chore(deps): update dependency qs to v6.9.7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
qs	6.9.4 → 6.9.7

---

qs vulnerable to Prototype Pollution

CVE-2022-24999 / GHSA-hrpp-h998-j3pp

More information

Details

qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-24999
• https://github.com/ljharb/qs/pull/428
• https://github.com/n8tz/CVE-2022-24999
• https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec
• https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68
• https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b
• https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d
• https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1
• https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105
• https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f
• https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee
• https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda
• https://github.com/expressjs/express/releases/tag/4.17.3
• https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html
• https://security.netapp.com/advisory/ntap-20230908-0005
• https://github.com/advisories/GHSA-hrpp-h998-j3pp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ljharb/qs (qs)

v6.9.7

Compare Source

• [Fix] parse: ignore __proto__ keys (#​428)
• [Fix] stringify: avoid encoding arrayformat comma when encodeValuesOnly = true (#​424)
• [Robustness] stringify: avoid relying on a global undefined (#​427)
• [readme] remove travis badge; add github actions/codecov badges; update URLs
• [Docs] add note and links for coercing primitive values (#​408)
• [Tests] clean up stringify tests slightly
• [meta] fix README.md (#​399)
• Revert "[meta] ignore eclint transitive audit warning"
• [actions] backport actions from main
• [Dev Deps] backport updates from main

v6.9.6

Compare Source

• [Fix] restore dist dir; mistakenly removed in d4f6c32

v6.9.5

Compare Source

• [Fix] stringify: do not encode parens for RFC1738
• [Fix] stringify: fix arrayFormat comma with empty array/objects (#​350)
• [Refactor] format: remove util.assign call
• [meta] add "Allow Edits" workflow; update rebase workflow
• [actions] switch Automatic Rebase workflow to pull_request_target event
• [Tests] stringify: add tests for #​378
• [Tests] migrate tests to Github Actions
• [Tests] run nyc on all tests; use tape runner
• [Dev Deps] update eslint, @ljharb/eslint-config, browserify, mkdirp, object-inspect, tape; add aud

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.