Skip to content

chore(deps): bump qs, body-parser, express, @kubernetes/client-node and cypress in /pkg/ui/v1beta1/frontend - #2697

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/pkg/ui/v1beta1/frontend/multi-793e823769
Open

chore(deps): bump qs, body-parser, express, @kubernetes/client-node and cypress in /pkg/ui/v1beta1/frontend#2697
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/pkg/ui/v1beta1/frontend/multi-793e823769

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor

Bumps qs to 6.15.3 and updates ancestor dependencies qs, body-parser, express, @kubernetes/client-node and cypress. These dependencies need to be updated together.

Updates qs from 6.13.0 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
  • [Deps] update side-channel
  • [Dev Deps] update eslint, mock-property, tape
  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
  • [Fix] parse: handle nested bracket groups and add regression tests (#530)
  • [readme] fix grammar (#550)
  • [Dev Deps] update @ljharb/eslint-config
  • [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
  • [Deps] update @ljharb/eslint-config
  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
  • [Tests] increase coverage

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLength → arrayLimit)
  • [actions] fix rebase workflow permissions

6.14.1

  • [Fix] ensure arrayLimit applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions

... (truncated)

Commits
  • 18d085e v6.15.3
  • c38af42 [Deps] update side-channel
  • adce539 [Dev Deps] update eslint, mock-property, tape
  • 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
  • f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
  • 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
  • 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
  • 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
  • 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
  • 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
  • Additional commits viewable in compare view

Updates body-parser from 1.20.3 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

New Contributors

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

1.20.4

What's Changed

Full Changelog: expressjs/body-parser@1.20.3...1.20.4

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit

1.20.5 / 2026-04-24

  • refactor(json): simplify strict mode error string construction
  • fix: extended urlencoded parsing of arrays with >100 elements (#716)
  • deps: qs@~6.15.1

1.20.4 / 2025-12-01

  • deps: qs@~6.14.0
  • deps: use tilde notation for dependencies
  • deps: http-errors@~2.0.1
  • deps: raw-body@~2.5.3
Commits

Updates express from 4.21.2 to 4.22.2

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

Changelog

Sourced from express's changelog.

4.22.2 / 2026-05-011

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

4.22.1 / 2025-12-01

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

4.22.0 / 2025-12-01

Commits

Updates @kubernetes/client-node from 0.16.3 to 1.4.0

Release notes

Sourced from @​kubernetes/client-node's releases.

Release 1.4.0

What's Changed

  • Support for Kubernetes Release 1.34.x

Bug fixes and updates

New Contributors

Full Changelog: kubernetes-client/javascript@1.3.0...1.4.0

1.3.0

What's Changed

Full Changelog: kubernetes-client/javascript@1.2.0...1.3.0

... (truncated)

Commits
  • 19a7ced Merge pull request #2636 from kubernetes-client/brendandburns-patch-16
  • 23985c6 address comment
  • cf1f5aa build(deps): bump @​types/node from 24.6.1 to 24.6.2 (#2647)
  • 0d7b508 Merge pull request #2646 from kubernetes-client/max/2448/errorcallback-on-con...
  • d80b7d0 fix: readd error callback on informer error and connect events
  • 2f2b63a Merge pull request #2645 from sachiniyer/main
  • 02b4f47 build(deps): bump @​types/node from 24.6.0 to 24.6.1 (#2643)
  • 6878c9a Merge pull request #2644 from kubernetes-client/dependabot/npm_and_yarn/main/...
  • 27ed55c add ObjectCache to the return type of makeInformer
  • 1c37138 build(deps-dev): bump typescript from 5.9.2 to 5.9.3
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates cypress from 13.13.1 to 15.19.0

Release notes

Sourced from cypress's releases.

