feathersjs · daffl · Feb 18, 2026 · Feb 18, 2026 · Feb 18, 2026 · Feb 18, 2026
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/feathers/fixtures/client.ts b/packages/feathers/fixtures/client.ts
@@ -21,9 +21,7 @@ export function clientTests(app: any, name: string) {
     it('.get and params passing', async () => {
       const query = {
         returnquery: 'true',
-        some: 'thing',
-        other: ['one', 'two'],
-        nested: { a: { b: 'object' } }
+        some: ['thing', '2', 'test']
       }
 
       const todo = await getService().get('0', { query })

diff --git a/packages/feathers/package.json b/packages/feathers/package.json
@@ -88,13 +88,12 @@
   "publishConfig": {
     "access": "public"
   },
-  "dependencies": {
-    "@types/qs": "^6.14.0",
-    "qs": "^6.14.0"
-  },
+  "dependencies": {},
   "devDependencies": {
     "@types/node": "^24.1.0",
+    "@types/qs": "^6.14.0",
     "@vitest/coverage-v8": "^3.2.4",
+    "qs": "^6.15.0",
     "shx": "^0.4.0",
     "typescript": "^5.8.0",
     "vitest": "^3.2.4"

diff --git a/packages/feathers/src/client/fetch.test.ts b/packages/feathers/src/client/fetch.test.ts
@@ -1,4 +1,4 @@
-import { beforeAll, describe, it, expect, vi } from 'vitest'
+import { beforeAll, describe, it, expect } from 'vitest'
 import { feathers } from '../index.js'
 import { clientTests } from '../../fixtures/client.js'
 import { NotAcceptable, NotFound, MethodNotAllowed, BadRequest } from '../errors.js'
@@ -54,13 +54,6 @@ describe('fetch REST connector', function () {
     await expect(() => service.get('notfound', {})).rejects.toBeInstanceOf(NotFound)
   })
 
-  it('supports nested arrays in queries', async () => {
-    const query = { test: { $in: ['0', '1', '2'] }, returnquery: 'true' }
-    const data = await service.get('dishes', { query })
-
-    expect(data.query).toEqual(query)
-  })
-
   it('can initialize a client instance', async () => {
     const init = fetchClient(fetch, {
       baseUrl: baseUrl
@@ -245,7 +238,7 @@ describe('FetchClient.handleEventStream', () => {
       name: 'test',
       baseUrl: 'http://localhost',
       connection: fetch,
-      stringify: (q) => ''
+      stringify: (_q) => ''
     })
 
     const response = createChunkedSSEResponse(chunks)
@@ -267,7 +260,7 @@ describe('FetchClient.handleEventStream', () => {
       name: 'test',
       baseUrl: 'http://localhost',
       connection: fetch,
-      stringify: (q) => ''
+      stringify: (_q) => ''
     })
 
     const response = createChunkedSSEResponse(chunks)
@@ -291,7 +284,7 @@ describe('FetchClient.handleEventStream', () => {
       name: 'test',
       baseUrl: 'http://localhost',
       connection: fetch,
-      stringify: (q) => ''
+      stringify: (_q) => ''
     })
 
     const response = createChunkedSSEResponse(chunks)
@@ -330,7 +323,7 @@ describe('FetchClient.handleEventStream', () => {
       name: 'test',
       baseUrl: 'http://localhost',
       connection: fetch,
-      stringify: (q) => ''
+      stringify: (_q) => ''
     })
 
     const messages: any[] = []

diff --git a/packages/feathers/src/client/index.ts b/packages/feathers/src/client/index.ts
@@ -1,5 +1,5 @@
-import qs from 'qs'
 import type { Application, Query } from '../declarations.js'
+import { stringify as defaultStringify } from '../query-string.js'
 import { FetchClient, ProxiedFetchClient } from './fetch.js'
 import { sseClient, SseClientOptions } from './sse.js'
 import { defaultServiceEvents } from '../service.js'
@@ -16,7 +16,7 @@ export type ClientOptions = {
 }
 
 export function fetchClient(connection: typeof fetch, options: ClientOptions = {}) {
-  const { stringify = qs.stringify, baseUrl = '', Service = ProxiedFetchClient } = options
+  const { stringify = defaultStringify, baseUrl = '', Service = ProxiedFetchClient } = options
   const events = options.sse ? defaultServiceEvents : undefined
   const sseOptions = typeof options.sse === 'string' ? { path: options.sse } : options.sse
   const defaultService = function (name: string) {

diff --git a/packages/feathers/src/http/middleware.ts b/packages/feathers/src/http/middleware.ts
@@ -1,7 +1,7 @@
 import type { Params, Service, Query } from '../index.js'
 import type { HookContext, NextFunction } from '../hooks/index.js'
 import { BadRequest, FeathersError } from '../errors.js'
-import qs from 'qs'
+import { parse } from '../query-string.js'
 
 interface RouteLookup {
   service: Service
@@ -60,7 +60,7 @@ export function bodyParser() {
   }
 }
 
