qs 6.16.0

Source: https://github.com/ljharb/qs
Tag scanned: v6.16.0
Compared with: v6.15.3 (0 signals introduced since)
Files: 15 scanned, 22 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 0.1 s
LLM review: LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:48

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-surrogate test/utils.js:560:22

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)
```
    }
    loneBoundary += '\uD83DX';
    loneExpected += '%F0%9F%91%98';
```

info unicode-mixed-script test/utils.js:583:23

identifier `Āက豈` mixes scripts: Latin + Other + Han (in string/comment) (raw pass, confidence 0.40)

    t.equal(
        utils.encode('Āက豈'),
        '%C4%80%E1%80%80%EF%A4%80',
        'encodes multibyte chars'

info unicode-surrogate test/utils.js:589:23

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

    t.equal(
        utils.encode('\uD83D \uDCA9'),
        '%F0%9F%90%A0%F0%BA%90%80',
        'encodes lone surrogates'

info unicode-surrogate test/utils.js:589:30

orphaned low surrogate \uDCA9 (no preceding high surrogate) (token pass, confidence 0.65)

    t.equal(
        utils.encode('\uD83D \uDCA9'),
        '%F0%9F%90%A0%F0%BA%90%80',
        'encodes lone surrogates'

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/ljharb/qs qs && cd qs
git checkout v6.16.0
disclude scan --severity info --diff v6.15.3 .