chore(deps): bump qs, @wp-playground/cli and express

[dependabot]

Bumps qs, @wp-playground/cli and express. These dependencies needed to be updated together.
Updates qs from 6.14.2 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

• [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
• [Deps] update @ljharb/eslint-config
• [Dev Deps] update @ljharb/eslint-config, iconv-lite
• [Tests] increase coverage

6.15.0

• [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
• [Fix] duplicates option should not apply to bracket notation keys (#514)

Commits

• 18d085e v6.15.3
• c38af42 [Deps] update side-channel
• adce539 [Dev Deps] update eslint, mock-property, tape
• 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
• f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
• 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
• 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
• 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
• 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
• 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
• Additional commits viewable in compare view

Updates @wp-playground/cli from 3.1.20 to 3.1.43

Release notes

Sourced from @​wp-playground/cli's releases.

WordPress Playground v3.1.43

No changelog entries for this release.

---

Install via npm:

npm install @wp-playground/client@3.1.43

Or browse all packages on npm.

Stay up to date: Click Watch → Custom → Releases at the top of this repository to get notified of new releases.

WordPress Playground v3.1.42

No changelog entries for this release.

---

Install via npm:

npm install @wp-playground/client@3.1.42

Or browse all packages on npm.

Stay up to date: Click Watch → Custom → Releases at the top of this repository to get notified of new releases.

WordPress Playground v3.1.41

No changelog entries for this release.

---

Install via npm:

npm install @wp-playground/client@3.1.41

Or browse all packages on npm.

Stay up to date: Click Watch → Custom → Releases at the top of this repository to get notified of new releases.

WordPress Playground v3.1.40

No changelog entries for this release.

---

... (truncated)

Changelog

Sourced from @​wp-playground/cli's changelog.

[v3.1.43] (2026-06-29)

[v3.1.42] (2026-06-26)

[v3.1.41] (2026-06-22)

[v3.1.40] (2026-06-19)

[v3.1.39] (2026-06-15)

[v3.1.38] (2026-06-08)

[v3.1.37] (2026-06-08)

[v3.1.36] (2026-06-01)

[v3.1.35] (2026-05-25)

[v3.1.34] (2026-05-18)

PHP WebAssembly

• [PHP.wasm] Fix sqlite_markdown extension loading. (#3650)
• [PHP.wasm] Support web JSPI side module ABI exports. (#3647)
• [codex] Use wp-extensions markdown editor release. (#3648)
• [website] Add php-extension query parameter. (#3645)

Various

Personal Playground

• Personal WP: Improve app install dialog. (#3652)

Contributors

... (truncated)

Commits

• 7cc9b0e v3.1.43
• d069d3d [GitHub Actions] Keep Vite optimizer output out of node_modules cache (#3842)
• de685f6 Refresh SQLite integration plugin
• 2c47978 Refresh SQLite integration plugin
• 851194f [docs] Updating MCP README (#3827)
• 1c0b143 Refresh SQLite integration plugin
• 5066c64 chore: update changelog
• 827bc91 v3.1.42
• 25e729e [CLI] Fix EBADF crash from stale SQLite WAL lock cleanup (#3833)
• 75e0869 Refresh SQLite integration plugin
• Additional commits viewable in compare view

Updates express from 4.22.0 to 4.22.2

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

New Contributors

• @​suuuuuuminnnnnn made their first contribution in expressjs/express#7021
• @​SAY-5 made their first contribution in expressjs/express#7181

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

• Release: 4.22.1 by @​UlisesGascon in expressjs/express#6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

Changelog

Sourced from express's changelog.

4.22.2 / 2026-05-011

• fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
  • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
• deps: qs@~6.15.1
• deps: body-parser@~1.20.5

4.22.1 / 2025-12-01

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
  • The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Commits

• df0abc9 4.22.2
• 836d366 4.x update qs to 6.15.1, body-parser 1.20.5 (#7224)
• 8d09bfe fix: restore array parsing for req.query repeated keys (#7181)
• d39e8ad deps: body-parser@~1.20.4 (#7021)
• efe85d9 deps: qs@^6.14.1 (#6972)
• f62378e 📝 add note to history
• 12fae14 4.22.1
• 5ddf311 Revert "sec: security patch for CVE-2024-51999"
• See full diff in compare view

[ph33nx]

@dependabot rebase

[ph33nx]

@dependabot rebase