Skip to content

Bump qs, http-server and express in /samples/graphiql-client - #594

Open
dependabot[bot] wants to merge 28 commits into
devfrom
dependabot/npm_and_yarn/samples/graphiql-client/multi-ead3a2a080
Open

Bump qs, http-server and express in /samples/graphiql-client#594
dependabot[bot] wants to merge 28 commits into
devfrom
dependabot/npm_and_yarn/samples/graphiql-client/multi-ead3a2a080

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps qs to 6.15.3 and updates ancestor dependencies qs, http-server and express. These dependencies need to be updated together.

Updates qs from 2.3.3 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
  • [Deps] update side-channel
  • [Dev Deps] update eslint, mock-property, tape
  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
  • [Fix] parse: handle nested bracket groups and add regression tests (#530)
  • [readme] fix grammar (#550)
  • [Dev Deps] update @ljharb/eslint-config
  • [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
  • [Deps] update @ljharb/eslint-config
  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
  • [Tests] increase coverage

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLength → arrayLimit)
  • [actions] fix rebase workflow permissions

6.14.1

  • [Fix] ensure arrayLimit applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions

... (truncated)

Commits
  • 18d085e v6.15.3
  • c38af42 [Deps] update side-channel
  • adce539 [Dev Deps] update eslint, mock-property, tape
  • 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
  • f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
  • 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
  • 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
  • 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
  • 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
  • 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for qs since your current version.

Install script changes

This version adds prepublish script that runs during installation. Review the package contents before updating.


Updates http-server from 0.9.0 to 14.1.1

Release notes

Sourced from http-server's releases.

v14.1.1

Other changes

v14.1.0

This release contains an emergency fix which replaces colors.js with chalk. See #781 for more info and discussion, and Marak/colors.js#285 for broader discussion about colors.js.

v14.0.0

Breaking changes

Features and enhancements

Bug Fixes

Other changes

Full Changelog: http-party/http-server@v13.0.2...v14.0.0

v13.1.0

This release contains an emergency backport from v14.1.0 which replaces colors.js with chalk

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by thornjad, a new releaser for http-server since your current version.


Updates express from 4.22.1 to 4.22.2

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: expressjs/express@v4.22.1...v4.22.2

Changelog

Sourced from express's changelog.

4.22.2 / 2026-05-011

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5
Commits

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Copilot AI and others added 28 commits May 18, 2026 12:04
@xperiandri
Migrate integration tests to in-process hosts via `WebApplicationFact…
66b743b 
…ory` and remove external server orchestration from build (#564)

Co-authored-by: xperiandri <2365592+xperiandri@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Andrii Chebukin <XperiAndri@Outlook.com>
@xperiandri
Enforce input/output kind safety for ListOf/Nullable wrappers at …
1506a22 
…compile time (#569)

Co-authored-by: xperiandri <2365592+xperiandri@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Andrii Chebukin <XperiAndri@Outlook.com>
@xperiandri
Pin CI workflows and build script to .NET SDK 10.0.300 (#578)
075018b 
Co-authored-by: xperiandri <2365592+xperiandri@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Andrii Chebukin <XperiAndri@Outlook.com>
@xperiandri
Pin CI workflows and build script to .NET SDK 10.0.301
19d11c3
@xperiandri
Fixed Repo Assist incorrectly encoded characters
cc5fc0f
@dependabot
Bump lodash and babel-cli in /samples/graphiql-client (#584)
50b4569 
Signed-off-by: dependabot[bot] <support@github.com>
@xperiandri
Publish CI test results into PR discussions, harden artifact download…
d8aba70 
…, and add PR preview publishing (#570)

Co-authored-by: xperiandri <2365592+xperiandri@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Andrii Chebukin <XperiAndri@Outlook.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
@xperiandri
Fixed NuGet packaging of DesignTime DLL for F# provider
45046d7 
Added MSBuild target to ensure DesignTime DLL is included in NuGet package, working around F# SDK limitations with ProjectReference-based providers. Removed obsolete target for cleaning NuGet pack input and updated conditions for consistency.
@xperiandri
Updated FSharp.TypeProviders.SDK to 8.10.0
e643b8d
@xperiandri
fixup! Updated FSharp.TypeProviders.SDK to 8.10.0
bdd7297
@xperiandri
High severity vulnerability fix: upgrade SQLitePCLRaw.lib.e_sqlite3…
15df50a 
… to `3.53.3` (#588)

Co-authored-by: xperiandri <2365592+xperiandri@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
@xperiandri
Support case-insensitive comparison with ObjectListFilter (#582)
c1e8510 
Co-authored-by: xperiandri <2365592+xperiandri@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Andrii Chebukin <XperiAndri@Outlook.com>
@xperiandri
ObjectListFilter filter values to target type coercion (#589)
2d94c67 
* Refactored `ObjectListFilter`: modularized, added type coercion

- Moved filter operators and LINQ logic to ObjectListFilterModule.fs
- Added `TypeCoercion.fs` for automatic filter value coercion (`Guid`, `DateTime`, F# DUs, etc.)
- Introduced `FilterValueCoercer` and extended `ObjectListFilterLinqOptions` for custom coercion
- Centralized filter suffix constants in `FilterSuffixConstants.fs`
- Updated `SchemaDefinitions.fs` to use new suffix constants
- Added `vtryFind` and `vtryPick` utilities for arrays/lists in `Extensions.fs`
- Improved code style, documentation, and function signatures

* Refactor 'ObjectListFilter' to use 'System.Text.Json' coercion

Replaces custom value coercers with 'System.Text.Json'-based coercion in 'ObjectListFilter', supporting advanced scenarios like F# DUs and CLR enums via 'JsonSerializerOptions'. Updates 'ObjectListFilterLinqOptions' to accept 'JsonSerializerOptions'. Refactors 'TypeCoercion' module to use JSON serialization/deserialization for all type conversions. Updates filter application logic and expands the test suite with new files to cover a wide range of coercion scenarios. Updates documentation and usage examples accordingly.

