Bump qs, express and cypress

[dependabot]

Bumps qs to 6.15.3 and updates ancestor dependencies qs, express and cypress. These dependencies need to be updated together.

Updates qs from 6.15.1 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

Commits

• 18d085e v6.15.3
• c38af42 [Deps] update side-channel
• adce539 [Dev Deps] update eslint, mock-property, tape
• 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
• f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
• 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
• 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
• 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
• 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
• 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
• Additional commits viewable in compare view

Updates express from 4.22.0 to 4.22.2

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

New Contributors

• @​suuuuuuminnnnnn made their first contribution in expressjs/express#7021
• @​SAY-5 made their first contribution in expressjs/express#7181

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

• Release: 4.22.1 by @​UlisesGascon in expressjs/express#6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

Changelog

Sourced from express's changelog.

4.22.2 / 2026-05-011

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

4.22.1 / 2025-12-01

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Commits

• df0abc9 4.22.2
• 836d366 4.x update qs to 6.15.1, body-parser 1.20.5 (#7224)
• 8d09bfe fix: restore array parsing for req.query repeated keys (#7181)
• d39e8ad deps: body-parser@~1.20.4 (#7021)
• efe85d9 deps: qs@^6.14.1 (#6972)
• f62378e 📝 add note to history
• 12fae14 4.22.1
• 5ddf311 Revert "sec: security patch for CVE-2024-51999"
• See full diff in compare view

Updates cypress from 14.5.3 to 15.19.0

Release notes

Sourced from cypress's releases.

v15.19.0

Changelog: https://docs.cypress.io/app/references/changelog#15-19-0

v15.18.1

Changelog: https://docs.cypress.io/app/references/changelog#15-18-1

v15.18.0

Changelog: https://docs.cypress.io/app/references/changelog#15-18-0

v15.17.0

Changelog: https://docs.cypress.io/app/references/changelog#15-17-0

v15.16.0

Changelog: https://docs.cypress.io/app/references/changelog#15-16-0

v15.15.0

Changelog: https://docs.cypress.io/app/references/changelog#15-15-0

v15.14.2

Changelog: https://docs.cypress.io/app/references/changelog#15-14-2

v15.14.1

Changelog: https://docs.cypress.io/app/references/changelog#15-14-1

v15.14.0

Changelog: https://docs.cypress.io/app/references/changelog#15-14-0

v15.13.1

Changelog: https://docs.cypress.io/app/references/changelog#15-13-1

v15.13.0

Changelog: https://docs.cypress.io/app/references/changelog#15-13-0

v15.12.0

Changelog: https://docs.cypress.io/app/references/changelog#15-12-0

v15.11.0

Changelog: https://docs.cypress.io/app/references/changelog#15-11-0

v15.10.0

Changelog: https://docs.cypress.io/app/references/changelog#15-10-0

v15.9.0

Changelog: https://docs.cypress.io/app/references/changelog#15-9-0

v15.8.2

Changelog: https://docs.cypress.io/app/references/changelog#15-8-2

v15.8.1

Changelog: https://docs.cypress.io/app/references/changelog#15-8-1

... (truncated)

Commits

• d19a47c test: migrate dev-server e2e specs to the reporter iframe (#34301)
• dd72f31 chore: Update Chrome (stable) to 150.0.7871.128 (#34293)
• 388f6e0 chore: retrieve SSL.com CodeSignTool for Windows signing from github CDN (#34...
• 3ff5960 perf: render command log in an isolated iframe to prevent renderer crash (#34...
• 37a899c fix: allow chaining assertions after should('exist') on raw DOM elements (#34...
• bfe83a1 chore: clean up the server cookie automation converters and various automatio...
• 72cef52 chore: Update Chrome (stable) to 150.0.7871.124 and Chrome (beta) to 151.0.79...
• 6792160 chore: bump websocket-driver to 0.7.5 to resolve critical Snyk vulnerability ...
• de06a07 test: fix cy-in-cy studio AI test to exercise authenticated flow (#34278)
• 9e7e850 feat: upgrade chai to 4.5.0 and expose new assertion aliases (#34178)
• Additional commits viewable in compare view

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.