[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
qs	6.16.0 → 6.17.1

---

Release Notes

ljharb/qs (qs)

v6.17.1

Compare Source

• [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#​640)
• [Fix] parse: respect plainObjects for [] with parseArrays: false (#​639)
• [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
• [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#​638)
• [Refactor] parse: extract wrapping-bracket stripping helper
• [readme] document that depth: 0 and depth: false keep keys flat
• [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

v6.17.0

Compare Source

• [New] stringify: add WHATWG format (#​623)
• [Fix] stringify: do not sort the caller's filter array in place (#​637)
• [Fix] parse: copy an own __proto__ key as data (#​636)
• [Fix] parse: decode percent-encoded dots case-insensitively (#​635)
• [Fix] stringify: encode keys when allowEmptyArrays is set (#​561)
• [Fix] parse: preserve comma arrays when interpreting numeric entities (#​630)
• [Fix] parse: allow scalar fields with a zero array limit (#​627)
• [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
• [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#​624)
• [eslint] fix indentation
• [readme] document the encoder's format argument
• [meta] add changelog acknowledgement
• [meta] fix changelog indents
• [Dev Deps] update eslint, evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
• [Tests] stringify: pin sort order for nested keys selected by an array filter
• [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
• [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
• [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
• [Tests] parse: pin the behavior of a zero or negative arrayLimit
• [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

v6.16.2

Compare Source

• [Fix] stringify: encode keys when allowEmptyArrays is set (#​561)
• [meta] use double quotes for better OS support
• [Dev Deps] update evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

v6.16.1

Compare Source

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#​564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#​565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#​621)
• [Fix] stringify: ignore inherited array format names (#​622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#​583)
• [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
• [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
• [Docs] document that qs and flat parsers disagree about parameter names
• [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
• [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#​567, #​568)
• [meta] fix changelog indents
• [actions] set least-privilege cache-mode
• [Tests] utils: decode: add missing cases
• [Tests] parse: characterize the ]= split when an = precedes any bracket group (#​620)
• [Tests] parse: allowDots: cover stray close brackets before a dot
• [Dev Deps] update @ljharb/eslint-config, eslint, tape

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Preview renovate/qs-6.x: https://loyal-possum-864.convex.site
Deployment: https://loyal-possum-864.convex.cloud
Dashboard: https://dashboard.convex.dev/d/loyal-possum-864