Skip to content

Bump qs, express, @vue/cli-plugin-babel, @vue/cli-plugin-eslint, @vue/cli-service, less and node-sass#52

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-fab3b858ac
Closed

Bump qs, express, @vue/cli-plugin-babel, @vue/cli-plugin-eslint, @vue/cli-service, less and node-sass#52
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-fab3b858ac

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Dec 31, 2025

Copy link
Copy Markdown
Contributor

Bumps qs to 6.14.1 and updates ancestor dependencies qs, express, @vue/cli-plugin-babel, @vue/cli-plugin-eslint, @vue/cli-service, less and node-sass. These dependencies need to be updated together.

Updates qs from 6.7.0 to 6.14.1

Changelog

Sourced from qs's changelog.

6.14.1

  • [Fix] ensure arrayLength applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions
  • [Tests] stringify: increase coverage
  • [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

6.14.0

  • [New] parse: add throwOnParameterLimitExceeded option (#517)
  • [Refactor] parse: use utils.combine more
  • [patch] parse: add explicit throwOnLimitExceeded default
  • [actions] use shared action; re-add finishers
  • [meta] Fix changelog formatting bug
  • [Deps] update side-channel
  • [Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols
  • [Tests] increase coverage

6.13.1

  • [Fix] stringify: avoid a crash when a filter key is null
  • [Fix] utils.merge: functions should not be stringified into keys
  • [Fix] parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset
  • [Fix] stringify: ensure a non-string filter does not crash
  • [Refactor] use __proto__ syntax instead of Object.create for null objects
  • [Refactor] misc cleanup
  • [Tests] utils.merge: add some coverage
  • [Tests] fix a test case
  • [actions] split out node 10-20, and 20+
  • [Dev Deps] update es-value-fixtures, mock-property, object-inspect, tape

6.13.0

  • [New] parse: add strictDepth option (#511)
  • [Tests] use npm audit instead of aud

6.12.3

  • [Fix] parse: properly account for strictNullHandling when allowEmptyArrays
  • [meta] fix changelog indentation

6.12.2

  • [Fix] parse: parse encoded square brackets (#506)
  • [readme] add CII best practices badge

6.12.1

  • [Fix] parse: Disable decodeDotInKeys by default to restore previous behavior (#501)
  • [Performance] utils: Optimize performance under large data volumes, reduce memory usage, and speed up processing (#502)
  • [Refactor] utils: use +=
  • [Tests] increase coverage

6.12.0

... (truncated)

Commits
  • 3fa11a5 v6.14.1
  • a626704 [Dev Deps] update npmignore
  • 3086902 [Fix] ensure arrayLength applies to [] notation as well
  • fc7930e [Dev Deps] update eslint, @ljharb/eslint-config
  • 0b06aac [Dev Deps] update @ljharb/eslint-config
  • 64951f6 [Refactor] parse: extract key segment splitting helper
  • e1bd259 [Dev Deps] update @ljharb/eslint-config
  • f4b3d39 [eslint] add eslint 9 optional peer dep
  • 6e94d95 [Dev Deps] update eslint, @ljharb/eslint-config, npmignore
  • 973dc3c [actions] add workflow permissions
  • Additional commits viewable in compare view

Updates express from 4.17.1 to 4.22.1

Release notes

Sourced from express's releases.

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

... (truncated)

Changelog

Sourced from express's changelog.

4.22.1 / 2025-12-01

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.


