From 8a298d4d1329fbf7f1150cd06ef1fae23a138ade Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 14:07:42 +0000
Subject: [PATCH] chore(deps): Bump qs from 6.16.0 to 6.17.0 (#2279)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [qs](https://github.com/ljharb/qs) from 6.16.0 to 6.17.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.17.0</strong></h2>
<ul>
<li>[New] <code>stringify</code>: add <code>WHATWG</code> format (<a
href="https://redirect.github.com/ljharb/qs/issues/623">#623</a>)</li>
<li>[Fix] <code>stringify</code>: do not sort the caller's
<code>filter</code> array in place (<a
href="https://redirect.github.com/ljharb/qs/issues/637">#637</a>)</li>
<li>[Fix] <code>parse</code>: copy an own <code>__proto__</code> key as
data (<a
href="https://redirect.github.com/ljharb/qs/issues/636">#636</a>)</li>
<li>[Fix] <code>parse</code>: decode percent-encoded dots
case-insensitively (<a
href="https://redirect.github.com/ljharb/qs/issues/635">#635</a>)</li>
<li>[Fix] <code>stringify</code>: encode keys when
<code>allowEmptyArrays</code> is set (<a
href="https://redirect.github.com/ljharb/qs/issues/561">#561</a>)</li>
<li>[Fix] <code>parse</code>: preserve comma arrays when interpreting
numeric entities (<a
href="https://redirect.github.com/ljharb/qs/issues/630">#630</a>)</li>
<li>[Fix] <code>parse</code>: allow scalar fields with a zero array
limit (<a
href="https://redirect.github.com/ljharb/qs/issues/627">#627</a>)</li>
<li>[Fix] <code>parse</code>: do not count an existing comma array
toward <code>arrayLimit</code> when <code>duplicates</code> discards or
replaces it</li>
<li>[Fix] <code>utils</code>: <code>encode</code>: encode lone
surrogates as U+FFFD instead of consuming the next code unit (<a
href="https://redirect.github.com/ljharb/qs/issues/624">#624</a>)</li>
<li>[eslint] fix indentation</li>
<li>[readme] document the encoder's <code>format</code> argument</li>
<li>[meta] add changelog acknowledgement</li>
<li>[meta] fix changelog indents</li>
<li>[Dev Deps] update <code>eslint</code>, <code>evalmd</code>,
<code>npmignore</code></li>
<li>[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code>
output for keys that need no encoding</li>
<li>[Tests] <code>stringify</code>: pin <code>sort</code> order for
nested keys selected by an array <code>filter</code></li>
<li>[Tests] <code>parse</code>: cover
<code>interpretNumericEntities</code> across value shapes, keys, and the
charset sentinel</li>
<li>[Tests] <code>parse</code>: cover more input that builds no array at
a zero or negative <code>arrayLimit</code></li>
<li>[Tests] <code>parse</code>: cover <code>comma</code> with a zero or
negative <code>arrayLimit</code>, and combining a full comma array</li>
<li>[Tests] <code>parse</code>: pin the behavior of a zero or negative
<code>arrayLimit</code></li>
<li>[Tests] <code>utils</code>/<code>stringify</code>: pin
<code>~</code>, <code>*</code>, and parens encoding in RFC3986 and
RFC1738</li>
</ul>
<h2><strong>6.16.2</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: encode keys when
<code>allowEmptyArrays</code> is set (<a
href="https://redirect.github.com/ljharb/qs/issues/561">#561</a>)</li>
<li>[meta] use double quotes for better OS support</li>
<li>[Dev Deps] update <code>evalmd</code>, <code>npmignore</code></li>
<li>[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code>
output for keys that need no encoding</li>
</ul>
<h2><strong>6.16.1</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: do not mutate an object input</li>
<li>[Fix] <code>stringify</code>: stop re-encoding structural separator
dots when <code>encodeDotInKeys</code> is set (<a
href="https://redirect.github.com/ljharb/qs/issues/564">#564</a>)</li>
<li>[Fix] <code>stringify</code>: <code>arrayFormat: 'comma'</code>:
pass the full encoder arguments with <code>encodeValuesOnly</code></li>
<li>[Fix] <code>utils</code>: encode <code>+</code> as <code>%2B</code>
in iso-8859-1 mode so values round-trip (<a
href="https://redirect.github.com/ljharb/qs/issues/565">#565</a>)</li>
<li>[Fix] parse: only convert top-level dots to brackets when allowDots
is on (<a
href="https://redirect.github.com/ljharb/qs/issues/621">#621</a>)</li>
<li>[Fix] <code>stringify</code>: ignore inherited array format names
(<a
href="https://redirect.github.com/ljharb/qs/issues/622">#622</a>)</li>
