# What changed in qs

> 42 changes in qs 6 from its official release notes, upgrade guides and advisories: 8 breaking, 5 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/qs/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## qs 6

### Breaking changes

- The [] sequence is treated as array syntax only when it ends the key. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- Enforces arrayLimit on comma groups under []= when throwOnLimitExceeded is set. (6.16.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6160), [security advisory](https://github.com/advisories/GHSA-X5FP-WJ9C-MXMX)
- allowEmptyArrays no longer skips cycle detection or drops own keys on an empty array with own properties. (6.16.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6160)
- Throws the arrayLimit error before splitting oversized comma values. (6.15.3) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6153)
- Enforces throwOnLimitExceeded when arrays grow cumulatively through combine or merge. (6.15.3) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6153)
- Handles nested bracket groups; output changes for some unbalanced bracket keys. (6.15.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6152)
- arrayLimit is now enforced on values parsed using comma notation. (6.14.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6142), [security advisory](https://github.com/advisories/GHSA-W7FW-MJWX-W883)
- With throwOnLimitExceeded enabled, parse now throws when indexed notation exceeds arrayLimit. (6.14.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6142)

### Security

- Does not invoke a non-callable constructor.isBuffer. (6.16.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6160), [security advisory](https://github.com/advisories/GHSA-4MJR-XMP4-GH2G)
- Avoids invoking the __proto__ setter when copying own properties. (6.15.3) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6153)
- Skips null/undefined entries in comma-format arrays when encodeValuesOnly is enabled, instead of crashing in the encoder. (6.15.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6152), [security advisory](https://github.com/advisories/GHSA-Q8MJ-M7CP-5Q26)
- Fixes `parameterLimit: Infinity` with `throwOnLimitExceeded: true` silently dropping all parameters. (6.15.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6151)
- Ensure arrayLimit applies to [] notation as well. (6.14.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6141), [security advisory](https://github.com/advisories/GHSA-6RW7-VPXM-498P)

### New APIs and options

- Adds a depth option to bound recursion depth; its default is Infinity. (6.16.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6160)
- Adds the strictMerge option to wrap object/primitive conflicts in an array. (6.15.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6150)

### Performance

- Decoders are skipped when the input contains no percent sign. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)

### Behavior and default changes

- Date values are serialized when a filter is provided. (6.16.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6160)
- Indexed notation exceeding arrayLimit now marks overflow objects. (6.14.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6142)

### Fixes and other changes

- parse no longer mutates an object input. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- Only top-level dots are converted to brackets when allowDots is enabled. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- arrayLimit is applied to the two-element array built for colliding values. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- Conflict containers retain a correct index and arrayLimit during strictMerge. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- Nesting added by repeated strictMerge conflicts is bounded. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- Merge overflow containers use their own keys to seed the index. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- Inherited array format names are ignored. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- With arrayFormat set to comma, elements without a callable toString no longer cause an exception. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- In iso-8859-1 mode, + is encoded as %2B so values round-trip. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- Structural separator dots are no longer re-encoded when encodeDotInKeys is set. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- With arrayFormat set to comma, the full encoder arguments are passed when encodeValuesOnly is enabled. (6.16.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6161)
- Flattens a collection appended to an overflowed array. (6.16.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6160)
- Encodes dots in a top-level key with a primitive value when encodeDotInKeys is set. (6.16.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6160)
- Preserves surrogate-pair encoding across chunks. (6.15.3) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6153)
- Avoids invoking the __proto__ setter when copying own properties. (6.15.3) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6153)
- Enforces arrayLimit consistently across merge's array paths. (6.15.3) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6153)
- Uses the configured delimiter after charsetSentinel. (6.15.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6152)
- Skips null/undefined filter-array entries instead of crashing in the encoder. (6.15.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6152)
- Applies the formatter to the encoded key under strictNullHandling. (6.15.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6152)
- The duplicates option no longer applies to bracket notation keys. (6.15.0) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6150)
- arrayLimit means maximum count, not maximum index, in combine, merge, and parseArrayValue. (6.14.2) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6142)
- Ignore a key when a custom decoder returns null for it. (6.14.1) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#6141)
- Fixes regressions from the robustness refactor. (6.6.3, 6.8.5, 6.9.9) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#699), [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#685), [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#663)
- Fixes a regression from the robustness refactor. (6.0.6) — [release notes](https://github.com/ljharb/qs/blob/bb03bce2236660c910a494ddc270937bad65f123/CHANGELOG.md#606)