[ojas-krishnaprasad]

Summary

This PR Bumps qurey-string from 8.x to 10.x which resolves us in CVE

Checklist

• Does your PR title have the correct title format?
• Does your PR have a breaking change?: no

[ojas-krishnaprasad]

@ianmeyer Is this approvable

[ojas-krishnaprasad]

Hi Team,
Is this can be merged?

[ojas-krishnaprasad]

@Mercy811 , @ianmeyer

[Mercy811]

LGTM! But I wanna have @daniel-graham-amplitude 's eyes on it too before merging

[ojas-krishnaprasad]

Thanks @Mercy811 , May i know what is the release plan for this to be avaialbe in npm registry?

[Mercy811]

Thanks @Mercy811 , May i know what is the release plan for this to be avaialbe in npm registry?

@ojas-krishnaprasad I'm fixing the aws permission to publish. Should be out end of day :)

[Mercy811]

@ojas-krishnaprasad amplitude-js@8.21.12 is now published and available on npm, and the latest dist-tag points to it: https://www.npmjs.com/package/amplitude-js/v/8.21.12

The release took a few follow-up fixes. query-string 10 uses syntax that our legacy Rollup build cannot parse, so #636 pins query-string to 9.5.1 while retaining the patched decoder dependency (the release lockfile resolves decode-uri-component to 0.5.1 for CVE-2026-118664). We also resolved release permissions and fixed an old Python dependency that blocked the S3/CDN upload in #637.

The 8.21.12 release workflow completed successfully. We verified the npm registry version and latest tag, and all six CDN script URLs return HTTP 200, including https://cdn.amplitude.com/libs/amplitude-8.21.12-min.gz.js.

Please upgrade to 8.21.12 and refresh your dependency lockfile so the query-string dependency chain resolves to the patched decoder. Thank you for the contribution and your patience!