Describe the Bug
Security update: upgrade qs to 6.14.1 introduces breaking change in qs.parse
Context
To address security vulnerabilities, we need to upgrade Directus 9 API to use qs@6.14.1.
However, this patch version introduces a breaking change in qs.parse behavior, as described here:
Problem
After upgrading to qs@6.14.1, we observed that existing blackbox tests are failing, indicating a behavioral change in query parsing that affects real API usage scenarios.
Proposal
Introduce an environment variable with default value to explicitly control the affected qs.parse option, allowing us to:
- Preserve backward compatibility by default
- Give users a clear opt-in path to the new behavior
- Avoid a massive breaking change during a security-driven upgrade
Open Question
Which default value should we choose for this configuration?
To Reproduce
- In api/package.json, update:
- "qs": "6.14.0"
- Update dependencies using pnpm
- Run the blackbox test suite
- Observe failures, notably during m2o-related tests
Directus Version
v11.0.7
Hosting Strategy
Self-Hosted (Docker Image)
Describe the Bug
Security update: upgrade qs to 6.14.1 introduces breaking change in qs.parse
Context
To address security vulnerabilities, we need to upgrade Directus 9 API to use qs@6.14.1.
However, this patch version introduces a breaking change in qs.parse behavior, as described here:
Problem
After upgrading to qs@6.14.1, we observed that existing blackbox tests are failing, indicating a behavioral change in query parsing that affects real API usage scenarios.
Proposal
Introduce an environment variable with default value to explicitly control the affected qs.parse option, allowing us to:
Open Question
Which default value should we choose for this configuration?
To Reproduce
Directus Version
v11.0.7
Hosting Strategy
Self-Hosted (Docker Image)