* Updateв schema, add type coercion guide, bug report, tools

* Added bug report for InputObject array type mismatch with analysis and test cases
* Added type coercion guide for ObjectListFilter with usage and API docs
* Introduced format-changed-files.ps1 to batch-format changed F# files via Fantomas
* Updated schema snapshots for relay-style connections and new scalars
* Refactored field_aliases.fsx for relay-style friends connection
* Optimized TypeCoercion.fs to use Utf8JsonWriter for value coercion
* Added prompt template for automated PR/issue description generation

* Rebase fix

* Update filters to use `CurrentCulture` string comparison

Updated all string comparison operations in `ObjectListFilter` and filter parsing logic to use `StringComparer.CurrentCulture` or `StringComparer.CurrentCultureIgnoreCase` instead of `Ordinal`/`OrdinalIgnoreCase`. Adjusted related test expectations to match. This ensures string-based filters now respect the current culture's case rules.

* Rebase fixes

* Removed unnecessary `ObjectListFilterValidationException`

* Added test traits

* AI review fixes

* Fix ObjectListFilter IN coercion behavior and add converter/no-converter tests
@xperiandri
Migrated to modern InternalsVisibleTo syntax
454a9e0
@xperiandri
Implemented support of Guid and value object scalars as InputValue
8e34237 
* Enhanced `InputValue.OfObject` to handle `Guid` (as `StringValue "D"`),
`IReadOnlyDictionary`/`IDictionary` (as `ObjectValue`), and improved F#
union handling.
* Added `GuidId` DU, wrapped scalar, and new `Guid`/`ValueObject`
fields to test types, extended tests for filtering with `Guid` and custom
value object scalars.
@xperiandri
Implemented tests for ObjectListFilter with empty arrays
78d21c1 
* Added `ObjectListFilterEmptyArrayTests.fs` with cases for Contains, Equals, Not Equals, and logical operators on empty/non-empty lists. Updated `.fsproj` to include the new file.
* Extended `ObjectListFilterLinqGenerateTests.fs` to verify correct Cosmos SQL generation for list equality and length checks.
@xperiandri
Updated SDK to 10.0.302
060fd26
@xperiandri
Updated Fantomas to 7.0.5
d971701
@xperiandri
Updated FSDocs-Tools to 22.1.0
eada5c2
@xperiandri
Implemented robust interface field covariance validation & tests
b9ce3ad 
- Implemented comprehensive validation for interface field covariance, covering output type subtyping, argument compatibility, and field implementation checks.
- Enhanced error messages with clearer formatting and context.
- Updated validation logic for object, input object, union, and enum types to use interpolated strings.
- Added `InterfaceCovarianceTests.fs` with extensive valid/invalid covariance scenarios.
- Modernized `TypeValidationTests.fs` and expanded `UnionInterfaceTests.fs` for execution coverage.
@dependabot
Bump @protobufjs/utf8 from 1.1.0 to 1.1.1 in /samples/client-provider…
be74f88 
…/file-upload/server (#558)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump brace-expansion from 1.1.14 to 1.1.18 in /samples/graphiql-client (
c072f8e 
#592)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump ws from 7.5.7 to 7.5.13 in /samples/client-provider/file-upload/…
7de55d4 
…server (#586)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump websocket-driver from 0.7.0 to 0.7.5 in /samples/graphiql-client (…
28775fd 
…#590)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump lodash from 4.17.21 to 4.18.1 in /samples/client-provider/file-u…
47f8300 
…pload/server (#561)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump decode-uri-component from 0.2.0 to 0.2.2 in /samples/graphiql-cl…
b86114c 
…ient (#408)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump nanoid and shortid in /samples/client-provider/file-upload/server (
ddf3b1a 
#593)

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump qs, http-server and express in /samples/graphiql-client
1716ee8 
Bumps [qs](https://github.com/ljharb/qs) to 6.15.3 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [http-server](https://github.com/http-party/http-server) and [express](https://github.com/expressjs/express). These dependencies need to be updated together.


Updates `qs` from 2.3.3 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v2.3.3...v6.15.3)

Updates `http-server` from 0.9.0 to 14.1.1
- [Release notes](https://github.com/http-party/http-server/releases)
- [Commits](http-party/http-server@0.9.0...v14.1.1)

Updates `express` from 4.22.1 to 4.22.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md)
- [Commits](expressjs/express@v4.22.1...v4.22.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
- dependency-name: http-server
  dependency-version: 14.1.1
  dependency-type: direct:development
- dependency-name: express
  dependency-version: 4.22.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 11, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 11, 2026
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

Test Results

    3 files      3 suites   10m 9s ⏱️
  592 tests   587 ✅  5 💤 0 ❌
1 776 runs  1 761 ✅ 15 💤 0 ❌

Results for commit 1716ee8.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@xperiandri