[dependabot]

Bumps qs from 6.16.0 to 6.17.1.

Changelog

Sourced from qs's changelog.

6.17.1

• [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#640)
• [Fix] parse: respect plainObjects for [] with parseArrays: false (#639)
• [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
• [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#638)
• [Refactor] parse: extract wrapping-bracket stripping helper
• [readme] document that depth: 0 and depth: false keep keys flat
• [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

6.17.0

• [New] stringify: add WHATWG format (#623)
• [Fix] stringify: do not sort the caller's filter array in place (#637)
• [Fix] parse: copy an own __proto__ key as data (#636)
• [Fix] parse: decode percent-encoded dots case-insensitively (#635)
• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [Fix] parse: preserve comma arrays when interpreting numeric entities (#630)
• [Fix] parse: allow scalar fields with a zero array limit (#627)
• [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
• [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
• [eslint] fix indentation
• [readme] document the encoder's format argument
• [meta] add changelog acknowledgement
• [meta] fix changelog indents
• [Dev Deps] update eslint, evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
• [Tests] stringify: pin sort order for nested keys selected by an array filter
• [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
• [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
• [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
• [Tests] parse: pin the behavior of a zero or negative arrayLimit
• [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

6.16.2

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)

... (truncated)

Commits

• 43baea4 v6.17.1
• 54623b6 [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as...
• 7924b65 [Fix] parse: respect plainObjects for [] with parseArrays: false
• 7d4b440 [readme] document that depth: 0 and depth: false keep keys flat
• 101492a [Fix] utils: merge: count the elements of a sparse array against `arrayLi...
• 42eccf0 [Fix] parse: guard bracket-wrapped prototype keys at depth 0
• ae0b5c7 [Refactor] parse: extract wrapping-bracket stripping helper
• 6459f9f [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by `al...
• cb6855c Merge backport release tags v6.12.6–v6.16.2 into main
• 136912a v6.16.2
• Additional commits viewable in compare view

[github-actions]

👋 Friendly nudge — this PR has had no activity for 7 days.

What needs attention:

• 👀 No approving reviews yet. Request a review from a teammate.
• ⬇️ 12 commits behind dev. Rebase to pick up latest changes.

---

If this PR is abandoned, please close it. If it's blocked on something external, leave a comment so the team knows.
This is an automated check that runs on weekdays. It won't nudge the same PR more than once per week.

[dependabot]

Superseded by #2398.