-export function queryParser(parser: (query: string) => Query = qs.parse) {
+export function queryParser(parser: (query: string) => Query = parse) {
   return async (context: HandlerContext, next: NextFunction) => {
     const { request } = context
     const url = new URL(request.url)

diff --git a/packages/feathers/src/query-string.test.ts b/packages/feathers/src/query-string.test.ts
@@ -0,0 +1,72 @@
+import { describe, it } from 'vitest'
+import assert from 'assert'
+import { stringify, parse } from './query-string.js'
+
+describe('query-string', () => {
+  describe('stringify', () => {
+    it('serializes flat string and number values', () => {
+      assert.strictEqual(stringify({ name: 'Alice', age: 30 }), 'name=Alice&age=30')
+    })
+
+    it('serializes boolean values as strings', () => {
+      assert.strictEqual(stringify({ active: true, deleted: false }), 'active=true&deleted=false')
+    })
+
+    it('skips null and undefined values', () => {
+      assert.strictEqual(stringify({ name: 'Alice', removed: null, extra: undefined }), 'name=Alice')
+    })
+
+    it('skips object values', () => {
+      assert.strictEqual(stringify({ name: 'Alice', age: { $gt: 18 } }), 'name=Alice')
+    })
+
+    it('serializes array values as repeated keys', () => {
+      assert.strictEqual(stringify({ ids: [1, 2, 3] }), 'ids=1&ids=2&ids=3')
+    })
+
+    it('skips null, undefined and object items in arrays', () => {
+      assert.strictEqual(stringify({ ids: [1, null, undefined, { $gt: 2 }, 3] }), 'ids=1&ids=3')
+    })
+
+    it('returns empty string for empty query', () => {
+      assert.strictEqual(stringify({}), '')
+    })
+  })
+
+  describe('parse', () => {
+    it('parses flat string values', () => {
+      assert.deepStrictEqual(parse('name=Alice'), { name: 'Alice' })
+    })
+
+    it('returns values as strings without type coercion', () => {
+      assert.deepStrictEqual(parse('age=30&active=true&deleted=false'), {
+        age: '30',
+        active: 'true',
+        deleted: 'false'
+      })
+    })
+
+    it('collects repeated keys into an array', () => {
+      assert.deepStrictEqual(parse('id=1&id=2&id=3'), { id: ['1', '2', '3'] })
+    })
+
+    it('returns empty object for empty string', () => {
+      assert.deepStrictEqual(parse(''), {})
+    })
+
+    it('decodes encoded characters', () => {
+      assert.deepStrictEqual(parse('name=Alice+Smith'), { name: 'Alice Smith' })
+    })
+  })
+
+  describe('round-trip', () => {
+    it('round-trips flat values (as strings)', () => {
+      const query = { name: 'Alice', age: 30, active: true }
+      assert.deepStrictEqual(parse(stringify(query)), { name: 'Alice', age: '30', active: 'true' })
+    })
+
+    it('round-trips array values', () => {
+      assert.deepStrictEqual(parse(stringify({ ids: [1, 2, 3] })), { ids: ['1', '2', '3'] })
+    })
+  })
+})
diff --git a/packages/feathers/src/query-string.ts b/packages/feathers/src/query-string.ts
@@ -0,0 +1,34 @@
+import type { Query } from './declarations.js'
+
+const isStringifiable = (value: unknown): value is string | number | boolean =>
+  value !== undefined && value !== null && typeof value !== 'object'
+
+export function stringify(query: Query): string {
+  const params = new URLSearchParams()
+
+  for (const [key, value] of Object.entries(query)) {
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (isStringifiable(item)) {
+          params.append(key, String(item))
+        }
+      }
+    } else if (isStringifiable(value)) {
+      params.set(key, String(value))
+    }
+  }
+
+  return params.toString()
+}
+
+export function parse(query: string): Query {
+  const params = new URLSearchParams(query)
+  const result: Query = {}
+
+  for (const key of params.keys()) {
+    const values = params.getAll(key)
+    result[key] = values.length === 1 ? values[0] : values
+  }
+
+  return result
+}