, encodeDotInKeys on dotted top-level keys, empty arrays with own properties, isBuffer, and __proto__ copy robustness. None of that matches the ErrorBoundary call.

Express/body-parser: they use qs.parse for HTTP query/body. Default throwOnLimitExceeded stays off, so stricter limit throws should not appear unless someone enables that option. Overflow/comma-array flattening can change results only for oversized or odd query strings, not typical webpack-dev-server traffic.

Risks / unknowns

1. Override vs lockfile mismatch (action required): packages/core and the lockfile are on 6.16.0, but root overrides.qs is still 6.15.2. A later npm install can pin everyone back to 6.15.2. Bump the override to 6.16.0 in this PR.
2. Express range: ~6.15.1 does not include 6.16.0. This repo already forces a single qs via overrides; that is expected. Unlikely to break webpack-dev-server; not on the Electron GUI runtime path.
3. Build: engines.node >= 0.6; this repo is Node ≥ 20. side-channel remains a normal production dep of qs.

Merge after aligning overrides.qs with 6.16.0. No first-party API migration needed.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 12
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved upstream range: 9aca4076fe788338c67cf7e115f0be6bc58d85a8..bb9379e01fad04c601478acd6152143cb20c984b
• Resolved refs: from=9aca4076fe788338c67cf7e115f0be6bc58d85a8 to=bb9379e01fad04c601478acd6152143cb20c984b
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 2
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 16

Top findings

• README.md:725 confusable :: var shiftJISEncoded = qs.stringify({ a: 'こんにちは！' }, { encoder: encoder });
• README.md:734 confusable :: assert.deepEqual(obj, { a: 'こんにちは！' });
• lib/parse.js:269 codepoint_decoder :: var cu = key.charCodeAt(i);
• lib/utils.js:242 codepoint_decoder :: var last = segment.charCodeAt(segment.length - 1);
• lib/utils.js:251 codepoint_decoder :: var c = segment.charCodeAt(i);
• lib/utils.js:285 codepoint_decoder :: c = 0x10000 + (((c & 0x3FF) << 10) | (segment.charCodeAt(i) & 0x3FF));
• dist/qs.js:8 codepoint_decoder :: "use strict";var utils=require(5),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,defaults={allowDots:!1,allowEmptyArrays:!1,allowPrototypes:!1,allowSparse:!1,arrayLimit:20,charset:"utf-8",charsetSentinel:!1,comma:!1,decodeDotInKeys:!1,decoder:utils.decode,delimiter:"&",depth:5,duplicates:"combine",ignoreQueryPrefix:!1,interpretNumericEntities:!1,parameterLimit:1e3,parseArrays:!0,plainObjects:!1,strictDepth:!1,strictMerge:!0,strictNullHandling:!1,throwOnLimitExceeded:!1},interpretNumer...[truncated]
• dist/qs.js:14 codepoint_decoder :: "use strict";var formats=require(1),getSideChannel=require(46),defineProperty=require(14),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,overflowChannel=getSideChannel(),markOverflow=function markOverflow(e,r){return overflowChannel.set(e,r),e},isOverflow=function isOverflow(e){return overflowChannel.has(e)},getMaxIndex=function getMaxIndex(e){return overflowChannel.get(e)},setMaxIndex=function setMaxIndex(e,r){overflowChannel.set(e,r)},hexTable=function(){for(var e=[],r=0;r<256;++r)e...[truncated]
• dist/qs.js:128 codepoint_decoder :: var hasMap="function"==typeof Map&&Map.prototype,mapSizeDescriptor=Object.getOwnPropertyDescriptor&&hasMap?Object.getOwnPropertyDescriptor(Map.prototype,"size"):null,mapSize=hasMap&&mapSizeDescriptor&&"function"==typeof mapSizeDescriptor.get?mapSizeDescriptor.get:null,mapForEach=hasMap&&Map.prototype.forEach,hasSet="function"==typeof Set&&Set.prototype,setSizeDescriptor=Object.getOwnPropertyDescriptor&&hasSet?Object.getOwnPropertyDescriptor(Set.prototype,"size"):null,setSize=hasSet&&setSizeDescr...[truncated]
• test/parse.js:1069 shell_process_spawn :: var parts = reg.exec(str);
• test/parse.js:1072 shell_process_spawn :: parts = reg.exec(str);
• dist/qs.js:49 shell_process_spawn :: "use strict";var undefined,$Object=require(22),$Error=require(16),$EvalError=require(15),$RangeError=require(17),$ReferenceError=require(18),$SyntaxError=require(19),$TypeError=require(20),$URIError=require(21),abs=require(34),floor=require(35),max=require(37),min=require(38),pow=require(39),round=require(40),sign=require(41),$Function=Function,getEvalledConstructor=function(r){try{return $Function('"use strict"; return ('+r+").constructor;")()}catch(r){}},$gOPD=require(30),$defineProperty=requi...[truncated]
• README.md:780 network_c2_indicator :: [<img src="https://raw.githubusercontent.com/numi-hq/open-design/main/assets/numi-lockup.png" alt="NUMI Logo" style="width: 200px;"/>](https://numi.tech/?ref=qs)
• test/utils.js:549 obfuscation_indicator :: decodeURIComponent(utils.encode(roundTrip)),
• test/utils.js:551 obfuscation_indicator :: 'a boundary-split surrogate pair round-trips through decodeURIComponent'
• lib/utils.js:208 obfuscation_indicator :: return decodeURIComponent(strWithoutPlus);
• dist/qs.js:14 obfuscation_indicator :: "use strict";var formats=require(1),getSideChannel=require(46),defineProperty=require(14),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,overflowChannel=getSideChannel(),markOverflow=function markOverflow(e,r){return overflowChannel.set(e,r),e},isOverflow=function isOverflow(e){return overflowChannel.has(e)},getMaxIndex=function getMaxIndex(e){return overflowChannel.get(e)},setMaxIndex=function setMaxIndex(e,r){overflowChannel.set(e,r)},hexTable=function(){for(var e=[],r=0;r<256;++r)e...[truncated]
• dist/qs.js:49 obfuscation_indicator :: "use strict";var undefined,$Object=require(22),$Error=require(16),$EvalError=require(15),$RangeError=require(17),$ReferenceError=require(18),$SyntaxError=require(19),$TypeError=require(20),$URIError=require(21),abs=require(34),floor=require(35),max=require(37),min=require(38),pow=require(39),round=require(40),sign=require(41),$Function=Function,getEvalledConstructor=function(r){try{return $Function('"use strict"; return ('+r+").constructor;")()}catch(r){}},$gOPD=require(30),$defineProperty=requi...[truncated]

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8a450be. Configure here.}

[cursor]

Incomplete qs version bump

Medium Severity

The qs bump to 6.16.0 leaves the root overrides pin at 6.15.2 and records ^6.16.0 in the lockfile instead of the exact spec. npm ci can disagree with npm install, so the resolved version may fail the sync check or silently revert.

Additional Locations (2)

• package-lock.json#L30059-L30060
• package-lock.json#L24366-L24369

 

^{Reviewed by Cursor Bugbot for commit 8a450be. Configure here.}