Skip to content

Conversation

@Xmaxer
Copy link

@Xmaxer Xmaxer commented Jan 5, 2026

There's a new security issue with the qs versions <6.14.1

https://security.snyk.io/vuln/SNYK-JS-QS-14724253

This is a non breaking update as far as I can see.

There's a new security issue with the qs versions <6.14.1

https://security.snyk.io/vuln/SNYK-JS-QS-14724253

This is a non breaking update as far as I can see.
@ljharb
Copy link
Collaborator

ljharb commented Jan 5, 2026

This is fine, but it's also unnecessary because the fixed version is in-range.

@abk182
Copy link

abk182 commented Jan 28, 2026

There also issue with node.js version
package engines - "node": ">= 0.4"
dependency graph engines: "node": ">= 0.6" (in qs@6.14.1)

Maybe it's worth upgrading the engine?

@Xmaxer
Copy link
Author

Xmaxer commented Jan 28, 2026

Sorry for the late reply. Yes, the fixed version is in range, but no harm in this either. If anything it shows that the engine versions are mismatched even if it is within range.

I can do it as part of this PR, it's up to the maintainer if they wish to proceed with this though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants