Merge pull request #32234 from backstage/renovate/npm-qs-vulnerability

chore(deps): update dependency qs to v6.14.1 [security]

.changeset/twenty-candles-open.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-catalog-graph': patch
+'@backstage/plugin-search': patch
+---
+
+Update for the `qs` library bump: the old array limit setting has changed to be more strict; you can no longer just give a zero to mean unlimited. So we choose an arbitrary high value, to at least go higher than the default 20.

plugins/catalog-graph/src/components/CatalogGraphPage/useCatalogGraphPage.test.tsx

@@ -13,10 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 import { RELATION_MEMBER_OF } from '@backstage/catalog-model';
 import { renderHook, waitFor } from '@testing-library/react';
-import { ReactNode } from 'react';
-import { act } from 'react-dom/test-utils';
+import { ReactNode, act } from 'react';
 import { BrowserRouter } from 'react-router-dom';
 import { Direction } from '../../lib/types';
 import { useCatalogGraphPage } from './useCatalogGraphPage';

plugins/catalog-graph/src/components/CatalogGraphPage/useCatalogGraphPage.ts

@@ -73,8 +73,10 @@ export function useCatalogGraphPage({
 
   const query = useMemo(
     () =>
-      (qs.parse(location.search, { arrayLimit: 0, ignoreQueryPrefix: true }) ||
-        {}) as {
+      (qs.parse(location.search, {
+        arrayLimit: 10000,
+        ignoreQueryPrefix: true,
+      }) || {}) as {
         selectedRelations?: string[] | string;
         selectedKinds?: string[] | string;
         rootEntityRefs?: string[] | string;

plugins/search/src/components/SearchPage/SearchPage.tsx

@@ -45,7 +45,7 @@ export const UrlUpdater = () => {
     }
 
     const query =
-      qs.parse(location.search.substring(1), { arrayLimit: 0 }) || {};
+      qs.parse(location.search.substring(1), { arrayLimit: 10000 }) || {};
 
     if (query.filters) {
       setFilters(query.filters as JsonObject);

plugins/search/src/components/SearchPage/UrlUpdater.tsx

@@ -43,7 +43,7 @@ export const UrlUpdater = () => {
     }
 
     const query =
-      qs.parse(location.search.substring(1), { arrayLimit: 0 }) || {};
+      qs.parse(location.search.substring(1), { arrayLimit: 10000 }) || {};
 
     if (query.filters) {
       setFilters(query.filters as JsonObject);

yarn.lock

@@ -42941,11 +42941,11 @@ __metadata:
   linkType: hard
 
 "qs@npm:^6.10.1, qs@npm:^6.10.3, qs@npm:^6.11.2, qs@npm:^6.12.2, qs@npm:^6.12.3, qs@npm:^6.14.0, qs@npm:^6.7.0, qs@npm:^6.9.4, qs@npm:~6.14.0":
-  version: 6.14.0
-  resolution: "qs@npm:6.14.0"
+  version: 6.14.1
+  resolution: "qs@npm:6.14.1"
   dependencies:
     side-channel: "npm:^1.1.0"
-  checksum: 10/a60e49bbd51c935a8a4759e7505677b122e23bf392d6535b8fc31c1e447acba2c901235ecb192764013cd2781723dc1f61978b5fdd93cc31d7043d31cdc01974
+  checksum: 10/34b5ab00a910df432d55180ef39c1d1375e550f098b5ec153b41787f1a6a6d7e5f9495593c3b112b77dbc6709d0ae18e55b82847a4c2bbbb0de1e8ccbb1794c5
   languageName: node
   linkType: hard