<li>[Fix] <code>stringify</code>: <code>arrayFormat: 'comma'</code>: do
not throw on elements with no callable <code>toString</code></li>
<li>[Fix] <code>utils</code>: <code>merge</code>: seed an overflow
container's index from its own keys, not just the source</li>
<li>[Fix] <code>utils</code>: <code>merge</code>: keep a
<code>strictMerge</code> conflict container's index and
<code>arrayLimit</code> correct</li>
<li>[Fix] <code>parse</code>: only treat <code>[]</code> as array syntax
when it ends the key</li>
<li>[Perf] <code>decode</code>: skip decoders when there is no percent
sign (<a
href="https://redirect.github.com/ljharb/qs/issues/583">#583</a>)</li>
<li>[Robustness] <code>utils</code>: <code>merge</code>: apply
<code>arrayLimit</code> to the two-element array built for colliding
values</li>
<li>[Robustness] <code>parse</code>: bound the nesting added by repeated
<code>strictMerge</code> conflicts (credit <a
href="https://github.com/Yeaseen"><code>@​Yeaseen</code></a>)</li>
<li>[Docs] document that <code>qs</code> and flat parsers disagree about
parameter names</li>
<li>[Docs] clarify that <code>throwOnLimitExceeded</code> limits each
array, not the total number of values</li>
<li>[Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (<a
href="https://redirect.github.com/ljharb/qs/issues/567">#567</a>, <a
href="https://redirect.github.com/ljharb/qs/issues/568">#568</a>)</li>
<li>[meta] fix changelog indents</li>
<li>[actions] set least-privilege <code>cache-mode</code></li>
<li>[Tests] <code>utils</code>: <code>decode</code>: add missing
cases</li>
<li>[Tests] <code>parse</code>: characterize the <code>]=</code> split
when an <code>=</code> precedes any bracket group (<a
href="https://redirect.github.com/ljharb/qs/issues/620">#620</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ljharb/qs/commit/bebfa1ab2ed4e5d6cd9317d42a65609296ebd2cb"><code>bebfa1a</code></a>
v6.17.0</li>
<li><a
href="https://github.com/ljharb/qs/commit/574a28be4cb190a3f3249b6fd325b16cd146b762"><code>574a28b</code></a>
[Dev Deps] update <code>eslint</code></li>
<li><a
href="https://github.com/ljharb/qs/commit/54f7f3b7b8df3d59a05255be1ef81208fdee1412"><code>54f7f3b</code></a>
[Fix] <code>stringify</code>: do not sort the caller's
<code>filter</code> array in place</li>
<li><a
href="https://github.com/ljharb/qs/commit/a2667af367b13fe0e5cc5bc8aad176ea57160f8b"><code>a2667af</code></a>
[Fix] <code>parse</code>: copy an own <code>__proto__</code> key as
data</li>
<li><a
href="https://github.com/ljharb/qs/commit/05a875552a31829825c3ebf8899f280011aa06be"><code>05a8755</code></a>
[Fix] <code>parse</code>: decode percent-encoded dots
case-insensitively</li>
<li><a
href="https://github.com/ljharb/qs/commit/234d5051f5071efaa025a7ca9e4d34a56a460a1b"><code>234d505</code></a>
[Fix] <code>stringify</code>: encode keys when
<code>allowEmptyArrays</code> is set</li>
<li><a
href="https://github.com/ljharb/qs/commit/5d9999948fb2718acfa4436b9d6a8ac181812873"><code>5d99999</code></a>
[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code> output
for keys that need no enco...</li>
<li><a
href="https://github.com/ljharb/qs/commit/feafd1517d5304cf07675c7a5efa5f2b1a905067"><code>feafd15</code></a>
[Tests] <code>stringify</code>: pin <code>sort</code> order for nested
keys selected by an array `f...</li>
<li><a
href="https://github.com/ljharb/qs/commit/b43b1cf8d0747d8520746d8cf6998d568431816a"><code>b43b1cf</code></a>
[Fix] <code>parse</code>: preserve comma arrays when interpreting
numeric entities</li>
<li><a
href="https://github.com/ljharb/qs/commit/81e7a2251d5a7f4c38e8ea77a31a285ab16d1822"><code>81e7a22</code></a>
[Tests] <code>parse</code>: cover <code>interpretNumericEntities</code>
across value shapes, keys, ...</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.16.0...v6.17.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7758612b..1afc3ca1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10515,9 +10515,9 @@
       "license": "MIT"
     },
     "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "version": "6.17.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.0.tgz",
+      "integrity": "sha512-5LK5BZ2XDHMvcUJaf0CQ5HL3aVgKbpklvByC7qLSxYkfE8COEEbJg5xCHWCTqzqi0Gs4Jn5Mv5v3R38W6edscA==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",