Updates @vue/cli-plugin-babel from 3.12.1 to 5.0.9

Release notes

Sourced from @​vue/cli-plugin-babel's releases.

v5.0.9

🐛 Bug Fix

  • @vue/cli-service
    • #7443 fix: add missing default __VUE_PROD_HYDRATION_MISMATCH_DETAILS__, fixes compatibility with vue 3.5.19 (@​bobvandevijver)

v5.0.8

🐛 Bug Fix

v5.0.7

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

v5.0.6

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

v5.0.5

🐛 Bug Fix

  • @vue/cli
    • #7167 fix(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service
  • @vue/cli-plugin-e2e-cypress
    • [697bb44] fix: should correctly resolve cypress bin path for Cypress 10 (Note that the project is still created with Cypress 9 by default, but you can upgrade to Cypress 10 on your own now)

Committers: 3

v5.0.4

🐛 Bug Fix

  • @vue/cli-service
  • @vue/cli-shared-utils, @vue/cli-ui
    • 75826d6 fix: replace node-ipc with @achrinza/node-ipc to further secure the dependency chain

... (truncated)

Changelog

Sourced from @​vue/cli-plugin-babel's changelog.

5.0.9 (2025-08-21)

🐛 Bug Fix

Committers: 2

5.0.7 (2022-07-05)

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

5.0.6 (2022-06-16)

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

5.0.5 (2022-06-16)

🐛 Bug Fix

  • @vue/cli
    • #7167 feat(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service

Committers: 3

... (truncated)

Commits

Updates @vue/cli-plugin-eslint from 3.12.1 to 5.0.9

Release notes

Sourced from @​vue/cli-plugin-eslint's releases.

v5.0.9

🐛 Bug Fix

  • @vue/cli-service
    • #7443 fix: add missing default __VUE_PROD_HYDRATION_MISMATCH_DETAILS__, fixes compatibility with vue 3.5.19 (@​bobvandevijver)

v5.0.8

🐛 Bug Fix

v5.0.7

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

v5.0.6

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

v5.0.5

🐛 Bug Fix

  • @vue/cli
    • #7167 fix(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service
  • @vue/cli-plugin-e2e-cypress
    • [697bb44] fix: should correctly resolve cypress bin path for Cypress 10 (Note that the project is still created with Cypress 9 by default, but you can upgrade to Cypress 10 on your own now)

Committers: 3

v5.0.4

🐛 Bug Fix

  • @vue/cli-service
  • @vue/cli-shared-utils, @vue/cli-ui
    • 75826d6 fix: replace node-ipc with @achrinza/node-ipc to further secure the dependency chain

... (truncated)

Changelog

Sourced from @​vue/cli-plugin-eslint's changelog.

5.0.9 (2025-08-21)

🐛 Bug Fix

Committers: 2

5.0.7 (2022-07-05)

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

5.0.6 (2022-06-16)

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

5.0.5 (2022-06-16)

🐛 Bug Fix

  • @vue/cli
    • #7167 feat(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service

Committers: 3

... (truncated)

Commits

Updates @vue/cli-service from 3.12.1 to 5.0.9

Release notes

Sourced from @​vue/cli-service's releases.

v5.0.9

🐛 Bug Fix

  • @vue/cli-service
    • #7443 fix: add missing default __VUE_PROD_HYDRATION_MISMATCH_DETAILS__, fixes compatibility with vue 3.5.19 (@​bobvandevijver)

v5.0.8

🐛 Bug Fix

v5.0.7

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

v5.0.6

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

v5.0.5

🐛 Bug Fix

  • @vue/cli
    • #7167 fix(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service
  • @vue/cli-plugin-e2e-cypress
    • [697bb44] fix: should correctly resolve cypress bin path for Cypress 10 (Note that the project is still created with Cypress 9 by default, but you can upgrade to Cypress 10 on your own now)

Committers: 3

v5.0.4

🐛 Bug Fix

  • @vue/cli-service
  • @vue/cli-shared-utils, @vue/cli-ui
    • 75826d6 fix: replace node-ipc with @achrinza/node-ipc to further secure the dependency chain

... (truncated)

Changelog

Sourced from @​vue/cli-service's changelog.

