Bumps [qs](https://github.com/ljharb/qs) and [body-parser](https://github.com/expressjs/body-parser). These dependencies needed to be updated together. Updates `qs` from 6.14.0 to 6.14.2 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's changelog</a>.</em></p> <blockquote> <h2><strong>6.14.2</strong></h2> <ul> <li>[Fix] <code>parse</code>: mark overflow objects for indexed notation exceeding <code>arrayLimit</code> (<a href="https://redirect.github.com/ljharb/qs/issues/546">#546</a>)</li> <li>[Fix] <code>arrayLimit</code> means max count, not max index, in <code>combine</code>/<code>merge</code>/<code>parseArrayValue</code></li> <li>[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded with indexed notation when <code>throwOnLimitExceeded</code> is true (<a href="https://redirect.github.com/ljharb/qs/issues/529">#529</a>)</li> <li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on <code>comma</code>-parsed values</li> <li>[Fix] <code>parse</code>: fix error message to reflect arrayLimit as max index; remove extraneous comments (<a href="https://redirect.github.com/ljharb/qs/issues/545">#545</a>)</li> <li>[Robustness] avoid <code>.push</code>, use <code>void</code></li> <li>[readme] document that <code>addQueryPrefix</code> does not add <code>?</code> to empty output (<a href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li> <li>[readme] clarify <code>parseArrays</code> and <code>arrayLimit</code> documentation (<a href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li> <li>[readme] replace runkit CI badge with shields.io check-runs badge</li> <li>[meta] fix changelog typo (<code>arrayLength</code> → <code>arrayLimit</code>)</li> <li>[actions] fix rebase workflow permissions</li> </ul> <h2><strong>6.14.1</strong></h2> <ul> <li>[Fix] ensure <code>arrayLimit</code> applies to <code>[]</code> notation as well</li> <li>[Fix] <code>parse</code>: when a custom decoder returns <code>null</code> for a key, ignore that key</li> <li>[Refactor] <code>parse</code>: extract key segment splitting helper</li> <li>[meta] add threat model</li> <li>[actions] add workflow permissions</li> <li>[Tests] <code>stringify</code>: increase coverage</li> <li>[Dev Deps] update <code>eslint</code>, <code>@ljharb/eslint-config</code>, <code>npmignore</code>, <code>es-value-fixtures</code>, <code>for-each</code>, <code>object-inspect</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/qs/commit/bdcf0c7f82387c18ac8fabfccd2f440645cef47b"><code>bdcf0c7</code></a> v6.14.2</li> <li><a href="https://github.com/ljharb/qs/commit/294db90c812ddbe7d7a35d5687c505fd21a2d6a2"><code>294db90</code></a> [readme] document that <code>addQueryPrefix</code> does not add <code>?</code> to empty output</li> <li><a href="https://github.com/ljharb/qs/commit/5c308e5516c270a78caa6f278465914090f91ec6"><code>5c308e5</code></a> [readme] clarify <code>parseArrays</code> and <code>arrayLimit</code> documentation</li> <li><a href="https://github.com/ljharb/qs/commit/6addf8cf738d529c54d91f6f3ffb6c1be91bbfdc"><code>6addf8c</code></a> [Fix] <code>parse</code>: mark overflow objects for indexed notation exceeding <code>arrayLimit</code></li> <li><a href="https://github.com/ljharb/qs/commit/cfc108f662326d6ab540f3545ef0b832baf83cdf"><code>cfc108f</code></a> [Fix] <code>arrayLimit</code> means max count, not max index, in <code>combine</code>/<code>merge</code>/`pars...</li> <li><a href="https://github.com/ljharb/qs/commit/febb64442a80e49200211fa38d3c96b58024ac77"><code>febb644</code></a> [Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded with indexed notation when `thr...</li> <li><a href="https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"><code>f6a7abf</code></a> [Fix] <code>parse</code>: enforce <code>arrayLimit</code> on <code>comma</code>-parsed values</li> <li><a href="https://github.com/ljharb/qs/commit/fbc5206c25b4d1851cea683f02c10756c521d15a"><code>fbc5206</code></a> [Fix] <code>parse</code>: fix error message to reflect arrayLimit as max index; remove e...</li> <li><a href="https://github.com/ljharb/qs/commit/1b9a8b4e78c6aff4c22fa559107227f02fd0216a"><code>1b9a8b4</code></a> [actions] fix rebase workflow permissions</li> <li><a href="https://github.com/ljharb/qs/commit/2a35775614e0fb46ac8a3060201a32a7c23a7fda"><code>2a35775</code></a> [meta] fix changelog typo (<code>arrayLength</code> → <code>arrayLimit</code>)</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/qs/compare/v6.14.0...v6.14.2">compare view</a></li> </ul> </details> <br /> Updates `body-parser` from 1.20.3 to 1.20.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/releases">body-parser's releases</a>.