Bump qs, express and @angular/cli #13

dependabot · 2025-12-31T18:32:39Z

Bumps qs to 6.14.1 and updates ancestor dependencies qs, express and @angular/cli. These dependencies need to be updated together.

Updates qs from 6.7.0 to 6.14.1

Changelog

Sourced from qs's changelog.

6.14.1

[Fix] ensure arrayLength applies to [] notation as well

[Fix] parse: when a custom decoder returns null for a key, ignore that key

[Refactor] parse: extract key segment splitting helper

[meta] add threat model

[actions] add workflow permissions

[Tests] stringify: increase coverage

[Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

6.14.0

[New] parse: add throwOnParameterLimitExceeded option (#517)

[Refactor] parse: use utils.combine more

[patch] parse: add explicit throwOnLimitExceeded default

[actions] use shared action; re-add finishers

[meta] Fix changelog formatting bug

[Deps] update side-channel

[Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols

[Tests] increase coverage

6.13.1

[Fix] stringify: avoid a crash when a filter key is null

[Fix] utils.merge: functions should not be stringified into keys

[Fix] parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset

[Fix] stringify: ensure a non-string filter does not crash

[Refactor] use __proto__ syntax instead of Object.create for null objects

[Refactor] misc cleanup

[Tests] utils.merge: add some coverage

[Tests] fix a test case

[actions] split out node 10-20, and 20+

[Dev Deps] update es-value-fixtures, mock-property, object-inspect, tape

6.13.0

[New] parse: add strictDepth option (#511)

[Tests] use npm audit instead of aud

6.12.3

[Fix] parse: properly account for strictNullHandling when allowEmptyArrays

[meta] fix changelog indentation

6.12.2

[Fix] parse: parse encoded square brackets (#506)

[readme] add CII best practices badge

6.12.1

[Fix] parse: Disable decodeDotInKeys by default to restore previous behavior (#501)

[Performance] utils: Optimize performance under large data volumes, reduce memory usage, and speed up processing (#502)

[Refactor] utils: use +=

[Tests] increase coverage

6.12.0

... (truncated)

Commits

3fa11a5 v6.14.1
a626704 [Dev Deps] update npmignore
3086902 [Fix] ensure arrayLength applies to [] notation as well
fc7930e [Dev Deps] update eslint, @ljharb/eslint-config
0b06aac [Dev Deps] update @ljharb/eslint-config
64951f6 [Refactor] parse: extract key segment splitting helper
e1bd259 [Dev Deps] update @ljharb/eslint-config
f4b3d39 [eslint] add eslint 9 optional peer dep
6e94d95 [Dev Deps] update eslint, @ljharb/eslint-config, npmignore
973dc3c [actions] add workflow permissions
Additional commits viewable in compare view

Updates express from 4.17.1 to 4.22.1

Release notes

Sourced from express's releases.

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Release: 4.22.1 by @UlisesGascon in expressjs/express#6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

Refactor: improve readability by @sazk07 in expressjs/express#6190

ci: add support for [email protected] by @UlisesGascon in expressjs/express#6080

Method functions with no path should error by @wesleytodd in expressjs/express#5957

ci: updated github actions ci workflow by @Phillip9587 in expressjs/express#6323

ci: reorder npm i steps to fix ci for older node versions by @Phillip9587 in expressjs/express#6336

Backport: ci: add node.js 24 to test matrix by @Phillip9587 in expressjs/express#6506

chore(4.x): wider range for query test skip by @jonchurch in expressjs/express#6513

use tilde notation for certain dependencies by @UlisesGascon in expressjs/express#6905

deps: [email protected] by @UlisesGascon in expressjs/express#6909

deps: use tilde notation for qs by @Phillip9587 in expressjs/express#6919

Release: 4.22.0 by @UlisesGascon in expressjs/express#6921

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Add funding field (v4) by @bjohansebas in expressjs/express#6065

deps: [email protected] by @blakeembrey in expressjs/express#5956

deps: bump [email protected] by @jonchurch in expressjs/express#6209

Release: 4.21.2 by @UlisesGascon in expressjs/express#6094

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in expressjs/express#6029

Release: 4.21.1 by @UlisesGascon in expressjs/express#6031

Full Changelog: expressjs/express@4.21.0...4.21.1

... (truncated)

Changelog

Sourced from express's changelog.