5.0.9 (2025-08-21)

🐛 Bug Fix

Committers: 2

5.0.7 (2022-07-05)

  • @vue/cli-service
  • @vue/cli-ui
    • #7210 chore: upgrade to apollo-server-express 3.x

Committers: 2

5.0.6 (2022-06-16)

Fix compatibility with the upcoming Vue 2.7 (currently in alpha) and Vue Loader 15.10 (currently in beta).

In Vue 2.7, vue-template-compiler is no longer a required peer dependency. Rather, there's a new export under the main package as vue/compiler-sfc.

5.0.5 (2022-06-16)

🐛 Bug Fix

  • @vue/cli
    • #7167 feat(upgrade): prevent changing the structure of package.json file during upgrade (@​blzsaa)
  • @vue/cli-service

Committers: 3

... (truncated)

Commits
  • 7eb93c1 v5.0.9
  • c21c156 fix: add missing default __VUE_PROD_HYDRATION_MISMATCH_DETAILS__ (#7443)
  • b154dbd v5.0.8
  • 0260e4d fix: add devServer.server.type to useHttps judgement (#7222)
  • 4a0655f v5.0.7
  • beffe8a fix: allow disabling progress plugin via devServer.client.progress
  • 558dea2 fix: support devServer.server option, avoid deprecation warning
  • bddd64d fix: optimize the judgment on whether HTTPS has been set in options (#7202)
  • ef08a08 v5.0.6
  • fcf27e3 fixup! fix: compatibility with Vue 2.7
  • Additional commits viewable in compare view

Updates less from 2.7.3 to 4.5.1

Release notes

Sourced from less's releases.

v4.4.2

v4.4.1

v4.4.0

v4.3.0

#4319 Add deprecation warnings to Less output during parsing and new quiet flag (@​matthew-dean) #4320 Update README.md to remove Lerna reference (@​matthew-dean) #4322 Revise Playwright install method for CI stability (@​puckowski) #4333 Add support for starting-style at rule. (@​puckowski)

v4.2.2

less/less.js#4290 Fix less/less.js#4268 nested pseudo-selector parsing (@​puckowski) less/less.js#4291 Enhance Less.js test environment setup (#4291) (@​iChenLei) less/less.js#4295 Fix less/less.js#4252 container queries created via mixin evaluating variables incorrectly (@​puckowski) less/less.js#4294 Fix less/less.js#3737 allow blank variable declarationd (@​puckowski) less/less.js#4292 Fix less/less.js#4258 variable interpolation after math (@​puckowski) less/less.js#4293 Fix less/less.js#4264 strip line comment from expression (@​puckowski) less/less.js#4302 Fix less/less.js#4301 at-rule declarations missing (@​puckowski) less/less.js#4309 Fix Node 23 CI (#4309) (@​iChenLei)

v4.2.1

v4.2.0

v4.1.3

v4.1.2

... (truncated)

Changelog

Sourced from less's changelog.

Change Log

v4.4.2 (2025-08-27)

v4.4.1 (2025-07-25)

v4.4.0 (2025-05-31)

v4.3.0 (2025-04-04)

v4.2.2 (2025-01-04)

v4.2.1 (2024-09-26)

v4.2.0 (2023-08-06)

v4.1.3 (2022-06-09)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for less since your current version.


Updates node-sass from 4.14.1 to 9.0.0

Release notes

Sourced from node-sass's releases.

v9.0.0

What's Changed

Breaking changes

Supported Environments

OS Architecture Node
Windows x86 & x64 16, 18, 19, 20
OSX x64 16, 18, 19, 20
Linux* x64 16, 18, 19, 20
Alpine Linux x64 16, 18, 19, 20

*Linux support refers to major distributions like Ubuntu, and Debian

v8.0.0

What's Changed

Breaking changes

Features

Dependencies

  • Bump true-case-path@2.2.1
  • Bump node-gyp @​9.0.0
  • Bump nan@^2.17.0
  • Bump sass-graph@^4.0.1

Misc

... (truncated)

Commits
  • 87f3899 feat: Node 20 support (#3355)
  • 06ae4c7 build(deps): bump coverallsapp/github-action from 2.0.0 to 2.1.0 (#3350)
  • e069f73 build(deps): bump coverallsapp/github-action from 1.2.0 to 2.0.0
  • c34837d build(deps): bump coverallsapp/github-action from 1.1.3 to 1.2.0
  • ee13eb9 8.0.0
  • 98e75b3 feat: Node 18 and 19 support and drop Node 17 (#3257)
  • e9bb866 Bump node-gyp and nan for node 19 support (#3314)
  • ab7840b Fix bina...

