Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

deps: qs@^6.14.1 - #689

#689
Merged
UlisesGascon merged 2 commits into
masterexpressjs/body-parser:masterfrom
ulises/upgrade-qs-in-2.xexpressjs/body-parser:ulises/upgrade-qs-in-2.xCopy head branch name to clipboard
Jan 5, 2026
Merged

deps: qs@^6.14.1#689
UlisesGascon merged 2 commits into
masterexpressjs/body-parser:masterfrom
ulises/upgrade-qs-in-2.xexpressjs/body-parser:ulises/upgrade-qs-in-2.xCopy head branch name to clipboard

Conversation

@UlisesGascon

Copy link
Copy Markdown
Member

Related to #687

UlisesGascon and others added 2 commits January 4, 2026 10:40
to preserve backcompat in the simpler parse after ljharb/qs@3086902
we need to provide an arrayLimit other than zero

input length is already capped by default, enforced by throwing a 413:

```js
// throws 413 before parsing when violated
options?.parameterLimit = 1000
```

so the default behavior is that we will parse arrays in simple mode up
to parameterLimit. Using `paramCount` because it will always be paramLimit
or lower here, and we use it in the other side of the ternary to mean
the same thing
@jonchurch

jonchurch commented Jan 5, 2026

Copy link
Copy Markdown
Member

I pushed the fix to keep backcompat with what we did in the simple mode before

fix(urlencoded): simple mode, set arrayLimit to paramCount
to preserve backcompat in the simpler parse after ljharb/qs@3086902
we need to provide an arrayLimit other than zero

input length is already capped by default, enforced by throwing a 413:

// throws 413 before parsing when violated
options?.parameterLimit = 1000

so the default behavior is that we will parse arrays in simple mode up
to parameterLimit. Using paramCount because it will always be paramLimit
or lower here, and we use it in the other side of the ternary to mean
the same thing

Comment thread lib/types/urlencoded.js
}

var arrayLimit = extended ? Math.max(100, paramCount) : 0
var arrayLimit = extended ? Math.max(100, paramCount) : paramCount

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the Math.max is here for extended mode to allow sparse arrays, so far as I can tell

@jonchurch
jonchurch marked this pull request as ready for review January 5, 2026 08:56

@UlisesGascon UlisesGascon left a comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are amazing @jonchurch! 👏👏👏

I was going into a much more complex debug locally 😅

@UlisesGascon UlisesGascon self-assigned this Jan 5, 2026
@UlisesGascon UlisesGascon mentioned this pull request Jan 5, 2026
2 tasks
@UlisesGascon

Copy link
Copy Markdown
Member Author

I included the changes in the HISTORY.md directly in the release notes (ref). @jonchurch can you approve the PR so I can merge it?

@bjohansebas bjohansebas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! good solution

@UlisesGascon UlisesGascon changed the title deps: qs@^6.14.1, deps: qs@^6.14.1 Jan 5, 2026
@UlisesGascon
UlisesGascon merged commit 03f17c2 into master Jan 5, 2026
16 checks passed
@UlisesGascon
UlisesGascon deleted the ulises/upgrade-qs-in-2.x branch January 5, 2026 18:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.