4.22.1 / 2025-12-01

Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

4.22.0 / 2025-12-01

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

deps: use tilde notation for dependencies

deps: [email protected]

4.21.2 / 2024-11-06

deps: [email protected]

Fix backtracking protection

deps: [email protected]

Throws an error on invalid path values

4.21.1 / 2024-10-08

Backported a fix for CVE-2024-47764

4.21.0 / 2024-09-11

Deprecate res.location("back") and res.redirect("back") magic string

deps: [email protected]

includes [email protected]

deps: [email protected]

deps: [email protected]

4.20.0 / 2024-09-10

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: [email protected]

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

... (truncated)

Commits

12fae14 4.22.1
5ddf311 Revert "sec: security patch for CVE-2024-51999"
49744ab 4.22.0 (#6921)
6e97452 sec: security patch for CVE-2024-51999
6a23d34 deps: use tilde notation for qs (#6919)
8c12cdf deps: [email protected] (#6909)
7fea74f deps: use tilde notation for certain dependencies (#6905)
dac7a04 chore: wider range for query test skip (#6513)
997919b ci: add node.js 24 to test matrix (#6506)
36fb59c fix(ci): reorder npm i steps to fix ci for older node versions (#6336)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.

Updates @angular/cli from 11.2.8 to 21.0.4

Release notes

Sourced from @angular/cli's releases.

21.0.4

@schematics/angular

Commit Description

improve VS Code background compilation start/end detection

remove inlineSources from library tsconfig template

@angular/build

Commit Description

add browser condition to resolver for vitest

allow non-prefixed requests when using SSR and base href

conditionally manage Vitest UI option

ensure tests run when compilation error is resolved

remove LmdbCacheStore export from private API

@angular/ssr

Commit Description

add leading slash to well-known non-Angular URLs

propagate status code to redirect

skip SSR processing for well-known non-Angular URLs like favicon.ico

21.0.3

@angular-devkit/build-angular

Commit Description

conditionally provide Zone.js change detection in the built-in test main file

@angular/build

Commit Description

Add custom middleware for to present an Angular-tailored message

Ensure disposal of close-javascript-transformer

ensure locale base href retains leading slash (#32040)

inject testing polyfills in Karma unit-test executor

support NODE_EXTRA_CA_CERTS in SSR SSL plugin

21.0.2

@angular/cli

Commit Description

update @modelcontextprotocol/sdk to v1.24.0

@angular-devkit/schematics

Commit Description

remove lazy imports in node tasks

@angular/build

Commit Description

add filename truncation to test discovery

allow overriding Vitest coverage reportsDirectory option

... (truncated)

Changelog

Sourced from @angular/cli's changelog.

21.0.4 (2025-12-18)

@schematics/angular

Commit Type Description

b671245b9 fix improve VS Code background compilation start/end detection

85a28dec7 fix remove inlineSources from library tsconfig template

@angular/build

Commit Type Description

deb4fff61 fix add browser condition to resolver for vitest

570ce8d3e fix allow non-prefixed requests when using SSR and base href

4dd3c1a32 fix conditionally manage Vitest UI option

4b8b7caec fix ensure tests run when compilation error is resolved

bef4fcecb fix remove LmdbCacheStore export from private API

@angular/ssr

Commit Type Description

bb54747da fix add leading slash to well-known non-Angular URLs

0cfe2e749 fix propagate status code to redirect

eadadb848 fix skip SSR processing for well-known non-Angular URLs like favicon.ico

21.1.0-next.2 (2025-12-10)

@angular/cli

Commit Type Description

d8b76e93d fix correctly handle yarn classic tag manifest fetching

7ab5c0b0a fix correctly spawn package managers on Windows in new abstraction

240588b7e perf optimize ng add version discovery

@angular-devkit/build-angular

Commit Type Description

985aa18d0 fix conditionally provide Zone.js change detection in the built-in test main file

@angular/build

| Commit | Type | Description |

... (truncated)

