npm / qs / 6.16.1

qs 6.16.1

Source

https://github.com/ljharb/qs

Tag scanned

v6.16.1

Compared with

v6.16.0 (4 signals introduced since)

Files

15 scanned, 22 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 8 info

Scan time

0.2 s

LLM review

LLM review by claude-haiku-5-5 (Anthropic): nothing at warn or critical to review.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 16:51

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info unicode-surrogate test/utils.js:590:32 new in this release

   orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

           st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
           st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
           st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');

2. info unicode-surrogate test/utils.js:590:39 new in this release

   orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

           st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
           st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
           st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');

3. info unicode-surrogate test/utils.js:590:50 new in this release

   orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

           st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
           st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
           st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');

4. info unicode-surrogate test/utils.js:590:57 new in this release

   orphaned low surrogate \uDC00 (no preceding high surrogate) (token pass, confidence 0.65)

           st.equal(utils.decode('a++b+', null, 'iso-8859-1'), 'a  b ', 'decodes every + to a space in iso-8859-1');
           st.equal(utils.decode('\uD800x\uDC00'), '\uD800x\uDC00', 'leaves lone surrogates unchanged');
           st.equal(utils.decode('😀+'), '😀 ', 'leaves surrogate pairs unchanged');

5. info unicode-surrogate test/utils.js:744:22

   orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

       }
       loneBoundary += '\uD83DX';
       loneExpected += '%F0%9F%91%98';

6. info unicode-mixed-script test/utils.js:767:23

   identifier `Āက豈` mixes scripts: Latin + Other + Han (in string/comment) (raw pass, confidence 0.40)

       t.equal(
           utils.encode('Āက豈'),
           '%C4%80%E1%80%80%EF%A4%80',
           'encodes multibyte chars'

7. info unicode-surrogate test/utils.js:773:23

   orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

       t.equal(
           utils.encode('\uD83D \uDCA9'),
           '%F0%9F%90%A0%F0%BA%90%80',
           'encodes lone surrogates'

8. info unicode-surrogate test/utils.js:773:30

   orphaned low surrogate \uDCA9 (no preceding high surrogate) (token pass, confidence 0.65)

       t.equal(
           utils.encode('\uD83D \uDCA9'),
           '%F0%9F%90%A0%F0%BA%90%80',
           'encodes lone surrogates'

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/ljharb/qs qs && cd qs
git checkout v6.16.1
disclude scan --severity info --diff v6.16.0 .