Bump qs and maildev

[dependabot]

Bumps qs to 6.16.0 and updates ancestor dependency maildev. These dependencies need to be updated together.

Updates qs from 6.15.2 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

Commits

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

Updates maildev from 2.2.1 to 3.0.0-rc.2

Release notes

Sourced from maildev's releases.

maildev@3.0.0-rc.1

MailDev 3.0.0 Release Candidate 1

MailDev 3.0 is a complete, ground-up rewrite. The entire stack has been rebuilt in TypeScript as a modern monorepo, the web UI has been rewritten in React, and the project now ships first-class Claude support via the Model Context Protocol (MCP). Your existing CLI flags, REST API, and .eml archives keep working.

✨ New Features

• Claude / AI integration via MCP — A built-in Model Context Protocol server lets Claude and other AI assistants interact with your dev inbox in natural language: searching emails, pulling verification links, analyzing content, and monitoring delivery. Enable the integrated HTTP transport with maildev --mcp (served at http://localhost:1080/mcp), or run the standalone maildev-mcp stdio server for Claude Desktop. Ships 5 tools, 3 resources, and 4 ready-made prompts (verify signup, check password reset, analyze email, monitor delivery).
• Brand-new React web UI — Rewritten from the ground up with React 19, TanStack Query, and React Router. Includes dark mode, responsive layout, and email device previews.
• Command palette (⌘K) — Fast, keyboard-driven access to actions.
• Keyboard navigation — Gmail-style shortcuts and arrow-key navigation, including navigation while searching.
• maildev init — Scaffold a config file to get started quickly.
• Configuration files — Native support for .maildevrc.json and maildev.config.js / .ts, plus MAILDEV_* environment variables, layered on top of CLI flags.
• Modern programmatic API — import { MailDev } from 'maildev' with a clean async/await start() / stop() lifecycle and typed server access.
• Published as scoped packages — Compose your own setup from @​maildev/core, @​maildev/smtp, @​maildev/api, @​maildev/ui, and @​maildev/mcp, or keep using the all-in-one maildev CLI.

⚠️ Breaking Changes

• Node.js 20+ required (was 18+).
• Web UI completely replaced — The AngularJS front end has been removed and rewritten in React. There is no in-place upgrade path for UI customizations built against the old front end.
• Callback-style APIs removed — The programmatic API is now async/await throughout (await maildev.start() instead of callbacks).
• New configuration format — Config files use the new format; environment-variable and CLI-flag configuration continue to work.

✅ Still compatible

• CLI flags — All 30+ v2 options (--smtp, --web, --incoming-, --outgoing-, --auto-relay, --web-user/--web-pass, --https, --base-pathname, etc.) are preserved.
• REST API — v2 endpoints remain backward compatible.
• Email archives — v2.x .eml mail directories are loaded automatically (--mail-directory).
• Docker — Same image usage and 1025/1080 port defaults.

🔧 Technical & Internal Improvements

• pnpm + Turbo monorepo — Split into six focused packages (core, smtp, api, ui, mcp, cli) with incremental, cached builds.

... (truncated)

Changelog

Sourced from maildev's changelog.

3.0.0-rc.2

Patch Changes

• d34aaa3: Fix the Docker healthcheck so containers report healthy out of the box. A dedicated healthcheck entrypoint (dist/bin/healthcheck.js) now:

  • probes 127.0.0.1 instead of localhost, so it no longer fails when localhost resolves to IPv6 (::1) while the web server binds IPv4 only (#537);
  • falls back to a TCP check on the SMTP port when the web UI is disabled with --disable-web, instead of probing an endpoint that isn't there (#544);
  • normalizes MAILDEV_BASE_PATHNAME so a trailing slash can't produce a // in the probe URL (#542).

• 196f277: Serve the web UI / REST API over HTTPS when --https (with --https-cert and --https-key) is set. The Fastify server now actually honors these options — previously the flags existed but the web server always served plain HTTP. HTTPS can also be configured via MAILDEV_HTTPS, MAILDEV_HTTPS_CERT, and MAILDEV_HTTPS_KEY, and the Docker healthcheck detects MAILDEV_HTTPS and probes over HTTPS so TLS-enabled containers report healthy.

• 42d3708: Add an opt-in maxEmails limit that also bounds the mail directory

  An opt-in maxEmails limit (default 0 = unlimited; set --max-emails to cap) discards the oldest emails along with their .eml files and attachments, so both memory and the mail directory can be kept bounded. When set, leftover files from earlier runs are trimmed at startup. The default keeps MailDev's historical unbounded behaviour, so persisted mail stays durable across restarts (no data loss by default).

  Breaking change:

  • @maildev/core: Storage implementations must now provide onEvicted. A new EvictHandler type and mapLimit helper are exported.

• fc7e584: Add a configurable maximum message size and reject oversized messages. A new --max-message-size option (env MAILDEV_MAX_MESSAGE_SIZE, default 50 MB) advertises the SMTP SIZE extension and refuses messages larger than the limit. The bytes forwarded to the parser are capped at the limit, so a malicious multipart message with a huge number of parts can no longer tie up the parser (addresses the unbounded MIME sibling-part fanout in #531). Set to 0 to disable the limit.

• 781cc0c: Restore persisted emails on startup. When --mail-directory (MAILDEV_MAIL_DIRECTORY) is set, existing .eml files in the directory are now loaded back into the UI when MailDev starts, so mail survives a restart (e.g. across container/pod restarts with a mounted volume).

• Updated dependencies [5d79197]

• Updated dependencies [c96f68f]

• Updated dependencies [b8462db]

• Updated dependencies [41cfcae]

• Updated dependencies [196f277]

• Updated dependencies [e7bc086]

• Updated dependencies [42d3708]

• Updated dependencies [fc7e584]

• Updated dependencies [7dd67c6]

  • @​maildev/api@​3.0.0-rc.2
  • @​maildev/core@​3.0.0-rc.2
  • @​maildev/mcp@​3.0.0-rc.2
  • @​maildev/ui@​3.0.0-rc.2
  • @​maildev/smtp@​3.0.0-rc.2

3.0.0-rc.1

Major Changes

• Complete project re-build

... (truncated)

Commits

• 77425eb Version packages 3.0.0-rc.2
• 2f287c0 Remove sponsorship
• 42d3708 feat: opt-in maxEmails limit that also bounds the mail directory (#559)
• 196f277 Serve the web UI/API over HTTPS (#555)
• fc7e584 Add configurable max message size to bound MIME parsing (#551)
• 781cc0c Restore persisted emails on startup (#549)
• d34aaa3 Fix Docker healthcheck for IPv6, disabled web UI, and base paths (#550)
• e363329 Update MCP docs
• 0c61202 Security updates
• 00435e7 Updates for Docker release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.