Skip to content

chore(deps): bump qs, @google-cloud/functions-framework and body-parser in /ops/functions - #2937

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ops/functions/multi-30c998b3cd
Open

chore(deps): bump qs, @google-cloud/functions-framework and body-parser in /ops/functions#2937
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ops/functions/multi-30c998b3cd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps qs to 6.16.0 and updates ancestor dependencies qs, @google-cloud/functions-framework and body-parser. These dependencies need to be updated together.

Updates qs from 6.10.3 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

  • [New] stringify: add a depth option to bound recursion depth (default Infinity)
  • [Fix] stringify: serialize Date values when a filter is provided
  • [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
  • [Fix] parse: flatten a collection appended to an overflowed array (#571)
  • [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
  • [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
  • [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
  • [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
  • [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
  • [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
  • [Dev Deps] update @ljharb/eslint-config, eslint
  • [Dev Deps] update eslint, evalmd

6.15.3

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
  • [Deps] update side-channel
  • [Dev Deps] update eslint, mock-property, tape
  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
  • [Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
  • [readme] fix grammar (#550)
  • [Dev Deps] update @ljharb/eslint-config
  • [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
  • [Deps] update @ljharb/eslint-config
  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
  • [Tests] increase coverage

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

... (truncated)

Commits
  • bb9379e v6.16.0
  • 62fd254 [Fix] stringify: serialize Date values when a filter is provided
  • 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
  • 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
  • d56f48c [Fix] parse: flatten a collection appended to an overflowed array
  • e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
  • 9a76af2 [Dev Deps] update eslint, evalmd
  • 3a890d4 [Dev Deps] update eslint, evalmd
  • b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
  • Additional commits viewable in compare view

Updates @google-cloud/functions-framework from 3.1.2 to 5.0.5

Release notes

Sourced from @​google-cloud/functions-framework's releases.

v5.0.5

5.0.5 (2026-06-29)

Bug Fixes

v5.0.4

5.0.4 (2026-06-24)

Bug Fixes

  • decode only the viewed bytes of Uint8Array log data (#772) (8b780fc)

v5.0.3

5.0.3 (2026-06-22)

Bug Fixes

  • add typesVersions so testing module resolves under classic TypeScript moduleResolution (#770) (d1593c2)
  • deps: bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/esm (#760) (5f58e79)
  • deps: bump qs, body-parser and express in /docs/esm (#761) (308a16e)

v5.0.2

5.0.2 (2026-02-18)

Bug Fixes

  • correct deprecated API usage and source comment typos (#741) (8d3ac85)
  • deps: bump qs from 6.14.1 to 6.15.0 (#739) (6c6b444)

v5.0.1

5.0.1 (2026-02-06)

Bug Fixes

v5.0.0

5.0.0 (2025-12-30)

⚠ BREAKING CHANGES

  • update dependency express to v5 (#726)

... (truncated)

Changelog

Sourced from @​google-cloud/functions-framework's changelog.

5.0.5 (2026-06-29)

Bug Fixes

5.0.4 (2026-06-24)

Bug Fixes

  • decode only the viewed bytes of Uint8Array log data (#772) (8b780fc)

5.0.3 (2026-06-22)

Bug Fixes

  • add typesVersions so testing module resolves under classic TypeScript moduleResolution (#770) (d1593c2)
  • deps: bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/esm (#760) (5f58e79)
  • deps: bump qs, body-parser and express in /docs/esm (#761) (308a16e)

5.0.2 (2026-02-18)

Bug Fixes

  • correct deprecated API usage and source comment typos (#741) (8d3ac85)
  • deps: bump qs from 6.14.1 to 6.15.0 (#739) (6c6b444)

5.0.1 (2026-02-06)

Bug Fixes

5.0.0 (2025-12-30)

⚠ BREAKING CHANGES

  • update dependency express to v5 (#726)

Miscellaneous Chores

4.0.1 (2025-11-20)

... (truncated)

Commits
  • f39924d chore(main): release 5.0.5 (#775)
  • 85344d0 fix(deps): Update dependencies (#774)
  • 817c233 chore(main): release 5.0.4 (#773)
  • 8b780fc fix: decode only the viewed bytes of Uint8Array log data (#772)
  • 7d08f3b chore: correct SCM path prefix for GoB (#771)
  • f1fa1ab chore(main): release 5.0.3 (#769)
  • 2115956 chore(deps): update dependency pack-n-play to v4 (#757)
  • edc6ed1 chore(deps): update dependency @​types/supertest to v7 (#753)
  • d1593c2 fix: add typesVersions so testing module resolves under classic TypeScript mo...
  • 5f58e79 fix(deps): bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/esm (#760)
  • Additional commits viewable in compare view

Updates body-parser from 1.20.0 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

v2.2.2

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0

2.2.2 / 2026-01-07

  • deps: qs@^6.14.1
  • refactor(json): simplify strict mode error string construction

2.2.1 / 2025-11-24

  • Security fix for GHSA-wqch-xfxh-vrr4
  • deps:
    • type-is@^2.0.1
    • iconv-lite@^0.7.0
      • Handle split surrogate pairs when encoding UTF-8
      • Avoid false positives in encodingExists by using prototype-less objects
    • raw-body@^3.0.1
    • debug@^4.4.3

2.2.0 / 2025-03-27

  • refactor: normalize common options for all parsers
  • deps:
    • iconv-lite@^0.6.3

2.1.0 / 2025-02-10

  • deps:
    • type-is@^2.0.0
    • debug@^4.4.0
    • Removed destroy
  • refactor: prefix built-in node module imports

... (truncated)

Commits
  • d0f2ace 2.3.0 (#735)
  • 7d03f2f chore: updated deps to latest (#733)
  • 8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
  • 32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
  • ff0f6b9 docs: update outdated reference to MDN docs (#730)
  • 14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
  • 37f36a2 deps: update content-type and type-is (#728)
  • e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
  • e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
  • a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump qs, @google-cloud/functions-framework and body-parser
86bfc37 
Bumps [qs](https://github.com/ljharb/qs) to 6.16.0 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [@google-cloud/functions-framework](https://github.com/GoogleCloudPlatform/functions-framework-nodejs) and [body-parser](https://github.com/expressjs/body-parser). These dependencies need to be updated together.


Updates `qs` from 6.10.3 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.10.3...v6.16.0)

Updates `@google-cloud/functions-framework` from 3.1.2 to 5.0.5
- [Release notes](https://github.com/GoogleCloudPlatform/functions-framework-nodejs/releases)
- [Changelog](https://github.com/GoogleCloudPlatform/functions-framework-nodejs/blob/main/CHANGELOG.md)
- [Commits](GoogleCloudPlatform/functions-framework-nodejs@v3.1.2...v5.0.5)

Updates `body-parser` from 1.20.0 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.0...v2.3.0)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
- dependency-name: "@google-cloud/functions-framework"
  dependency-version: 5.0.5
  dependency-type: direct:production
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 2, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 2, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MikeSofaer MikeSofaer Awaiting requested review from MikeSofaer MikeSofaer is a code owner
@faisalnaveedRNS faisalnaveedRNS Awaiting requested review from faisalnaveedRNS faisalnaveedRNS is a code owner
@kjawadDeveloper2 kjawadDeveloper2 Awaiting requested review from kjawadDeveloper2 kjawadDeveloper2 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code [zube]: In Progress

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants