Why is qs locked at 6.7.0?

Hi,

I was going through my project dependencies and noticed I had a duplicate qs. qs@6.9.4 is out and most of my dependencies use it. However, express and body-parser have a hard dependency on qs@6.7.0. Express says it does it because body-parser does it. I looked through body-parser (code search and issues) and there doesn’t seem to be an obvious reason for it.

So my questions are:

• Why does body-parser use qs@6.7.0 instead of qs@^6.7.0 (caret)?
• Is there anything that can be done to unlock it?

Thanks.

https://github.com/expressjs/express/issues/4171#issuecomment-582466565 https://github.com/expressjs/express/pull/4172#discussion_r375244826

[dougwilson]

The issue is that qs makes accidental breaking changes or otherwise undesirable changes we need to work around before bumping. We also just generally fix deps we do not own to a specific version to address the security attack when a dep is compromised and a new version published to do something malicious.

[jahed]

No worries on pushing a release if no one else wants it. I can easily use the resolutions field in my package.json to bump the qs version express/body-parser uses to dedupe it (and take responsibility for any issues I encounter by doing so).