Commits

b8829e2 release: cut the v21.0.4 release
46ccf30 build: update pnpm to v10.26.0
93a018a build: update cross-repo angular dependencies
0d2735c refactor: directly set responseInit.status by removing type assertion and T...
3b3afb1 build: update cross-repo angular dependencies
8794802 build: update dependency webpack to v5.104.0
6bbfa89 build: update github/codeql-action action to v4.31.9
570ce8d fix(@angular/build): allow non-prefixed requests when using SSR and base href
8b720fa build: lock file maintenance
0cfe2e7 fix(@angular/ssr): propagate status code to redirect
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [qs](https://github.com/ljharb/qs) to 6.14.1 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [express](https://github.com/expressjs/express) and [@angular/cli](https://github.com/angular/angular-cli). These dependencies need to be updated together. Updates `qs` from 6.7.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.7.0...v6.14.1) Updates `express` from 4.17.1 to 4.22.1 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.1/History.md) - [Commits](expressjs/express@4.17.1...v4.22.1) Updates `@angular/cli` from 11.2.8 to 21.0.4 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v11.2.8...v21.0.4) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect - dependency-name: express dependency-version: 4.22.1 dependency-type: indirect - dependency-name: "@angular/cli" dependency-version: 21.0.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 31, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump qs, express and @angular/cli #13

Bump qs, express and @angular/cli #13

Uh oh!

dependabot bot commented on behalf of github Dec 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Commit	Description
	improve VS Code background compilation start/end detection
	remove `inlineSources` from library tsconfig template

Commit	Description
	add browser condition to resolver for vitest
	allow non-prefixed requests when using SSR and base href
	conditionally manage Vitest UI option
	ensure tests run when compilation error is resolved
	remove LmdbCacheStore export from private API

Commit	Description
	add leading slash to well-known non-Angular URLs
	propagate status code to redirect
	skip SSR processing for well-known non-Angular URLs like favicon.ico

Commit	Description
	Add custom middleware for to present an Angular-tailored message
	Ensure disposal of close-javascript-transformer
	ensure locale base href retains leading slash (#32040)
	inject testing polyfills in Karma unit-test executor
	support NODE_EXTRA_CA_CERTS in SSR SSL plugin

Commit	Description
	add filename truncation to test discovery
	allow overriding Vitest coverage `reportsDirectory` option

Commit	Type	Description
b671245b9	fix	improve VS Code background compilation start/end detection
85a28dec7	fix	remove `inlineSources` from library tsconfig template

Commit	Type	Description
deb4fff61	fix	add browser condition to resolver for vitest
570ce8d3e	fix	allow non-prefixed requests when using SSR and base href
4dd3c1a32	fix	conditionally manage Vitest UI option
4b8b7caec	fix	ensure tests run when compilation error is resolved
bef4fcecb	fix	remove LmdbCacheStore export from private API

Commit	Type	Description
bb54747da	fix	add leading slash to well-known non-Angular URLs
0cfe2e749	fix	propagate status code to redirect
eadadb848	fix	skip SSR processing for well-known non-Angular URLs like favicon.ico

Commit	Type	Description
d8b76e93d	fix	correctly handle yarn classic tag manifest fetching
7ab5c0b0a	fix	correctly spawn package managers on Windows in new abstraction
240588b7e	perf	optimize `ng add` version discovery

Bump qs, express and @angular/cli #13

Are you sure you want to change the base?

Bump qs, express and @angular/cli #13

Uh oh!

Conversation

dependabot bot commented on behalf of github Dec 31, 2025

6.14.1

6.14.0

6.13.1

6.13.0

6.12.3

6.12.2

6.12.1

6.12.0

v4.22.1

What's Changed

4.22.0

Important: Security

What's Changed

4.21.2

What's Changed

4.21.1

What's Changed

4.22.1 / 2025-12-01

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

4.20.0 / 2024-09-10

21.0.4

@​schematics/angular

@​angular/build

@​angular/ssr

21.0.3

@​angular-devkit/build-angular

@​angular/build

21.0.2

@​angular/cli

@​angular-devkit/schematics

@​angular/build

21.0.4 (2025-12-18)

@​schematics/angular

@​angular/build

@​angular/ssr

21.1.0-next.2 (2025-12-10)

@​angular/cli

@​angular-devkit/build-angular

@​angular/build

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`@schematics/angular`

`@angular/build`

`@angular/ssr`

`@angular-devkit/build-angular`

`@angular/build`

`@angular/cli`

`@angular-devkit/schematics`

`@angular/build`

`@schematics/angular`

`@angular/build`

`@angular/ssr`

`@angular/cli`

`@angular-devkit/build-angular`

`@angular/build`