chore(deps): bump qs from 6.15.0 to 6.16.0 by dependabot[bot] · Pull Request #258 · strataljs/stratal

dependabot · 2026-09-02T18:59:42Z

Bumps qs from 6.15.0 to 6.16.0.

Changelog

6.16.0

[New] stringify: add a depth option to bound recursion depth (default Infinity)

[Fix] stringify: serialize Date values when a filter is provided

[Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set

[Fix] parse: flatten a collection appended to an overflowed array (#571)

[Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer

[Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties

[Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)

[Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded

[Docs] clarify arrayLimit is a representation threshold, not an element-count cap

[Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit

[Tests] stringify: pin current encodeDotInKeys separator-dot behavior

[Dev Deps] update @ljharb/eslint-config, eslint

[Dev Deps] update eslint, evalmd

6.15.3

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge

[Fix] utils: respect encoding of surrogate pairs across chunks (#559)

[Robustness] parse: throw the arrayLimit error before splitting oversized comma values

[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties

[Robustness] utils: enforce arrayLimit consistently across merge's array paths

[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf

[Deps] update side-channel

[Dev Deps] update eslint, mock-property, tape

[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

[Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters

[Deps] update @ljharb/eslint-config

[Dev Deps] update @ljharb/eslint-config, iconv-lite

[Tests] increase coverage

Commits

bb9379e v6.16.0
62fd254 [Fix] stringify: serialize Date values when a filter is provided
8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
d56f48c [Fix] parse: flatten a collection appended to an overflowed array
e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
9a76af2 [Dev Deps] update eslint, evalmd
3a890d4 [Dev Deps] update eslint, evalmd
b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
Additional commits viewable in compare view

