chore(deps): update dependency qs to v6.9.9 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
qs	6.5.5 → 6.9.9

---

qs vulnerable to Prototype Pollution

CVE-2022-24999 / GHSA-hrpp-h998-j3pp

More information

Details

qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-24999
• https://github.com/ljharb/qs/pull/428
• https://github.com/n8tz/CVE-2022-24999
• https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec
• https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68
• https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b
• https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d
• https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1
• https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105
• https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f
• https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee
• https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda
• https://github.com/expressjs/express/releases/tag/4.17.3
• https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html
• https://security.netapp.com/advisory/ntap-20230908-0005
• https://github.com/advisories/GHSA-hrpp-h998-j3pp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ljharb/qs (qs)

v6.9.9

Compare Source

• [Fix] fix regressions from robustness refactor
• [meta] add npmignore to autogenerate an npmignore file
• [actions] update reusable workflows

v6.9.8

Compare Source

• [Robustness] avoid .push, use void
• [readme] clarify parseArrays and arrayLimit documentation (#​543)
• [readme] document that addQueryPrefix does not add ? to empty output (#​418)
• [readme] replace runkit CI badge with shields.io check-runs badge
• [actions] fix rebase workflow permissions

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.