[dependabot]

Bumps qs and express. These dependencies needed to be updated together.
Updates qs from 6.15.3 to 6.16.1

Changelog

Sourced from qs's changelog.

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)
• [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
• [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
• [Docs] document that qs and flat parsers disagree about parameter names
• [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
• [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
• [meta] fix changelog indents
• [actions] set least-privilege cache-mode
• [Tests] utils: decode: add missing cases
• [Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
• [Tests] parse: allowDots: cover stray close brackets before a dot
• [Dev Deps] update @ljharb/eslint-config, eslint, tape

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

Commits

• 2471b66 v6.16.1
• 51f736e [Docs] document that qs and flat parsers disagree about parameter names
• 40239f7 [Dev Deps] update tape
• d219359 [Fix] parse: do not mutate an object input
• 98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
• cb075c5 [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments wi...
• 4b89c03 [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip
• 266527d [Perf] decode: skip decoders when there is no percent sign
• 82c5bd0 [Tests] utils: decode: add missing cases
• 3ee412c [Tests] parse: characterize the ]= split when an = precedes any bracket...
• Additional commits viewable in compare view

Updates express from 4.22.2 to 4.22.3

Changelog

Sourced from express's changelog.

4.22.3

• Allow conditional revalidation for QUERY requests
  • req.fresh now includes QUERY in the freshness check, so QUERY responses can return 304 when a validator matches
• deps: qs@~6.16.0

Commits

• 899b524 4.22.3 (#7466)
• 1fad2c3 ci: add npm staged publication with dist-tag support (#7465)
• 4138650 deps: qs@~6.16.0 (#7440)
• 61ccf2e feat: allow conditional revalidation for QUERY requests (v4) (#7377)
• 715101b Update path-to-regexp to 0.1.13 because CVE-2026-4867 (#7135)
• f472e5f docs: fix the release date format for 4.22.2
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.71%. Comparing base (5a3241b) to head (eabae56).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #228   +/-   ##
=======================================
  Coverage   98.71%   98.71%           
=======================================
  Files          80       80           
  Lines        1402     1402           
  Branches      443      470   +27     
=======================================
  Hits         1384     1384           
  Misses         18       18           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dcoa]

@dependabot rebase.

[dcoa]

@dependabot rebase.