Bump qs from 6.5.2 to 6.5.3 #23

dependabot · 2022-12-09T01:27:09Z

Bumps qs from 6.5.2 to 6.5.3.

Changelog

6.5.3

[Fix] parse: ignore __proto__ keys (#428)

[Fix] utils.merge: avoid a crash with a null target and a truthy non-array source

[Fix] correctly parse nested arrays

[Fix] stringify: fix a crash with strictNullHandling and a custom filter/serializeDate (#279)

[Fix] utils: merge: fix crash when source is a truthy primitive & no options are provided

[Fix] when parseArrays is false, properly handle keys ending in []

[Fix] fix for an impossible situation: when the formatter is called with a non-string value

[Fix] utils.merge: avoid a crash with a null target and an array source

[Refactor] utils: reduce observable [[Get]]s

[Refactor] use cached Array.isArray

[Refactor] stringify: Avoid arr = arr.concat(...), push to the existing instance (#269)

[Refactor] parse: only need to reassign the var once

[Robustness] stringify: avoid relying on a global undefined (#427)

[readme] remove travis badge; add github actions/codecov badges; update URLs

[Docs] Clean up license text so it’s properly detected as BSD-3-Clause

[Docs] Clarify the need for "arrayLimit" option

[meta] fix README.md (#399)

[meta] add FUNDING.yml

[actions] backport actions from main

[Tests] always use String(x) over x.toString()

[Tests] remove nonexistent tape option

[Dev Deps] backport from main

Commits

298bfa5 v6.5.3
ed0f5dc [Fix] parse: ignore __proto__ keys (#428)
691e739 [Robustness] stringify: avoid relying on a global undefined (#427)
1072d57 [readme] remove travis badge; add github actions/codecov badges; update URLs
12ac1c4 [meta] fix README.md (#399)
0338716 [actions] backport actions from main
5639c20 Clean up license text so it’s properly detected as BSD-3-Clause
51b8a0b add FUNDING.yml
45f6759 [Fix] fix for an impossible situation: when the formatter is called with a no...
f814a7f [Dev Deps] backport from main
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [qs](https://github.com/ljharb/qs) from 6.5.2 to 6.5.3. - [Release notes](https://github.com/ljharb/qs/releases) - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.2...v6.5.3) --- updated-dependencies: - dependency-name: qs dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

prisma-cloud-devsecops

Prisma Cloud has found errors in this PR ⬇️

prisma-cloud-devsecops · 2022-12-09T01:28:20Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


unset-value 1.0.0 / yarn.lock

Total vulnerabilities: 1

Critical: 0 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

PRISMA-2022-0049 HIGH 8 2.0.1 Open

prisma-cloud-devsecops · 2022-12-09T01:28:20Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


y18n 4.0.0 / yarn.lock

Total vulnerabilities: 1

Critical: 1 High: 0 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2020-7774 CRITICAL 9.8 4.0.1 Open

prisma-cloud-devsecops · 2022-12-09T01:28:20Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


tar 4.4.10 / yarn.lock

Total vulnerabilities: 5

Critical: 0 High: 5 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2021-37713 HIGH 7 4.4.18 Open

CVE-2021-37712 HIGH 7 4.4.18 Open

CVE-2021-37701 HIGH 8.6 4.4.16 Open

CVE-2021-32804 HIGH 8.1 - Open

CVE-2021-32803 HIGH 8.1 - Open

prisma-cloud-devsecops · 2022-12-09T01:28:20Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


tmpl 1.0.4 / yarn.lock

Total vulnerabilities: 1

Critical: 0 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2021-3777 HIGH 7.5 1.0.5 Open

prisma-cloud-devsecops · 2022-12-09T01:28:20Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


lodash 4.17.14 / yarn.lock

Total vulnerabilities: 2

Critical: 0 High: 2 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2020-8203 HIGH 7.4 4.17.20 Open

