qs is a JavaScript querystring parser and serializer for turning query strings into objects and back into strings. It supports nested keys using square bracket notation and includes options for things like decoding, limits on nesting depth and parameter counts, and safer handling of prototype-related keys.
Project status
- Actively maintained: the upstream was pushed on 2026-10-28, with updates as recently as that date.
- Cadence is bursty rather than clearly regular: several updates landed within hours on October 27-28, after updates in August and June.
AI summary generated
Recent updates
v6.17.1
The publisher provided no release notes for v6.17.1. The code diff contains parser and array-limit fixes, plus documentation updates; the repository CHANGELOG describes the fixes, but they are absent from the supplied publisher notes.
v6.16.2
The publisher provided no release notes. The repository changelog describes a new `stringify` depth option and fixes to parsing, merging, key encoding, and limit enforcement; the diff also includes input-copying behavior and development-tool updates. No exports were removed, and the ecosystem advisories provided do not relate to this package or its changed dependencies.
Featuresv6.15.4
The publisher supplied no release notes. The code changes add a new default parsing behavior for object/primitive conflicts, tighten array-limit handling, fix several parsing and stringification edge cases, and update dependencies; the diff's CHANGELOG.md and README.md document many of these changes.
BreakingSecurityFeaturesv6.14.3
The publisher supplied no release notes. The diff contains cumulative changes from qs 6.14.0 through 6.14.3, including parser limit behavior and error handling changes, a stringify fix for empty arrays, and dependency and tooling updates.
BreakingFeaturesv6.13.4
The publisher provided no release notes. The code and repository changelog show the v6.13.0 to v6.13.4 changes, including an opt-in strict parsing depth limit, fixes to empty-array key encoding and parsing edge cases, and dependency and tooling updates.
Featuresv6.12.6
The publisher provided no release notes. The diff shows a `stringify` fix for encoding keys when `allowEmptyArrays` is enabled, along with dependency and development-tooling updates; it shows no public API signature or export changes.
v6.17.0
The publisher supplied no release notes for v6.17.0. The code adds WHATWG-compatible query encoding and several parser/stringifier fixes, including safer handling of own `__proto__` properties and corrected encoding of lone UTF-16 surrogates; the repository changelog records these changes, but they were not summarized in the publisher notes.
SecurityFeaturesv6.16.1
v6.16.1 contains a set of correctness and robustness fixes across qs.parse, qs.stringify, and internal merge/decode utilities, with emphasis on bracket grammar, dot encoding/rewriting, and strictMerge/arrayLimit edge cases. No publisher release notes were provided, so the changes described below are inferred directly from the code diff and accompanying changelog/test updates.
v6.16.0
v6.16.0 adds recursion-depth bounding support to qs.stringify via a new depth option, and makes several parser and stringifier behavior changes related to arrayLimit/throwOnLimitExceeded and encodeDotInKeys. The provided release_notes section contains no publisher notes, so the changes below are derived from the actual code diff (and accompanying repo docs).
BreakingFeaturesv6.15.3
v6.15.3 introduces stricter and more consistent enforcement of array limits during query parsing and merging when `throwOnLimitExceeded` is enabled. It also includes robustness fixes around `__proto__` property handling and improved correctness for surrogate pairs during encoding, plus a performance improvement to cycle compaction.
Securityv6.15.2
v6.15.2 primarily adjusts query parsing and stringification edge cases. The most notable code changes are in how bracketed keys are split during parsing (more robust handling of nested and unterminated bracket groups) and how stringify handles null/undefined values and delimiter behavior in specific modes.
Breakingv6.15.1
Release v6.15.1 includes a targeted fix in the querystring parser related to parameter limiting. Specifically, it corrects behavior when `parameterLimit` is set to `Infinity` while `throwOnLimitExceeded` is `true`, and it also updates lint/development dependencies.
v6.15.0
Release v6.15.0 was published on 2026-02-15, but the publisher provided no release notes (no details on changes). As a result, this release cannot be assessed from the provided text for API changes, bug fixes, security updates, or migration steps.
v6.12.5
No release notes were provided for v6.12.5. However, upgrading from v6.11.4 to v6.12.5 includes substantial changes to qs' query parsing and stringifying behavior (new options, new defaults, and internal robustness/performance refactors), plus CI workflow and dependency updates.
Featuresv6.11.4
v6.11.4 does not include publisher release notes in the provided data, but the code diff shows several robustness-focused changes plus notable behavior/option handling around `stringify` with `arrayFormat: 'comma'`. The diff also includes CI workflow permission hardening and updates to documentation and tests (including new coverage for empty keys).
BreakingSecurityFeaturesv6.10.7
No publisher release notes were provided for v6.10.7. The code diff between v6.9.9 and v6.10.7 shows several behavioral changes in query parsing and stringifying (notably sparse array parsing and arrayFormat comma output formatting), plus a new cyclic-reference detection mechanism and a new runtime dependency.
v6.9.9
No publisher release notes were provided for v6.9.9, but the repo changelog indicates this version focused on robustness regressions, plus meta/workflow updates. The actual code changes between v6.8.5 and v6.9.9 include behavioral modifications to both parsing and stringifying, especially around custom encoder/decoder callback signatures, handling of '__proto__' keys, and comma array encoding when encodeValuesOnly is enabled.
v6.8.5
v6.8.5 has no publisher-provided release notes. The repository changelog for 6.8.5 only mentions a robustness regression fix, generating an npmignore for publishing, and updating GitHub Actions workflows, but the code diff shows more substantial behavioral refactors in query parsing and stringifying.
v6.6.3
Release v6.6.3 was published on 2026-02-13, but no release notes or change log details were provided by the publisher. As a result, there is insufficient information to identify new features, breaking changes, bug fixes, security updates, or dependency changes from the release notes alone.
v6.7.5
No publisher release notes were provided for v6.7.5. The code diff from v6.6.3 to v6.7.5 shows substantial internal refactoring plus query parsing and stringifying behavior additions, including new comma-delimited array handling and changes to formatter and option normalization.
Features