deps: qs@^6.14.1

[UlisesGascon]

Port for #6969

[sergio-tao]

Well done!
Is there going to be a new release (5.2.2?) with this dependency fix? 😁

[gabrieel1007]

@sergio-tao
Good question!
Actually, everything about this is covered in PR #6969 — you can check the details there.

[serhalp]

Hello! Is there a 4.x release planned that will include this fix soon? Thanks!

[jaenster]

Could we please have a patch version for express containing this?

[jonchurch]

@serhalp @jaenster
Speaking for myself, I'm not currently planning a patch release specifically for this.

A fresh npm install already resolves to secure versions, and a patch release wouldn't change your remediation steps or silence Dependabot alerts. You'd still need to update your lockfile either way.

To update: npm update qs body-parser

(The body-parser update may not be needed depending on your version, but older versions of body-parser had qs pinned so it's good to include.)

It occurs to me though that I may be too used to managing dependencies this way to understand why others want to solve it with a patch release. Why do you ask for a patch release? Is there something causing you pain here that a patch would solve? Tooling yelling at you?

[jaenster]

That works if you use qs and body-parser directly. But, we dont, we use nestjs express, which uses express, which uses these.

But, i might be that im the inexperienced idiot here, so please teach me if im doing it wrong and can solve it without an override. Context, we use pnpm.

[krzysdz]

That works if you use qs and body-parser directly. But, we dont, we use nestjs express, which uses express, which uses these.

Nest v10.4.22 includes updates to express (v4) and body-parser (nestjs/nest#16178, nestjs/nest#16157). Nest v11 uses express v5.2.1, which allows body-parser updates and current (not yet released) version on git lists qs 6.14.1 in package-lock.json:

https://github.com/nestjs/nest/blob/defe683829e030377f10a85175eb549b6813d575/package-lock.json#L37965-L37979

Context, we use pnpm.

pnpm has pnpm update and, if I understand filters correctly, pnpm --filter "express..." update should update only express and its dependencies. If you are using nest v10, you will also have to update it to v10.4.22 in order to allow for express updates.