CVE-2021-23337 HIGH 7.2 4.17.21 Open

prisma-cloud-devsecops · 2022-12-09T01:28:22Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


glob-parent 5.0.0 / yarn.lock

Total vulnerabilities: 1

Critical: 0 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2020-28469 HIGH 7.5 5.1.2 Open

prisma-cloud-devsecops · 2022-12-09T01:28:22Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


acorn 6.2.0 / yarn.lock

Total vulnerabilities: 1

Critical: 0 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

GHSA-6chw-6frg-f759 HIGH 7 6.4.1 Open

prisma-cloud-devsecops · 2022-12-09T01:28:22Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


ansi-regex 3.0.0 / yarn.lock

Total vulnerabilities: 1

Critical: 0 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2021-3807 HIGH 7.5 4.1.1 Open

prisma-cloud-devsecops · 2022-12-09T01:28:22Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


acorn 5.7.3 / yarn.lock

Total vulnerabilities: 1

Critical: 0 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

GHSA-6chw-6frg-f759 HIGH 7 5.7.4 Open

prisma-cloud-devsecops · 2022-12-09T01:28:22Z

yarn.lock

-  version "6.5.2"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
-  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+  version "6.5.3"


ansi-regex 4.1.0 / yarn.lock

Total vulnerabilities: 1

Critical: 0 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2021-3807 HIGH 7.5 4.1.1 Open

dependabot bot added the dependencies Pull requests that update a dependency file label Dec 9, 2022

prisma-cloud-devsecops bot reviewed Dec 9, 2022

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Bump qs from 6.5.2 to 6.5.3 #23

Bump qs from 6.5.2 to 6.5.3 #23

Uh oh!

dependabot bot commented on behalf of github Dec 9, 2022

Uh oh!

prisma-cloud-devsecops bot left a comment

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022 •

edited

Loading

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022 •

edited

Loading

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Vulnerability ID	Severity	CVSS	Fixed in	Status
CVE-2021-37713	HIGH	7	`4.4.18`	Open
CVE-2021-37712	HIGH	7	`4.4.18`	Open
CVE-2021-37701	HIGH	8.6	`4.4.16`	Open
CVE-2021-32804	HIGH	8.1	`-`	Open
CVE-2021-32803	HIGH	8.1	`-`	Open

Vulnerability ID	Severity	CVSS	Fixed in	Status
CVE-2020-8203	HIGH	7.4	`4.17.20`	Open
CVE-2021-23337	HIGH	7.2	`4.17.21`	Open

Uh oh!

Bump qs from 6.5.2 to 6.5.3 #23

Are you sure you want to change the base?

Bump qs from 6.5.2 to 6.5.3 #23

Uh oh!

Conversation

dependabot bot commented on behalf of github Dec 9, 2022

6.5.3

Uh oh!

prisma-cloud-devsecops bot left a comment

Choose a reason for hiding this comment

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Choose a reason for hiding this comment

unset-value 1.0.0 / yarn.lock

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Choose a reason for hiding this comment

y18n 4.0.0 / yarn.lock

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

tar 4.4.10 / yarn.lock

Total vulnerabilities: 5

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Choose a reason for hiding this comment

tmpl 1.0.4 / yarn.lock

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

lodash 4.17.14 / yarn.lock

Total vulnerabilities: 2

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Choose a reason for hiding this comment

glob-parent 5.0.0 / yarn.lock

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Choose a reason for hiding this comment

acorn 6.2.0 / yarn.lock

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Choose a reason for hiding this comment

ansi-regex 3.0.0 / yarn.lock

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Choose a reason for hiding this comment

acorn 5.7.3 / yarn.lock

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Dec 9, 2022

Choose a reason for hiding this comment

ansi-regex 4.1.0 / yarn.lock

Total vulnerabilities: 1

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

prisma-cloud-devsecops bot Dec 9, 2022 •

edited

Loading

prisma-cloud-devsecops bot Dec 9, 2022 •

edited

Loading