[dependabot]

Bumps qs to 6.16.2 and updates ancestor dependencies qs, express and cypress. These dependencies need to be updated together.

Updates qs from 6.16.0 to 6.16.2

Changelog

Sourced from qs's changelog.

6.16.2

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)
• [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
• [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
• [Docs] document that qs and flat parsers disagree about parameter names
• [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
• [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
• [meta] fix changelog indents
• [actions] set least-privilege cache-mode
• [Tests] utils: decode: add missing cases
• [Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
• [Tests] parse: allowDots: cover stray close brackets before a dot
• [Dev Deps] update @ljharb/eslint-config, eslint, tape

Commits

• 136912a v6.16.2
• 6ed1c73 [Dev Deps] update evalmd, npmignore
• a09bc29 [meta] use double quotes for better OS support
• 5d3b1b9 [Fix] stringify: encode keys when allowEmptyArrays is set
• f13ec6c [Tests] stringify: pin allowEmptyArrays output for keys that need no enco...
• 2471b66 v6.16.1
• 51f736e [Docs] document that qs and flat parsers disagree about parameter names
• 40239f7 [Dev Deps] update tape
• d219359 [Fix] parse: do not mutate an object input
• 98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
• Additional commits viewable in compare view

Updates express from 4.22.0 to 4.22.3

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

New Contributors

• @​suuuuuuminnnnnn made their first contribution in expressjs/express#7021
• @​SAY-5 made their first contribution in expressjs/express#7181

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

• Release: 4.22.1 by @​UlisesGascon in expressjs/express#6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

Changelog

Sourced from express's changelog.

4.22.3

• Allow conditional revalidation for QUERY requests
  • req.fresh now includes QUERY in the freshness check, so QUERY responses can return 304 when a validator matches
• deps: qs@~6.16.0

4.22.2

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

4.22.1

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Commits

• 899b524 4.22.3 (#7466)
• 1fad2c3 ci: add npm staged publication with dist-tag support (#7465)
• 4138650 deps: qs@~6.16.0 (#7440)
• 61ccf2e feat: allow conditional revalidation for QUERY requests (v4) (#7377)
• 715101b Update path-to-regexp to 0.1.13 because CVE-2026-4867 (#7135)
• f472e5f docs: fix the release date format for 4.22.2
• df0abc9 4.22.2
• 836d366 4.x update qs to 6.15.1, body-parser 1.20.5 (#7224)
• 8d09bfe fix: restore array parsing for req.query repeated keys (#7181)
• d39e8ad deps: body-parser@~1.20.4 (#7021)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates cypress from 14.5.3 to 16.2.1

Release notes

Sourced from cypress's releases.

v16.2.1

Changelog: https://docs.cypress.io/app/references/changelog#16-2-1

v16.2.0

Changelog: https://docs.cypress.io/app/references/changelog#16-2-0

v16.1.1

Changelog: https://docs.cypress.io/app/references/changelog#16-1-1

v16.1.0

Changelog: https://docs.cypress.io/app/references/changelog#16-1-0

v16.0.0

Changelog: https://docs.cypress.io/app/references/changelog#16-0-0

v15.21.1

Changelog: https://docs.cypress.io/app/references/changelog#15-21-1

v15.21.0

Changelog: https://docs.cypress.io/app/references/changelog#15-21-0

v15.20.1

Changelog: https://docs.cypress.io/app/references/changelog#15-20-1

v15.20.0

Changelog: https://docs.cypress.io/app/references/changelog#15-20-0

v15.19.0

Changelog: https://docs.cypress.io/app/references/changelog#15-19-0

v15.18.1

Changelog: https://docs.cypress.io/app/references/changelog#15-18-1

v15.18.0

Changelog: https://docs.cypress.io/app/references/changelog#15-18-0

v15.17.0

Changelog: https://docs.cypress.io/app/references/changelog#15-17-0

v15.16.0

Changelog: https://docs.cypress.io/app/references/changelog#15-16-0

v15.15.0

Changelog: https://docs.cypress.io/app/references/changelog#15-15-0

v15.14.2

Changelog: https://docs.cypress.io/app/references/changelog#15-14-2

v15.14.1

Changelog: https://docs.cypress.io/app/references/changelog#15-14-1

... (truncated)

Commits

• 519d66d chore: migrate @​packages/reporter to @​packages/eslint-config (#35179)
• 75df26c chore: migrate @​packages/telemetry to the shared ESLint flat config (#35178)
• a4c26a3 chore(packages/runner): migrate to @​packages/eslint-config (#35175)
• 0a5e2aa chore: fix @​ts- comments in driver test code for ban-ts-comment (#35177)
• aec6bfe chore: migrate @​packages/example to the shared ESLint flat config (#35174)
• 868c50f chore: give driver src @​ts-expect-error directives a reason (#35176)
• e7da585 chore: migrate net-stubbing, network, network-tools and socket to @​packages/e...
• 86458df chore(packages/config): migrate to @​packages/eslint-config (#35172)
• 89e48b9 chore: migrate packages/extension to @​packages/eslint-config (#35170)
• 409efa3 chore: enable prefer-const in the shared ESLint flat config (#35169)
• Additional commits viewable in compare view

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.