adesege

Benchmark

Details

Benchmark suite	Current: `509942f`	Previous: `ccb3f17`	Ratio
`test/benchmarks/request-response.bench.ts > Request/Response > simple GET - 200`	`66486.52120679597` ops/sec (`±1.20%`)	`44355.827899388205` ops/sec (`±1.52%`)	`0.67`
`test/benchmarks/request-response.bench.ts > Request/Response > GET with route params - 200`	`69883.48356105018` ops/sec (`±0.58%`)	`49077.55133303189` ops/sec (`±1.07%`)	`0.70`
`test/benchmarks/request-response.bench.ts > Request/Response > POST with JSON body - 201`	`37394.942171875045` ops/sec (`±0.88%`)	`24127.579263272528` ops/sec (`±1.28%`)	`0.65`
`test/benchmarks/request-response.bench.ts > Request/Response > POST invalid body - validation error`	`6667.225828405841` ops/sec (`±2.26%`)	`4332.798367697519` ops/sec (`±3.08%`)	`0.65`
`test/benchmarks/request-response.bench.ts > Request/Response > GET unknown route - 404`	`11058.389986884871` ops/sec (`±1.08%`)	`6877.491973422911` ops/sec (`±1.38%`)	`0.62`
`src/__benchmarks__/application.bench.ts > Application - Bootstrap > constructor only`	`464833.4598635414` ops/sec (`±0.43%`)	`367439.1967778971` ops/sec (`±2.58%`)	`0.79`
`src/__benchmarks__/application.bench.ts > Application - Bootstrap > full initialize()`	`59791.65428465351` ops/sec (`±0.96%`)	`40916.51636711715` ops/sec (`±2.82%`)	`0.68`
`src/__benchmarks__/application.bench.ts > Application - Service Resolution > resolve service after bootstrap`	`60880.42965019222` ops/sec (`±1.16%`)	`46221.77899438597` ops/sec (`±1.51%`)	`0.76`
`src/__benchmarks__/application.bench.ts > Application - Multi-Controller Bootstrap > initialize with 5 controllers (8 routes)`	`61535.42021327282` ops/sec (`±0.78%`)	`47297.584538015675` ops/sec (`±0.94%`)	`0.77`
`src/__benchmarks__/application.bench.ts > Application - Multi-Controller Bootstrap > resolve service after multi-controller bootstrap`	`61440.71748646264` ops/sec (`±0.66%`)	`46712.398512126` ops/sec (`±0.86%`)	`0.76`
`src/di/__benchmarks__/container.bench.ts > Container - Registration > register class provider`	`5785683.560288294` ops/sec (`±1.27%`)	`3659523.004609583` ops/sec (`±0.26%`)	`0.63`
`src/di/__benchmarks__/container.bench.ts > Container - Registration > registerSingleton`	`5518980.598179397` ops/sec (`±0.18%`)	`3674735.919157303` ops/sec (`±0.23%`)	`0.67`
`src/di/__benchmarks__/container.bench.ts > Container - Registration > registerValue`	`6018743.951850158` ops/sec (`±0.94%`)	`3643329.0527346027` ops/sec (`±0.97%`)	`0.61`
`src/di/__benchmarks__/container.bench.ts > Container - Registration > registerFactory`	`5992994.549692975` ops/sec (`±0.80%`)	`3731349.291036125` ops/sec (`±0.79%`)	`0.62`
`src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve class token`	`1852280.5441101394` ops/sec (`±0.56%`)	`1231183.1036989056` ops/sec (`±0.71%`)	`0.66`
`src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve symbol token`	`1830761.4837292894` ops/sec (`±0.59%`)	`1316018.4734202325` ops/sec (`±0.72%`)	`0.72`
`src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve value token`	`2639940.2206800827` ops/sec (`±0.18%`)	`1783899.5774658315` ops/sec (`±0.30%`)	`0.68`
`src/di/__benchmarks__/container.bench.ts > Container - Resolution > resolve singleton token`	`1748698.527084491` ops/sec (`±0.45%`)	`1315930.5814242992` ops/sec (`±0.55%`)	`0.75`
`src/di/__benchmarks__/container.bench.ts > Container - Resolution > isRegistered check`	`2736087.1627581296` ops/sec (`±0.11%`)	`1806360.778904609` ops/sec (`±0.19%`)	`0.66`
`src/di/__benchmarks__/container.bench.ts > Container - Conditional Binding > when().use().give().otherwise()`	`3277248.754648199` ops/sec (`±2.53%`)	`1989351.3462046375` ops/sec (`±2.25%`)	`0.61`
`src/di/__benchmarks__/container.bench.ts > Container - Conditional Binding > when() with cached predicate`	`3284303.8095181887` ops/sec (`±0.59%`)	`2077218.3049918814` ops/sec (`±0.64%`)	`0.63`
`src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register single module`	`1751389.5516443728` ops/sec (`±0.36%`)	`1318623.2747570868` ops/sec (`±0.43%`)	`0.75`
`src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register 3-level module tree`	`883796.2341752087` ops/sec (`±0.41%`)	`674368.8967327109` ops/sec (`±0.61%`)	`0.76`
`src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Registration > register dynamic module (forRoot)`	`1430449.6280831464` ops/sec (`±0.58%`)	`1033574.8692689876` ops/sec (`±0.46%`)	`0.72`
`src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Initialization > initialize with lifecycle hooks`	`1062925.9549306047` ops/sec (`±0.57%`)	`861264.3797109328` ops/sec (`±0.67%`)	`0.81`
`src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllControllers`	`781479.2169575695` ops/sec (`±2.57%`)	`601067.2979531069` ops/sec (`±0.70%`)	`0.77`
`src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllConsumers`	`766671.2149290154` ops/sec (`±0.42%`)	`598005.5897686194` ops/sec (`±2.06%`)	`0.78`
`src/module/__benchmarks__/module-registry.bench.ts > ModuleRegistry - Collection > getAllJobs`	`792300.0525269357` ops/sec (`±1.53%`)	`606220.5693193878` ops/sec (`±0.44%`)	`0.77`
`src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register controller with 5 OpenAPI routes`	`29715.5691242472` ops/sec (`±6.25%`)	`20659.201604495036` ops/sec (`±7.81%`)	`0.70`
`src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register single-route controller`	`117053.23063687033` ops/sec (`±8.15%`)	`87549.06480088776` ops/sec (`±9.59%`)	`0.75`
`src/router/__benchmarks__/route-registration.bench.ts > RouteRegistration - Configure > register multiple controllers`	`27171.44113779702` ops/sec (`±6.25%`)	`20055.348642388202` ops/sec (`±7.48%`)	`0.74`
`src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 10 routes by specificity`	`478725.1114863042` ops/sec (`±0.41%`)	`348297.84898624144` ops/sec (`±1.02%`)	`0.73`
`src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 50 routes by specificity`	`87141.06061936283` ops/sec (`±0.40%`)	`66342.982298651` ops/sec (`±0.49%`)	`0.76`
`src/router/__benchmarks__/route-registration.bench.ts > Route Sorting > sort 100 routes by specificity`	`42059.2776739615` ops/sec (`±0.40%`)	`32949.193140155745` ops/sec (`±0.54%`)	`0.78`
`src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - static path`	`16091272.358737111` ops/sec (`±0.09%`)	`12503091.774915366` ops/sec (`±0.09%`)	`0.78`
`src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - single param`	`2576059.953629312` ops/sec (`±0.49%`)	`2209847.5226742206` ops/sec (`±1.46%`)	`0.86`
`src/router/__benchmarks__/route-registration.bench.ts > Param Extraction > extractParamNames - multiple params`	`1809526.8889498112` ops/sec (`±0.48%`)	`1332989.981337998` ops/sec (`±0.60%`)	`0.74`

This comment was automatically generated by workflow using github-action-benchmark.

Bumps [qs](https://github.com/ljharb/qs) from 6.15.0 to 6.16.0. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.0...v6.16.0) --- updated-dependencies: - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-20T19:16:03Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: strataljs/stratal/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: a43e8ad6-dd45-470c-af68-2453824a46f9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot · 2026-09-20T21:18:16Z

Looks like qs is up-to-date now, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 2, 2026

dependabot Bot mentioned this pull request Sep 2, 2026

chore(deps): bump qs from 6.15.0 to 6.15.3 #223

Closed

adesege reviewed Sep 2, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/qs-6.16.0 branch from f1c7c5c to 509942f Compare September 20, 2026 19:15

dependabot Bot closed this Sep 20, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/qs-6.16.0 branch September 20, 2026 21:18

Navigation Menu

chore(deps): bump qs from 6.15.0 to 6.16.0 - #258

chore(deps): bump qs from 6.15.0 to 6.16.0#258
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/qs-6.16.0

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

Uh oh!

adesege left a comment •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 20, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

6.16.0

6.15.3

6.15.2

6.15.1

Uh oh!

adesege left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Benchmark

Uh oh!

coderabbitai Bot commented Sep 20, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

adesege left a comment •

edited

Loading