npm / qs

qs

What changed in qs 6, from its official release notes, upgrade guides and advisories. Also covers @types/qs. Sources checked 2026-10-19.

8 breaking5 security2 new APIs and options1 performance2 behavior and defaults24 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

qs 642 changes

Breaking changes 8

The [] sequence is treated as array syntax only when it ends the key.
6.16.1release notes
Enforces arrayLimit on comma groups under []= when throwOnLimitExceeded is set.
6.16.0release notes security advisory
allowEmptyArrays no longer skips cycle detection or drops own keys on an empty array with own properties.
6.16.0release notes
Throws the arrayLimit error before splitting oversized comma values.
6.15.3release notes
Enforces throwOnLimitExceeded when arrays grow cumulatively through combine or merge.
6.15.3release notes
Handles nested bracket groups; output changes for some unbalanced bracket keys.
6.15.2release notes
arrayLimit is now enforced on values parsed using comma notation.
6.14.2release notes security advisory
With throwOnLimitExceeded enabled, parse now throws when indexed notation exceeds arrayLimit.
6.14.2release notes

Security 5

Does not invoke a non-callable constructor.isBuffer.
6.16.0release notes security advisory
Avoids invoking the __proto__ setter when copying own properties.
6.15.3release notes
Skips null/undefined entries in comma-format arrays when encodeValuesOnly is enabled, instead of crashing in the encoder.
6.15.2release notes security advisory
Fixes parameterLimit: Infinity with throwOnLimitExceeded: true silently dropping all parameters.
6.15.1release notes
Ensure arrayLimit applies to [] notation as well.
6.14.1release notes security advisory

New APIs and options 2

Adds a depth option to bound recursion depth; its default is Infinity.
6.16.0release notes
Adds the strictMerge option to wrap object/primitive conflicts in an array.
6.15.0release notes

Performance 1

Decoders are skipped when the input contains no percent sign.
6.16.1release notes

Behavior and default changes 2

Date values are serialized when a filter is provided.
6.16.0release notes
Indexed notation exceeding arrayLimit now marks overflow objects.
6.14.2release notes

Fixes and other changes 24

parse no longer mutates an object input.
6.16.1release notes
Only top-level dots are converted to brackets when allowDots is enabled.
6.16.1release notes
arrayLimit is applied to the two-element array built for colliding values.
6.16.1release notes
Conflict containers retain a correct index and arrayLimit during strictMerge.
6.16.1release notes
Nesting added by repeated strictMerge conflicts is bounded.
6.16.1release notes
Merge overflow containers use their own keys to seed the index.
6.16.1release notes
Inherited array format names are ignored.
6.16.1release notes
With arrayFormat set to comma, elements without a callable toString no longer cause an exception.
6.16.1release notes
In iso-8859-1 mode, + is encoded as %2B so values round-trip.
6.16.1release notes
Structural separator dots are no longer re-encoded when encodeDotInKeys is set.
6.16.1release notes
With arrayFormat set to comma, the full encoder arguments are passed when encodeValuesOnly is enabled.
6.16.1release notes
Flattens a collection appended to an overflowed array.
6.16.0release notes
Encodes dots in a top-level key with a primitive value when encodeDotInKeys is set.
6.16.0release notes
Preserves surrogate-pair encoding across chunks.
6.15.3release notes
Avoids invoking the __proto__ setter when copying own properties.
6.15.3release notes
Enforces arrayLimit consistently across merge's array paths.
6.15.3release notes
Uses the configured delimiter after charsetSentinel.
6.15.2release notes
Skips null/undefined filter-array entries instead of crashing in the encoder.
6.15.2release notes
Applies the formatter to the encoded key under strictNullHandling.
6.15.2release notes
The duplicates option no longer applies to bracket notation keys.
6.15.0release notes
arrayLimit means maximum count, not maximum index, in combine, merge, and parseArrayValue.
6.14.2release notes
Ignore a key when a custom decoder returns null for it.
6.14.1release notes
Fixes regressions from the robustness refactor.
6.6.3, 6.8.5, 6.9.9release notes release notes release notes
Fixes a regression from the robustness refactor.
6.0.6release notes