</em></p> <blockquote> <h2>v1.20.5</h2> <h2>What's Changed</h2> <p>The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (<a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a>)</p> <ul> <li>refactor(json): simplify strict mode error string construction by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/692">expressjs/body-parser#692</a></li> <li>fix: correct off-by-one error in parameterCount by <a href="https://github.com/abhu85"><code>@abhu85</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a></li> <li>deps(qs): bump qs to 6.15.1 by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/722">expressjs/body-parser#722</a></li> <li>Release: 1.20.5 by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/721">expressjs/body-parser#721</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/abhu85"><code>@abhu85</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/body-parser/pull/716">expressjs/body-parser#716</a></li> </ul> <p>Special thanks to triager <a href="https://github.com/krzysdz"><code>@krzysdz</code></a> for keeping this on our radar and effectively triaging the specific issue!</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/1.20.4...1.20.5">https://github.com/expressjs/body-parser/compare/1.20.4...1.20.5</a></p> <h2>1.20.4</h2> <h2>What's Changed</h2> <ul> <li>Remove redundant depth check by <a href="https://github.com/blakeembrey"><code>@blakeembrey</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/538">expressjs/body-parser#538</a></li> <li>ci: add support for Node.js v23 by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/553">expressjs/body-parser#553</a></li> <li>ci: restore CI for 1.x branch by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/665">expressjs/body-parser#665</a></li> <li>deps: qs@^6.14.0 by <a href="https://github.com/bjohansebas"><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/664">expressjs/body-parser#664</a></li> <li>deps: use tilde notation and update certain dependencies by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/668">expressjs/body-parser#668</a></li> <li>chore: remove SECURITY.md by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/669">expressjs/body-parser#669</a></li> <li>ci: add CodeQL (SAST) by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/670">expressjs/body-parser#670</a></li> <li>Release: 1.20.4 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/body-parser/pull/672">expressjs/body-parser#672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/body-parser/compare/1.20.3...1.20.4">https://github.com/expressjs/body-parser/compare/1.20.3...1.20.4</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/body-parser/blob/1.20.5/HISTORY.md">body-parser's changelog</a>.</em></p> <blockquote> <h1>1.20.5 / 2026-04-24</h1> <ul> <li>refactor(json): simplify strict mode error string construction</li> <li>fix: extended urlencoded parsing of arrays with >100 elements (<a href="https://redirect.github.com/expressjs/body-parser/issues/716">#716</a>)</li> <li>deps: qs@~6.15.1</li> </ul> <h1>1.20.4 / 2025-12-01</h1> <ul> <li>deps: qs@~6.14.0</li> <li>deps: use tilde notation for dependencies</li> <li>deps: http-errors@~2.0.1</li> <li>deps: raw-body@~2.5.3</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/body-parser/commit/0defdbe7f95ad0d3bc007d3a7c59c8c0ab9e6575"><code>0defdbe</code></a> release(patch): 1.20.5</li> <li><a href="https://github.com/expressjs/body-parser/commit/cd0e7a000c53e7be7262d303e57a352b6a00db7f"><code>cd0e7a0</code></a> deps(qs): bump qs to 6.15.1</li> <li><a href="https://github.com/expressjs/body-parser/commit/6f24d7e8bcd9860b136920926ce86da1a7dd1d51"><code>6f24d7e</code></a> fix: correct off-by-one error in parameterCount (<a href="https://redirect.github.com/expressjs/body-parser/issues/716">#716</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/b849bd533d8b4abf5576a3e301f28d9befa05ddd"><code>b849bd5</code></a> deps: qs@~6.14.1 (<a href="https://redirect.github.com/expressjs/body-parser/issues/690">#690</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/2c55e2f712f320a8e8d0f9fcb1d06526d0e401c9"><code>2c55e2f</code></a> refactor(json): simplify strict mode error string construction (<a href="https://redirect.github.com/expressjs/body-parser/issues/692">#692</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/7db202cac84a001e6566c2dc6516b44db98beff3"><code>7db202c</code></a> 1.20.4 (<a href="https://redirect.github.com/expressjs/body-parser/issues/672">#672</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/d8f8adb898676dfdf997b4455e5f9b689b53e989"><code>d8f8adb</code></a> ci: add CodeQL (SAST) (<a href="https://redirect.github.com/expressjs/body-parser/issues/670">#670</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/6d133c19b3e7c0bb8301959ca1dba283d23d23c3"><code>6d133c1</code></a> chore: remove SECURITY.md (<a href="https://redirect.github.com/expressjs/body-parser/issues/669">#669</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/fcd15355041ada6f37288dd13858d50429016b66"><code>fcd1535</code></a> deps: use tilde notation and update certain dependencies (<a href="https://redirect.github.com/expressjs/body-parser/issues/668">#668</a>)</li> <li><a href="https://github.com/expressjs/body-parser/commit/ec5fa290d25d85e0049757e240249072331eaee6"><code>ec5fa29</code></a> deps: qs@~6.14.0 (<a href="https://redirect.github.com/expressjs/body-parser/issues/664">#664</a>)</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/body-parser/compare/1.20.3...1.20.5">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~jonchurch">jonchurch</a>, a new releaser for body-parser since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>