Conversation
Bumps [qs](https://github.com/ljharb/qs) to 6.14.1 and updates ancestor dependency [express](https://github.com/expressjs/express). These dependencies need to be updated together. Updates `qs` from 6.5.1 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.1...v6.14.1) Updates `express` from 4.16.3 to 4.22.1 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.1/History.md) - [Commits](expressjs/express@4.16.3...v4.22.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect - dependency-name: express dependency-version: 4.22.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
|
|
✓ Safe to upgradeI recommend merging this upgrade because it includes critical security fixes for prototype pollution vulnerabilities in both qs and express packages without introducing breaking changes that affect this codebase. The application uses express.urlencoded with extended: false, meaning it doesn't rely on the qs parser where breaking changes occurred. No deprecated patterns (res.redirect('back'), res.clearCookie with maxAge, non-integer res.status values) were found in the codebase. This upgrade patches multiple High severity security vulnerabilities including CVE-2024-51999 and CVE-2024-47764. What we checked
Dependency UsageExpress serves as the core web framework for this Node.js RESTful application, powering the main application setup with middleware (logging, cookie parsing, error handling), route definitions for the home page, and database-backed API endpoints for user data retrieval. The qs package is installed as a transitive dependency of Express but has no direct usage in the application code, indicating it's used internally by Express for query string parsing. The architecture follows a standard Express pattern with centralized configuration in app.js, modular routing, and a server bootstrap script that launches the application on a configurable port.
View 2 more usages
Less Important Usages (1)These usages were analyzed but no breaking changes were detected: express
ChangesThe qs package upgrade addresses 21 critical security vulnerabilities, including prototype pollution protections (
View 589 more changes
View 492 more changes in the full analysis References (6)[1]: Application uses express.urlencoded({ extended: false }), which means it doesn't use the qs parser. Breaking changes in qs (depth limits, cycle detection) don't affect this application since extended: false uses the querystring library instead Line 23 in 73ef5f7 [2]: Express upgraded to 4.22.1 - staying within v4.x branch, so Express 5 breaking changes don't apply node-restful-app/package-lock.json Line 521 in 73ef5f7 [3]: qs upgraded to 6.14.1 with critical security fixes for prototype pollution (proto keys) and safer-buffer usage node-restful-app/package-lock.json Line 1204 in 73ef5f7 [4]: res.status usage with numeric expression (err.status || 500) is compatible - no string or non-integer values used Line 48 in 73ef5f7 [5]: No req.query usage found in user routes - application doesn't parse or modify query parameters node-restful-app/routes/users.js Line 1 in 73ef5f7 [6]: No res.redirect or res.clearCookie usage in routes - deprecated patterns not present in codebase node-restful-app/routes/index.js Line 1 in 73ef5f7 fossabot analyzed this PR using static analysis and dependency research. View this analysis on the web |
Bumps qs to 6.14.1 and updates ancestor dependency express. These dependencies need to be updated together.
Updates
qsfrom 6.5.1 to 6.14.1Changelog
Sourced from qs's changelog.
... (truncated)
Commits
3fa11a5v6.14.1a626704[Dev Deps] updatenpmignore3086902[Fix] ensure arrayLength applies to[]notation as wellfc7930e[Dev Deps] updateeslint,@ljharb/eslint-config0b06aac[Dev Deps] update@ljharb/eslint-config64951f6[Refactor]parse: extract key segment splitting helpere1bd259[Dev Deps] update@ljharb/eslint-configf4b3d39[eslint] add eslint 9 optional peer dep6e94d95[Dev Deps] updateeslint,@ljharb/eslint-config,npmignore973dc3c[actions] add workflow permissionsUpdates
expressfrom 4.16.3 to 4.22.1Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
... (truncated)
Commits
12fae144.22.15ddf311Revert "sec: security patch for CVE-2024-51999"49744ab4.22.0 (#6921)6e97452sec: security patch for CVE-2024-519996a23d34deps: use tilde notation forqs(#6919)8c12cdfdeps: qs@6.14.0 (#6909)7fea74fdeps: use tilde notation for certain dependencies (#6905)dac7a04chore: wider range for query test skip (#6513)997919bci: add node.js 24 to test matrix (#6506)36fb59cfix(ci): reordernpm isteps to fix ci for older node versions (#6336)Maintainer changes
This version was pushed to npm by jonchurch, a new releaser for express since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.