    Description has been truncated

…/cli-service, less and node-sass

Bumps [qs](https://github.com/ljharb/qs) to 6.14.1 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [express](https://github.com/expressjs/express), [@vue/cli-plugin-babel](https://github.com/vuejs/vue-cli/tree/HEAD/packages/@vue/cli-plugin-babel), [@vue/cli-plugin-eslint](https://github.com/vuejs/vue-cli/tree/HEAD/packages/@vue/cli-plugin-eslint), [@vue/cli-service](https://github.com/vuejs/vue-cli/tree/HEAD/packages/@vue/cli-service), [less](https://github.com/less/less.js) and [node-sass](https://github.com/sass/node-sass). These dependencies need to be updated together.


Updates `qs` from 6.7.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.7.0...v6.14.1)

Updates `express` from 4.17.1 to 4.22.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.1/History.md)
- [Commits](expressjs/express@4.17.1...v4.22.1)

Updates `@vue/cli-plugin-babel` from 3.12.1 to 5.0.9
- [Release notes](https://github.com/vuejs/vue-cli/releases)
- [Changelog](https://github.com/vuejs/vue-cli/blob/dev/CHANGELOG.md)
- [Commits](https://github.com/vuejs/vue-cli/commits/v5.0.9/packages/@vue/cli-plugin-babel)

Updates `@vue/cli-plugin-eslint` from 3.12.1 to 5.0.9
- [Release notes](https://github.com/vuejs/vue-cli/releases)
- [Changelog](https://github.com/vuejs/vue-cli/blob/dev/CHANGELOG.md)
- [Commits](https://github.com/vuejs/vue-cli/commits/v5.0.9/packages/@vue/cli-plugin-eslint)

Updates `@vue/cli-service` from 3.12.1 to 5.0.9
- [Release notes](https://github.com/vuejs/vue-cli/releases)
- [Changelog](https://github.com/vuejs/vue-cli/blob/dev/CHANGELOG.md)
- [Commits](https://github.com/vuejs/vue-cli/commits/v5.0.9/packages/@vue/cli-service)

Updates `less` from 2.7.3 to 4.5.1
- [Release notes](https://github.com/less/less.js/releases)
- [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/less/less.js/commits)

Updates `node-sass` from 4.14.1 to 9.0.0
- [Release notes](https://github.com/sass/node-sass/releases)
- [Changelog](https://github.com/sass/node-sass/blob/master/CHANGELOG.md)
- [Commits](sass/node-sass@v4.14.1...v9.0.0)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
- dependency-name: express
  dependency-version: 4.22.1
  dependency-type: direct:production
- dependency-name: "@vue/cli-plugin-babel"
  dependency-version: 5.0.9
  dependency-type: direct:development
- dependency-name: "@vue/cli-plugin-eslint"
  dependency-version: 5.0.9
  dependency-type: direct:development
- dependency-name: "@vue/cli-service"
  dependency-version: 5.0.9
  dependency-type: direct:development
- dependency-name: less
  dependency-version: 4.5.1
  dependency-type: direct:development
- dependency-name: node-sass
  dependency-version: 9.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 31, 2025
@dependabot @github

dependabot Bot commented on behalf of github Feb 13, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #57.

@dependabot dependabot Bot closed this Feb 13, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/multi-fab3b858ac branch February 13, 2026 16:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants