@andersbakken/fisk 5.0.1 → 5.0.3

package/builder/fisk-builder.js

@@ -2508,7 +2508,7 @@ function push$1(dest, name, elem) {
  * @return {Object} The parsed object
  * @public
  */
-function parse$e(header) {
+function parse$d(header) {
   const offers = Object.create(null);
 
   if (header === undefined || header === '') return offers;
@@ -2659,7 +2659,7 @@ function parse$e(header) {
  * @return {String} A string representing the given object
  * @public
  */
-function format$6(extensions) {
+function format$5(extensions) {
   return Object.keys(extensions)
     .map((extension) => {
       let configurations = extensions[extension];
@@ -2683,7 +2683,7 @@ function format$6(extensions) {
     .join(', ');
 }
 
-var extension = { format: format$6, parse: parse$e };
+var extension = { format: format$5, parse: parse$d };
 
 /* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Readable$" }] */
 
@@ -2707,7 +2707,7 @@ const {
   NOOP
 } = constants$1;
 const { addEventListener, removeEventListener } = eventTarget;
-const { format: format$5, parse: parse$d } = extension;
+const { format: format$4, parse: parse$c } = extension;
 const { toBuffer } = bufferUtilExports;
 
 const readyStates = ['CONNECTING', 'OPEN', 'CLOSING', 'CLOSED'];
@@ -3341,7 +3341,7 @@ function initAsClient(websocket, address, protocols, options) {
       false,
       opts.maxPayload
     );
-    opts.headers['Sec-WebSocket-Extensions'] = format$5({
+    opts.headers['Sec-WebSocket-Extensions'] = format$4({
       [PerMessageDeflate$1.extensionName]: perMessageDeflate.offer()
     });
   }
@@ -3532,7 +3532,7 @@ function initAsClient(websocket, address, protocols, options) {
       let extensions;
 
       try {
-        extensions = parse$d(secWebSocketExtensions);
+        extensions = parse$c(secWebSocketExtensions);
       } catch (err) {
         const message = 'Invalid Sec-WebSocket-Extensions header';
         abortHandshake$1(websocket, socket, message);
@@ -4067,7 +4067,7 @@ const { createHash } = require$$5__default["default"];
 
 const PerMessageDeflate = permessageDeflate;
 const WebSocket$1 = websocket;
-const { format: format$4, parse: parse$c } = extension;
+const { format: format$3, parse: parse$b } = extension;
 const { GUID, kWebSocket } = constants$1;
 
 const keyRegex = /^[+/0-9A-Za-z]{22}==$/;
@@ -4290,7 +4290,7 @@ class WebSocketServer extends EventEmitter$1 {
       );
 
       try {
-        const offers = parse$c(req.headers['sec-websocket-extensions']);
+        const offers = parse$b(req.headers['sec-websocket-extensions']);
 
         if (offers[PerMessageDeflate.extensionName]) {
           perMessageDeflate.accept(offers[PerMessageDeflate.extensionName]);
@@ -4391,7 +4391,7 @@ class WebSocketServer extends EventEmitter$1 {
 
     if (extensions[PerMessageDeflate.extensionName]) {
       const params = extensions[PerMessageDeflate.extensionName].params;
-      const value = format$4({
+      const value = format$3({
         [PerMessageDeflate.extensionName]: [params]
       });
       headers.push(`Sec-WebSocket-Extensions: ${value}`);
@@ -9512,10 +9512,10 @@ function DeprecationError (namespace, message, stack) {
   return error
 }
 
-var bytesExports = {};
+var bytesExports$1 = {};
 var bytes$1 = {
-  get exports(){ return bytesExports; },
-  set exports(v){ bytesExports = v; },
+  get exports(){ return bytesExports$1; },
+  set exports(v){ bytesExports$1 = v; },
 };
 
 /*!
@@ -9525,166 +9525,174 @@ var bytes$1 = {
  * MIT Licensed
  */
 
-/**
- * Module exports.
- * @public
- */
+var hasRequiredBytes;
 
-bytes$1.exports = bytes;
-bytesExports.format = format$3;
-bytesExports.parse = parse$b;
+function requireBytes () {
+	if (hasRequiredBytes) return bytesExports$1;
+	hasRequiredBytes = 1;
 
-/**
- * Module variables.
- * @private
- */
+	/**
+	 * Module exports.
+	 * @public
+	 */
 
-var formatThousandsRegExp = /\B(?=(\d{3})+(?!\d))/g;
+	bytes$1.exports = bytes;
+	bytesExports$1.format = format;
+	bytesExports$1.parse = parse;
 
-var formatDecimalsRegExp = /(?:\.0*|(\.[^0]+)0+)$/;
+	/**
+	 * Module variables.
+	 * @private
+	 */
 
-var map = {
-  b:  1,
-  kb: 1 << 10,
-  mb: 1 << 20,
-  gb: 1 << 30,
-  tb: Math.pow(1024, 4),
-  pb: Math.pow(1024, 5),
-};
+	var formatThousandsRegExp = /\B(?=(\d{3})+(?!\d))/g;
 
-var parseRegExp = /^((-|\+)?(\d+(?:\.\d+)?)) *(kb|mb|gb|tb|pb)$/i;
+	var formatDecimalsRegExp = /(?:\.0*|(\.[^0]+)0+)$/;
 
-/**
- * Convert the given value in bytes into a string or parse to string to an integer in bytes.
- *
- * @param {string|number} value
- * @param {{
- *  case: [string],
- *  decimalPlaces: [number]
- *  fixedDecimals: [boolean]
- *  thousandsSeparator: [string]
- *  unitSeparator: [string]
- *  }} [options] bytes options.
- *
- * @returns {string|number|null}
- */
+	var map = {
+	  b:  1,
+	  kb: 1 << 10,
+	  mb: 1 << 20,
+	  gb: 1 << 30,
+	  tb: Math.pow(1024, 4),
+	  pb: Math.pow(1024, 5),
+	};
 
-function bytes(value, options) {
-  if (typeof value === 'string') {
-    return parse$b(value);
-  }
+	var parseRegExp = /^((-|\+)?(\d+(?:\.\d+)?)) *(kb|mb|gb|tb|pb)$/i;
 
-  if (typeof value === 'number') {
-    return format$3(value, options);
-  }
+	/**
+	 * Convert the given value in bytes into a string or parse to string to an integer in bytes.
+	 *
+	 * @param {string|number} value
+	 * @param {{
+	 *  case: [string],
+	 *  decimalPlaces: [number]
+	 *  fixedDecimals: [boolean]
+	 *  thousandsSeparator: [string]
+	 *  unitSeparator: [string]
+	 *  }} [options] bytes options.
+	 *
+	 * @returns {string|number|null}
+	 */
 
-  return null;
-}
+	function bytes(value, options) {
+	  if (typeof value === 'string') {
+	    return parse(value);
+	  }
 
-/**
- * Format the given value in bytes into a string.
- *
- * If the value is negative, it is kept as such. If it is a float,
- * it is rounded.
- *
- * @param {number} value
- * @param {object} [options]
- * @param {number} [options.decimalPlaces=2]
- * @param {number} [options.fixedDecimals=false]
- * @param {string} [options.thousandsSeparator=]
- * @param {string} [options.unit=]
- * @param {string} [options.unitSeparator=]
- *
- * @returns {string|null}
- * @public
- */
+	  if (typeof value === 'number') {
+	    return format(value, options);
+	  }
 
-function format$3(value, options) {
-  if (!Number.isFinite(value)) {
-    return null;
-  }
+	  return null;
+	}
 
-  var mag = Math.abs(value);
-  var thousandsSeparator = (options && options.thousandsSeparator) || '';
-  var unitSeparator = (options && options.unitSeparator) || '';
-  var decimalPlaces = (options && options.decimalPlaces !== undefined) ? options.decimalPlaces : 2;
-  var fixedDecimals = Boolean(options && options.fixedDecimals);
-  var unit = (options && options.unit) || '';
-
-  if (!unit || !map[unit.toLowerCase()]) {
-    if (mag >= map.pb) {
-      unit = 'PB';
-    } else if (mag >= map.tb) {
-      unit = 'TB';
-    } else if (mag >= map.gb) {
-      unit = 'GB';
-    } else if (mag >= map.mb) {
-      unit = 'MB';
-    } else if (mag >= map.kb) {
-      unit = 'KB';
-    } else {
-      unit = 'B';
-    }
-  }
+	/**
+	 * Format the given value in bytes into a string.
+	 *
+	 * If the value is negative, it is kept as such. If it is a float,
+	 * it is rounded.
+	 *
+	 * @param {number} value
+	 * @param {object} [options]
+	 * @param {number} [options.decimalPlaces=2]
+	 * @param {number} [options.fixedDecimals=false]
+	 * @param {string} [options.thousandsSeparator=]
+	 * @param {string} [options.unit=]
+	 * @param {string} [options.unitSeparator=]
+	 *
+	 * @returns {string|null}
+	 * @public
+	 */
 
-  var val = value / map[unit.toLowerCase()];
-  var str = val.toFixed(decimalPlaces);
+	function format(value, options) {
+	  if (!Number.isFinite(value)) {
+	    return null;
+	  }
 
-  if (!fixedDecimals) {
-    str = str.replace(formatDecimalsRegExp, '$1');
-  }
+	  var mag = Math.abs(value);
+	  var thousandsSeparator = (options && options.thousandsSeparator) || '';
+	  var unitSeparator = (options && options.unitSeparator) || '';
+	  var decimalPlaces = (options && options.decimalPlaces !== undefined) ? options.decimalPlaces : 2;
+	  var fixedDecimals = Boolean(options && options.fixedDecimals);
+	  var unit = (options && options.unit) || '';
+
+	  if (!unit || !map[unit.toLowerCase()]) {
+	    if (mag >= map.pb) {
+	      unit = 'PB';
+	    } else if (mag >= map.tb) {
+	      unit = 'TB';
+	    } else if (mag >= map.gb) {
+	      unit = 'GB';
+	    } else if (mag >= map.mb) {
+	      unit = 'MB';
+	    } else if (mag >= map.kb) {
+	      unit = 'KB';
+	    } else {
+	      unit = 'B';
+	    }
+	  }
 
-  if (thousandsSeparator) {
-    str = str.split('.').map(function (s, i) {
-      return i === 0
-        ? s.replace(formatThousandsRegExp, thousandsSeparator)
-        : s
-    }).join('.');
-  }
+	  var val = value / map[unit.toLowerCase()];
+	  var str = val.toFixed(decimalPlaces);
 
-  return str + unitSeparator + unit;
-}
+	  if (!fixedDecimals) {
+	    str = str.replace(formatDecimalsRegExp, '$1');
+	  }
 
-/**
- * Parse the string value into an integer in bytes.
- *
- * If no unit is given, it is assumed the value is in bytes.
- *
- * @param {number|string} val
- *
- * @returns {number|null}
- * @public
- */
+	  if (thousandsSeparator) {
+	    str = str.split('.').map(function (s, i) {
+	      return i === 0
+	        ? s.replace(formatThousandsRegExp, thousandsSeparator)
+	        : s
+	    }).join('.');
+	  }
 
-function parse$b(val) {
-  if (typeof val === 'number' && !isNaN(val)) {
-    return val;
-  }
+	  return str + unitSeparator + unit;
+	}
 
-  if (typeof val !== 'string') {
-    return null;
-  }
+	/**
+	 * Parse the string value into an integer in bytes.
+	 *
+	 * If no unit is given, it is assumed the value is in bytes.
+	 *
+	 * @param {number|string} val
+	 *
+	 * @returns {number|null}
+	 * @public
+	 */
+
+	function parse(val) {
+	  if (typeof val === 'number' && !isNaN(val)) {
+	    return val;
+	  }
 
-  // Test if the string passed is valid
-  var results = parseRegExp.exec(val);
-  var floatValue;
-  var unit = 'b';
+	  if (typeof val !== 'string') {
+	    return null;
+	  }
 
-  if (!results) {
-    // Nothing could be extracted from the given string
-    floatValue = parseInt(val, 10);
-    unit = 'b';
-  } else {
-    // Retrieve the value and the unit
-    floatValue = parseFloat(results[1]);
-    unit = results[4].toLowerCase();
-  }
+	  // Test if the string passed is valid
+	  var results = parseRegExp.exec(val);
+	  var floatValue;
+	  var unit = 'b';
 
-  if (isNaN(floatValue)) {
-    return null;
-  }
+	  if (!results) {
+	    // Nothing could be extracted from the given string
+	    floatValue = parseInt(val, 10);
+	    unit = 'b';
+	  } else {
+	    // Retrieve the value and the unit
+	    floatValue = parseFloat(results[1]);
+	    unit = results[4].toLowerCase();
+	  }
 
-  return Math.floor(map[unit] * floatValue);
+	  if (isNaN(floatValue)) {
+	    return null;
+	  }
+
+	  return Math.floor(map[unit] * floatValue);
+	}
+	return bytesExports$1;
 }
 
 var contentType = {};
@@ -22805,7 +22813,7 @@ function requireRawBody () {
 	 */
 
 	var asyncHooks = tryRequireAsyncHooks();
-	var bytes = bytesExports;
+	var bytes = requireBytes();
 	var createError = httpErrorsExports;
 	var iconv = requireLib();
 	var unpipe = unpipe_1;
@@ -35154,7 +35162,7 @@ function requireJson () {
 	 * @private
 	 */
 
-	var bytes = bytesExports;
+	var bytes = requireBytes();
 	var contentType$1 = contentType;
 	var createError = httpErrorsExports;
 	var debug = requireSrc$1()('body-parser:json');
@@ -35300,11 +35308,7 @@ function requireJson () {
 	  var partial = '';
 
 	  if (index !== -1) {
-	    partial = str.substring(0, index) + JSON_SYNTAX_CHAR;
-
-	    for (var i = index + 1; i < str.length; i++) {
-	      partial += JSON_SYNTAX_CHAR;
-	    }
+	    partial = str.substring(0, index) + new Array(str.length - index + 1).join(JSON_SYNTAX_CHAR);
 	  }
 
 	  try {
@@ -35407,7 +35411,7 @@ function requireRaw () {
 	 * Module dependencies.
 	 */
 
-	var bytes = bytesExports;
+	var bytes = requireBytes();
 	var debug = requireSrc$1()('body-parser:raw');
 	var read = requireRead();
 	var typeis = typeIsExports;
@@ -35516,7 +35520,7 @@ function requireText () {
 	 * Module dependencies.
 	 */
 
-	var bytes = bytesExports;
+	var bytes = requireBytes();
 	var contentType$1 = contentType;
 	var debug = requireSrc$1()('body-parser:text');
 	var read = requireRead();
@@ -37358,7 +37362,7 @@ var setMaxIndex = function setMaxIndex(obj, maxIndex) {
 var hexTable = (function () {
     var array = [];
     for (var i = 0; i < 256; ++i) {
-        array.push('%' + ((i < 16 ? '0' : '') + i.toString(16)).toUpperCase());
+        array[array.length] = '%' + ((i < 16 ? '0' : '') + i.toString(16)).toUpperCase();
     }
 
     return array;
@@ -37374,7 +37378,7 @@ var compactQueue = function compactQueue(queue) {
 
             for (var j = 0; j < obj.length; ++j) {
                 if (typeof obj[j] !== 'undefined') {
-                    compacted.push(obj[j]);
+                    compacted[compacted.length] = obj[j];
                 }
             }
 
@@ -37402,13 +37406,19 @@ var merge$3 = function merge(target, source, options) {
 
     if (typeof source !== 'object' && typeof source !== 'function') {
         if (isArray$3(target)) {
-            target.push(source);
+            var nextIndex = target.length;
+            if (options && typeof options.arrayLimit === 'number' && nextIndex > options.arrayLimit) {
+                return markOverflow(arrayToObject(target.concat(source), options), nextIndex);
+            }
+            target[nextIndex] = source;
         } else if (target && typeof target === 'object') {
             if (isOverflow(target)) {
                 // Add at next numeric index for overflow objects
                 var newIndex = getMaxIndex(target) + 1;
                 target[newIndex] = source;
                 setMaxIndex(target, newIndex);
+            } else if (options && options.strictMerge) {
+                return [target, source];
             } else if (
                 (options && (options.plainObjects || options.allowPrototypes))
                 || !has$2.call(Object.prototype, source)
@@ -37435,7 +37445,11 @@ var merge$3 = function merge(target, source, options) {
             }
             return markOverflow(result, getMaxIndex(source) + 1);
         }
-        return [target].concat(source);
+        var combined = [target].concat(source);
+        if (options && typeof options.arrayLimit === 'number' && combined.length > options.arrayLimit) {
+            return markOverflow(arrayToObject(combined, options), combined.length - 1);
+        }
+        return combined;
     }
 
     var mergeTarget = target;
@@ -37450,7 +37464,7 @@ var merge$3 = function merge(target, source, options) {
                 if (targetItem && typeof targetItem === 'object' && item && typeof item === 'object') {
                     target[i] = merge(targetItem, item, options);
                 } else {
-                    target.push(item);
+                    target[target.length] = item;
                 }
             } else {
                 target[i] = item;
@@ -37467,6 +37481,17 @@ var merge$3 = function merge(target, source, options) {
         } else {
             acc[key] = value;
         }
+
+        if (isOverflow(source) && !isOverflow(acc)) {
+            markOverflow(acc, getMaxIndex(source));
+        }
+        if (isOverflow(acc)) {
+            var keyNum = parseInt(key, 10);
+            if (String(keyNum) === key && keyNum >= 0 && keyNum > getMaxIndex(acc)) {
+                setMaxIndex(acc, keyNum);
+            }
+        }
+
         return acc;
     }, mergeTarget);
 };
@@ -37583,8 +37608,8 @@ var compact = function compact(value) {
             var key = keys[j];
             var val = obj[key];
             if (typeof val === 'object' && val !== null && refs.indexOf(val) === -1) {
-                queue.push({ obj: obj, prop: key });
-                refs.push(val);
+                queue[queue.length] = { obj: obj, prop: key };
+                refs[refs.length] = val;
             }
         }
     }
@@ -37626,7 +37651,7 @@ var maybeMap = function maybeMap(val, fn) {
     if (isArray$3(val)) {
         var mapped = [];
         for (var i = 0; i < val.length; i += 1) {
-            mapped.push(fn(val[i]));
+            mapped[mapped.length] = fn(val[i]);
         }
         return mapped;
     }
@@ -37643,6 +37668,7 @@ var utils$d = {
     isBuffer: isBuffer$1,
     isOverflow: isOverflow,
     isRegExp: isRegExp,
+    markOverflow: markOverflow,
     maybeMap: maybeMap,
     merge: merge$3
 };
@@ -37765,7 +37791,7 @@ var stringify$2 = function stringify(
 
     if (obj === null) {
         if (strictNullHandling) {
-            return encoder && !encodeValuesOnly ? encoder(prefix, defaults$5.encoder, charset, 'key', format) : prefix;
+            return formatter(encoder && !encodeValuesOnly ? encoder(prefix, defaults$5.encoder, charset, 'key', format) : prefix);
         }
 
         obj = '';
@@ -37789,7 +37815,9 @@ var stringify$2 = function stringify(
     if (generateArrayPrefix === 'comma' && isArray$2(obj)) {
         // we need to join elements in
         if (encodeValuesOnly && encoder) {
-            obj = utils$c.maybeMap(obj, encoder);
+            obj = utils$c.maybeMap(obj, function (v) {
+                return v == null ? v : encoder(v);
+            });
         }
         objKeys = [{ value: obj.length > 0 ? obj.join(',') || null : void undefined }];
     } else if (isArray$2(filter)) {
@@ -37959,6 +37987,11 @@ var stringify_1 = function (object, opts) {
     var sideChannel = getSideChannel();
     for (var i = 0; i < objKeys.length; ++i) {
         var key = objKeys[i];
+
+        if (typeof key === 'undefined' || key === null) {
+            continue;
+        }
+
         var value = obj[key];
 
         if (options.skipNulls && value === null) {
@@ -37992,10 +38025,10 @@ var stringify_1 = function (object, opts) {
     if (options.charsetSentinel) {
         if (options.charset === 'iso-8859-1') {
             // encodeURIComponent('&#10003;'), the "numeric entity" representation of a checkmark
-            prefix += 'utf8=%26%2310003%3B&';
+            prefix += 'utf8=%26%2310003%3B' + options.delimiter;
         } else {
             // encodeURIComponent('✓')
-            prefix += 'utf8=%E2%9C%93&';
+            prefix += 'utf8=%E2%9C%93' + options.delimiter;
         }
     }
 
@@ -38027,6 +38060,7 @@ var defaults$4 = {
     parseArrays: true,
     plainObjects: false,
     strictDepth: false,
+    strictMerge: true,
     strictNullHandling: false,
     throwOnLimitExceeded: false
 };
@@ -38065,13 +38099,13 @@ var parseValues = function parseQueryStringValues(str, options) {
     var cleanStr = options.ignoreQueryPrefix ? str.replace(/^\?/, '') : str;
     cleanStr = cleanStr.replace(/%5B/gi, '[').replace(/%5D/gi, ']');
 
-    var limit = options.parameterLimit === Infinity ? undefined : options.parameterLimit;
+    var limit = options.parameterLimit === Infinity ? void undefined : options.parameterLimit;
     var parts = cleanStr.split(
         options.delimiter,
-        options.throwOnLimitExceeded ? limit + 1 : limit
+        options.throwOnLimitExceeded && typeof limit !== 'undefined' ? limit + 1 : limit
     );
 
-    if (options.throwOnLimitExceeded && parts.length > limit) {
+    if (options.throwOnLimitExceeded && typeof limit !== 'undefined' && parts.length > limit) {
         throw new RangeError('Parameter limit exceeded. Only ' + limit + ' parameter' + (limit === 1 ? '' : 's') + ' allowed.');
     }
 
@@ -38132,9 +38166,16 @@ var parseValues = function parseQueryStringValues(str, options) {
             val = isArray$1(val) ? [val] : val;
         }
 
+        if (options.comma && isArray$1(val) && val.length > options.arrayLimit) {
+            if (options.throwOnLimitExceeded) {
+                throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
+            }
+            val = utils$b.combine([], val, options.arrayLimit, options.plainObjects);
+        }
+
         if (key !== null) {
             var existing = has.call(obj, key);
-            if (existing && options.duplicates === 'combine') {
+            if (existing && (options.duplicates === 'combine' || part.indexOf('[]=') > -1)) {
                 obj[key] = utils$b.combine(
                     obj[key],
                     val,
@@ -38182,17 +38223,21 @@ var parseObject = function (chain, val, options, valuesParsed) {
             var cleanRoot = root.charAt(0) === '[' && root.charAt(root.length - 1) === ']' ? root.slice(1, -1) : root;
             var decodedRoot = options.decodeDotInKeys ? cleanRoot.replace(/%2E/g, '.') : cleanRoot;
             var index = parseInt(decodedRoot, 10);
-            if (!options.parseArrays && decodedRoot === '') {
-                obj = { 0: leaf };
-            } else if (
-                !isNaN(index)
+            var isValidArrayIndex = !isNaN(index)
                 && root !== decodedRoot
                 && String(index) === decodedRoot
                 && index >= 0
-                && (options.parseArrays && index <= options.arrayLimit)
-            ) {
+                && options.parseArrays;
+            if (!options.parseArrays && decodedRoot === '') {
+                obj = { 0: leaf };
+            } else if (isValidArrayIndex && index < options.arrayLimit) {
                 obj = [];
                 obj[index] = leaf;
+            } else if (isValidArrayIndex && options.throwOnLimitExceeded) {
+                throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
+            } else if (isValidArrayIndex) {
+                obj[index] = leaf;
+                utils$b.markOverflow(obj, index);
             } else if (decodedRoot !== '__proto__') {
                 obj[decodedRoot] = leaf;
             }
@@ -38204,9 +38249,12 @@ var parseObject = function (chain, val, options, valuesParsed) {
     return leaf;
 };
 
-var splitKeyIntoSegments = function splitKeyIntoSegments(givenKey, options) {
-    var key = options.allowDots ? givenKey.replace(/\.([^.[]+)/g, '[$1]') : givenKey;
+// Split a key like "a[b][c[]]" into ['a', '[b]', '[c[]]'] while preserving
+// qs parse semantics for depth/prototype guards.
+var splitKeyIntoSegments = function splitKeyIntoSegments(originalKey, options) {
+    var key = options.allowDots ? originalKey.replace(/\.([^.[]+)/g, '[$1]') : originalKey;
 
+    // depth <= 0 keeps the whole key as one segment
     if (options.depth <= 0) {
         if (!options.plainObjects && has.call(Object.prototype, key)) {
             if (!options.allowPrototypes) {
@@ -38217,14 +38265,11 @@ var splitKeyIntoSegments = function splitKeyIntoSegments(givenKey, options) {
         return [key];
     }
 
-    var brackets = /(\[[^[\]]*])/;
-    var child = /(\[[^[\]]*])/g;
-
-    var segment = brackets.exec(key);
-    var parent = segment ? key.slice(0, segment.index) : key;
-
-    var keys = [];
+    var segments = [];
 
+    // parent before the first '[' (may be empty if key starts with '[')
+    var first = key.indexOf('[');
+    var parent = first >= 0 ? key.slice(0, first) : key;
     if (parent) {
         if (!options.plainObjects && has.call(Object.prototype, parent)) {
             if (!options.allowPrototypes) {
@@ -38232,32 +38277,62 @@ var splitKeyIntoSegments = function splitKeyIntoSegments(givenKey, options) {
             }
         }
 
-        keys.push(parent);
+        segments[segments.length] = parent;
     }
 
-    var i = 0;
-    while ((segment = child.exec(key)) !== null && i < options.depth) {
-        i += 1;
+    var n = key.length;
+    var open = first;
+    var collected = 0;
 
-        var segmentContent = segment[1].slice(1, -1);
-        if (!options.plainObjects && has.call(Object.prototype, segmentContent)) {
-            if (!options.allowPrototypes) {
-                return;
+    while (open >= 0 && collected < options.depth) {
+        var level = 1;
+        var i = open + 1;
+        var close = -1;
+
+        // balance nested '[' and ']' inside this bracket group using a nesting level counter
+        while (i < n && close < 0) {
+            var cu = key.charCodeAt(i);
+            if (cu === 0x5B) { // '['
+                level += 1;
+            } else if (cu === 0x5D) { // ']'
+                level -= 1;
+                if (level === 0) {
+                    close = i; // found matching close; loop will exit by condition
+                }
             }
+            i += 1;
         }
 
-        keys.push(segment[1]);
+        if (close < 0) {
+            // Unterminated group: wrap the raw remainder in one bracket pair so it stays
+            // a single literal segment (e.g. "[[]b" -> "[[]b]"); we do not infer missing ']'.
+            segments[segments.length] = '[' + key.slice(open) + ']';
+            return segments;
+        }
+
+        var seg = key.slice(open, close + 1);
+        // prototype guard for the content of this group
+        var content = seg.slice(1, -1);
+        if (!options.plainObjects && has.call(Object.prototype, content) && !options.allowPrototypes) {
+            return;
+        }
+
+        segments[segments.length] = seg;
+        collected += 1;
+
+        // find the next '[' after this balanced group
+        open = key.indexOf('[', close + 1);
     }
 
-    if (segment) {
+    if (open >= 0) {
         if (options.strictDepth === true) {
             throw new RangeError('Input depth exceeded depth option of ' + options.depth + ' and strictDepth is true');
         }
 
-        keys.push('[' + key.slice(segment.index) + ']');
+        segments[segments.length] = '[' + key.slice(open) + ']';
     }
 
-    return keys;
+    return segments;
 };
 
 var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
@@ -38330,6 +38405,7 @@ var normalizeParseOptions = function normalizeParseOptions(opts) {
         parseArrays: opts.parseArrays !== false,
         plainObjects: typeof opts.plainObjects === 'boolean' ? opts.plainObjects : defaults$4.plainObjects,
         strictDepth: typeof opts.strictDepth === 'boolean' ? !!opts.strictDepth : defaults$4.strictDepth,
+        strictMerge: typeof opts.strictMerge === 'boolean' ? !!opts.strictMerge : defaults$4.strictMerge,
         strictNullHandling: typeof opts.strictNullHandling === 'boolean' ? opts.strictNullHandling : defaults$4.strictNullHandling,
         throwOnLimitExceeded: typeof opts.throwOnLimitExceeded === 'boolean' ? opts.throwOnLimitExceeded : false
     };
@@ -38390,7 +38466,7 @@ function requireUrlencoded () {
 	 * @private
 	 */
 
-	var bytes = bytesExports;
+	var bytes = requireBytes();
 	var contentType$1 = contentType;
 	var createError = httpErrorsExports;
 	var debug = requireSrc$1()('body-parser:urlencoded');
@@ -38584,16 +38660,15 @@ function requireUrlencoded () {
 
 	function parameterCount (body, limit) {
 	  var count = 0;
-	  var index = 0;
+	  var index = -1;
 
-	  while ((index = body.indexOf('&', index)) !== -1) {
+	  do {
 	    count++;
-	    index++;
-
-	    if (count === limit) {
+	    if (count > limit) {
 	      return undefined
 	    }
-	  }
+	    index = body.indexOf('&', index + 1);
+	  } while (index !== -1)
 
 	  return count
 	}
@@ -41428,6 +41503,7 @@ function pathToRegexp(path, keys, options) {
       pos = offset + match.length;
 
       if (match === '*') {
+        backtrack = '';
         extraOffset += 3;
         return '(.*)';
       }
@@ -41457,6 +41533,7 @@ function pathToRegexp(path, keys, options) {
         + ')'
         + optional;
 
+      backtrack = '';
       extraOffset += result.length - match.length;
 
       return result;
@@ -50340,7 +50417,8 @@ function trustSingle (subnet) {
 
 	function parseExtendedQueryString(str) {
 	  return qs.parse(str, {
-	    allowPrototypes: true
+	    allowPrototypes: true,
+	    arrayLimit: 1000
 	  });
 	}
 
@@ -58120,6 +58198,13 @@ function requireFollowRedirects () {
 	  useNativeURL = error.code === "ERR_INVALID_URL";
 	}
 
+	// HTTP headers to drop across HTTP/HTTPS and domain boundaries
+	var sensitiveHeaders = [
+	  "Authorization",
+	  "Proxy-Authorization",
+	  "Cookie",
+	];
+
 	// URL fields to preserve in copy operations
 	var preservedUrlFields = [
 	  "auth",
@@ -58201,6 +58286,11 @@ function requireFollowRedirects () {
 	    }
 	  };
 
+	  // Create filter for sensitive HTTP headers
+	  this._headerFilter = new RegExp("^(?:" +
+	      sensitiveHeaders.concat(options.sensitiveHeaders).map(escapeRegex).join("|") +
+	    ")$", "i");
+
 	  // Perform the first request
 	  this._performRequest();
 	}
@@ -58384,6 +58474,9 @@ function requireFollowRedirects () {
 	  if (!options.headers) {
 	    options.headers = {};
 	  }
+	  if (!isArray(options.sensitiveHeaders)) {
+	    options.sensitiveHeaders = [];
+	  }
 
 	  // Since http.request treats host as an alias of hostname,
 	  // but the url module interprets host as hostname plus port,
@@ -58566,7 +58659,7 @@ function requireFollowRedirects () {
 	     redirectUrl.protocol !== "https:" ||
 	     redirectUrl.host !== currentHost &&
 	     !isSubdomain(redirectUrl.host, currentHost)) {
-	    removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
+	    removeMatchingHeaders(this._headerFilter, this._options.headers);
 	  }
 
 	  // Evaluate the beforeRedirect callback
@@ -58759,6 +58852,10 @@ function requireFollowRedirects () {
 	  return dot > 0 && subdomain[dot] === "." && subdomain.endsWith(domain);
 	}
 
+	function isArray(value) {
+	  return value instanceof Array;
+	}
+
 	function isString(value) {
 	  return typeof value === "string" || value instanceof String;
 	}
@@ -58775,6 +58872,10 @@ function requireFollowRedirects () {
 	  return URL && value instanceof URL;
 	}
 
+	function escapeRegex(regex) {
+	  return regex.replace(/[\]\\/()*+?.$]/g, "\\$&");
+	}
+
 	// Exports
 	followRedirects.exports = wrap({ http: http, https: https });
 	followRedirectsExports.wrap = wrap;
@@ -60013,6 +60114,9 @@ axiosExports.default = axios$1;
 
 var axios = /*@__PURE__*/getDefaultExportFromCjs(axiosExports$1);
 
+var bytesExports = requireBytes();
+var bytes = /*@__PURE__*/getDefaultExportFromCjs(bytesExports);
+
 if (process.argv.includes("--help") || process.argv.includes("-h")) {
     console.log(`Usage: fisk-builder [options]
 
@@ -60190,7 +60294,7 @@ const environments = {};
 const client = new Client(option, common.Version);
 client.on("objectCache", (enabled) => {
     const size = option("object-cache-size");
-    const objectCacheSize = typeof size === "number" ? size : bytesExports.parse(String(size));
+    const objectCacheSize = typeof size === "number" ? size : bytes.parse(String(size));
     // console.log("got object cache", enabled, objectCacheSize, option("object-cache-size"));
     if (enabled && objectCacheSize) {
         const objectCacheDir = option.string("object-cache-dir") || path__default["default"].join(common.cacheDir(), "objectcache");
@@ -60526,7 +60630,7 @@ client.on("getEnvironments", (message) => {
                 return;
             }
             console.log("Got finish", env);
-            exec("tar xf '" + file + "'", { cwd: dir })
+            exec("tar xf env.tar.gz", { cwd: dir })
                 .then(() => {
                 const json = path__default["default"].join(dir, "environment.json");
                 console.log("Writing json file", json);