v15.19.0

Changelog: https://docs.cypress.io/app/references/changelog#15-19-0

v15.18.1

Changelog: https://docs.cypress.io/app/references/changelog#15-18-1

v15.18.0

Changelog: https://docs.cypress.io/app/references/changelog#15-18-0

v15.17.0

Changelog: https://docs.cypress.io/app/references/changelog#15-17-0

v15.16.0

Changelog: https://docs.cypress.io/app/references/changelog#15-16-0

v15.15.0

Changelog: https://docs.cypress.io/app/references/changelog#15-15-0

v15.14.2

Changelog: https://docs.cypress.io/app/references/changelog#15-14-2

v15.14.1

Changelog: https://docs.cypress.io/app/references/changelog#15-14-1

v15.14.0

Changelog: https://docs.cypress.io/app/references/changelog#15-14-0

v15.13.1

Changelog: https://docs.cypress.io/app/references/changelog#15-13-1

v15.13.0

Changelog: https://docs.cypress.io/app/references/changelog#15-13-0

v15.12.0

Changelog: https://docs.cypress.io/app/references/changelog#15-12-0

v15.11.0

Changelog: https://docs.cypress.io/app/references/changelog#15-11-0

v15.10.0

Changelog: https://docs.cypress.io/app/references/changelog#15-10-0

v15.9.0

Changelog: https://docs.cypress.io/app/references/changelog#15-9-0

v15.8.2

Changelog: https://docs.cypress.io/app/references/changelog#15-8-2

v15.8.1

Changelog: https://docs.cypress.io/app/references/changelog#15-8-1

... (truncated)

Commits
  • d19a47c test: migrate dev-server e2e specs to the reporter iframe (#34301)
  • dd72f31 chore: Update Chrome (stable) to 150.0.7871.128 (#34293)
  • 388f6e0 chore: retrieve SSL.com CodeSignTool for Windows signing from github CDN (#34...
  • 3ff5960 perf: render command log in an isolated iframe to prevent renderer crash (#34...
  • 37a899c fix: allow chaining assertions after should('exist') on raw DOM elements (#34...
  • bfe83a1 chore: clean up the server cookie automation converters and various automatio...
  • 72cef52 chore: Update Chrome (stable) to 150.0.7871.124 and Chrome (beta) to 151.0.79...
  • 6792160 chore: bump websocket-driver to 0.7.5 to resolve critical Snyk vulnerability ...
  • de06a07 test: fix cy-in-cy studio AI test to exercise authenticated flow (#34278)
  • 9e7e850 feat: upgrade chai to 4.5.0 and expose new assertion aliases (#34178)
  • Additional commits viewable in compare view
Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump qs, body-parser, express, @kubernetes/client-node a…
d0c1bef 
…nd cypress

Bumps [qs](https://github.com/ljharb/qs) to 6.15.3 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [body-parser](https://github.com/expressjs/body-parser), [express](https://github.com/expressjs/express), [@kubernetes/client-node](https://github.com/kubernetes-client/javascript) and [cypress](https://github.com/cypress-io/cypress). These dependencies need to be updated together.


Updates `qs` from 6.13.0 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.15.3)

Updates `body-parser` from 1.20.3 to 1.20.6
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.3...1.20.6)

Updates `express` from 4.21.2 to 4.22.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md)
- [Commits](expressjs/express@4.21.2...v4.22.2)

Updates `@kubernetes/client-node` from 0.16.3 to 1.4.0
- [Release notes](https://github.com/kubernetes-client/javascript/releases)
- [Commits](kubernetes-client/javascript@0.16.3...1.4.0)

Updates `cypress` from 13.13.1 to 15.19.0
- [Release notes](https://github.com/cypress-io/cypress/releases)
- [Changelog](https://github.com/cypress-io/cypress/blob/develop/CHANGELOG.md)
- [Commits](cypress-io/cypress@v13.13.1...v15.19.0)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
- dependency-name: express
  dependency-version: 4.22.2
  dependency-type: indirect
- dependency-name: "@kubernetes/client-node"
  dependency-version: 1.4.0
  dependency-type: direct:development
- dependency-name: cypress
  dependency-version: 15.19.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 26, 2026
@github-actions

github-actions Bot commented Jul 26, 2026

Copy link
Copy Markdown

🎉 Welcome to the Kubeflow Katib repo! 🎉

Thanks for opening your first PR! We're excited to have you onboard 🚀

Next steps:

Feel free to ask questions in the comments. Thanks again for contributing! 🙏

@google-oss-prow

google-oss-prow Bot commented Jul 26, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kimwnasptd for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@danish9039 danish9039 mentioned this pull request Aug 28, 2026
Open
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anencore94 anencore94 Awaiting requested review from anencore94
@johnugeorge johnugeorge Awaiting requested review from johnugeorge
@kimwnasptd kimwnasptd Awaiting requested review from kimwnasptd

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code size/XXL

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants