@openclaw/slack 2026.10.10 → 2026.11.5-beta.1

package/node_modules/@slack/bolt/node_modules/content-type/package.json

@@ -1,42 +1,52 @@
 {
   "name": "content-type",
+  "version": "2.1.0",
   "description": "Create and parse HTTP Content-Type header",
-  "version": "1.0.5",
-  "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
-  "license": "MIT",
   "keywords": [
     "content-type",
     "http",
     "req",
     "res",
-    "rfc7231"
+    "rfc7231",
+    "rfc9110"
   ],
   "repository": "jshttp/content-type",
-  "devDependencies": {
-    "deep-equal": "1.0.1",
-    "eslint": "8.32.0",
-    "eslint-config-standard": "15.0.1",
-    "eslint-plugin-import": "2.27.5",
-    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "6.1.1",
-    "eslint-plugin-standard": "4.1.0",
-    "mocha": "10.2.0",
-    "nyc": "15.1.0"
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
   },
+  "license": "MIT",
+  "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
+  "type": "commonjs",
+  "exports": "./dist/index.js",
+  "main": "./dist/index.js",
+  "typings": "./dist/index.d.ts",
   "files": [
-    "LICENSE",
-    "HISTORY.md",
-    "README.md",
-    "index.js"
+    "dist/"
   ],
+  "scripts": {
+    "bench": "vitest bench",
+    "build": "ts-scripts build",
+    "format": "ts-scripts format",
+    "prepare": "ts-scripts install && npm run build",
+    "specs": "ts-scripts specs",
+    "test": "ts-scripts test"
+  },
+  "devDependencies": {
+    "@borderless/ts-scripts": "^0.15.0",
+    "@vitest/coverage-v8": "^3.0.5",
+    "typescript": "^5.7.3",
+    "vitest": "^3.2.4"
+  },
   "engines": {
-    "node": ">= 0.6"
+    "node": ">=18"
   },
-  "scripts": {
-    "lint": "eslint .",
-    "test": "mocha --reporter spec --check-leaks --bail test/",
-    "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
-    "test-cov": "nyc --reporter=html --reporter=text npm test",
-    "version": "node scripts/version-history.js && git add HISTORY.md"
+  "ts-scripts": {
+    "dist": [
+      "dist"
+    ],
+    "project": [
+      "tsconfig.build.json"
+    ]
   }
 }

package/node_modules/@slack/bolt/node_modules/express/Readme.md

@@ -1,12 +1,14 @@
-[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](https://expressjs.com/)
+<a href="https://expressjs.com/">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://expressjs.com/images/logos/logo-express-white.svg">
+    <img alt="Express Logo" src="https://expressjs.com/images/logos/logo-express-black.svg" width="280">
+  </picture>
+</a>
 
 **Fast, unopinionated, minimalist web framework for [Node.js](https://nodejs.org).**
 
-**This project has a [Code of Conduct].**
-
 ## Table of contents
 
-- [Table of contents](#table-of-contents)
 - [Installation](#installation)
 - [Features](#features)
 - [Docs \& Community](#docs--community)
@@ -57,7 +59,7 @@ If this is a brand new project, make sure to create a `package.json` first with
 the [`npm init` command](https://docs.npmjs.com/creating-a-package-json-file).
 
 Installation is done using the
-[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+[`npm install` command](https://docs.npmjs.com/downloading-and-installing-packages-locally):
 
 ```bash
 npm install express
@@ -80,7 +82,7 @@ for more information.
 
   * [Website and Documentation](https://expressjs.com/) - [[website repo](https://github.com/expressjs/expressjs.com)]
   * [GitHub Organization](https://github.com/expressjs) for Official Middleware & Modules
-  * [Github Discussions](https://github.com/expressjs/discussions) for discussion on the development and usage of Express
+  * [GitHub Discussions](https://github.com/expressjs/discussions) for discussion on the development and usage of Express
 
 **PROTIP** Be sure to read the [migration guide to v5](https://expressjs.com/en/guide/migrating-5)
 
@@ -152,9 +154,11 @@ tests, triaging incoming pull requests and issues, and more!
 
 See the [Contributing Guide] for more technical details on contributing.
 
+This project has a [Code of Conduct]. By participating, you are expected to uphold this code.
+
 ### Security Issues
 
-If you discover a security vulnerability in Express, please see [Security Policies and Procedures](SECURITY.md).
+If you discover a security vulnerability in Express, please see [Security Policies and Procedures](https://github.com/expressjs/express/security/policy).
 
 ### Running Tests
 
@@ -212,7 +216,9 @@ The original author of Express is [TJ Holowaychuk](https://github.com/tj)
 * [IamLizu](https://github.com/IamLizu) - **S M Mahmudul Hasan** (he/him)
 * [Phillip9587](https://github.com/Phillip9587) - **Phillip Barta**
 * [efekrskl](https://github.com/efekrskl) - **Efe Karasakal**
-
+* [rxmarbles](https://github.com/rxmarbles) - **Rick Markins** (he/him)
+* [krzysdz](https://github.com/krzysdz)
+* [GroophyLifefor](https://github.com/GroophyLifefor) - **Murat Kirazkaya**
 
 <details>
 <summary>Triagers emeriti members</summary>
@@ -247,7 +253,7 @@ The original author of Express is [TJ Holowaychuk](https://github.com/tj)
   * [tunniclm](https://github.com/tunniclm) - **Mike Tunnicliffe**
   * [enyoghasim](https://github.com/enyoghasim) - **David Enyoghasim**
   * [0ss](https://github.com/0ss) - **Salah**
-  * [import-brain](https://github.com/import-brain) - **Eric Cheng** (he/him)
+  * [ejcheng](https://github.com/ejcheng)- **Eric Cheng** (he/him)
   * [dakshkhetan](https://github.com/dakshkhetan) - **Daksh Khetan** (he/him)
   * [lucasraziel](https://github.com/lucasraziel) - **Lucas Soares Do Rego**
   * [mertcanaltin](https://github.com/mertcanaltin) - **Mert Can Altin**

package/node_modules/@slack/bolt/node_modules/express/lib/application.js

@@ -523,7 +523,7 @@ app.render = function render(name, options, callback) {
   var cache = this.cache;
   var done = callback;
   var engines = this.engines;
-  var opts = options;
+  var opts = options || {};
   var view;
 
   // support callback function as second arg
@@ -614,7 +614,7 @@ app.listen = function listen() {
 
 function logerror(err) {
   /* istanbul ignore next */
-  if (this.get('env') !== 'test') console.error(err.stack || err.toString());
+  if (this.get('env') !== 'test') console.error(err);
 }
 
 /**

package/node_modules/@slack/bolt/node_modules/express/lib/request.js

@@ -83,16 +83,13 @@ req.header = function header(name) {
 };
 
 /**
- * To do: update docs.
- *
  * Check if the given `type(s)` is acceptable, returning
- * the best match when true, otherwise `undefined`, in which
+ * the best match when true, otherwise `false`, in which
  * case you should respond with 406 "Not Acceptable".
  *
  * The `type` value may be a single MIME type string
  * such as "application/json", an extension name
- * such as "json", a comma-delimited list such as "json, html, text/plain",
- * an argument list such as `"json", "html", "text/plain"`,
+ * such as "json", an argument list such as `"json", "html", "text/plain"`,
  * or an array `["json", "html", "text/plain"]`. When a list
  * or array is given, the _best_ match, if any is returned.
  *
@@ -107,7 +104,7 @@ req.header = function header(name) {
  *     // => "html"
  *     req.accepts('text/html');
  *     // => "text/html"
- *     req.accepts('json, text');
+ *     req.accepts('json', 'text');
  *     // => "json"
  *     req.accepts('application/json');
  *     // => "application/json"
@@ -115,12 +112,11 @@ req.header = function header(name) {
  *     // Accept: text/*, application/json
  *     req.accepts('image/png');
  *     req.accepts('png');
- *     // => undefined
+ *     // => false
  *
  *     // Accept: text/*;q=.5, application/json
  *     req.accepts(['html', 'json']);
  *     req.accepts('html', 'json');
- *     req.accepts('html, json');
  *     // => "json"
  *
  * @param {String|Array} type(s)
@@ -147,17 +143,34 @@ req.acceptsEncodings = function(){
 };
 
 /**
- * Check if the given `charset`s are acceptable,
- * otherwise you should respond with 406 "Not Acceptable".
+ * Checks if the specified `charset`s are acceptable based on the request's `Accept-Charset` header.
+ * Returns the best matching charset or an array of acceptable charsets.
  *
- * @param {String} ...charset
- * @return {String|Array}
+ * The `charset` argument(s) can be:
+ * - A single charset string (e.g., "utf-8")
+ * - Multiple charset strings as arguments (e.g., `"utf-8", "iso-8859-1"`)
+ * - A comma-delimited list of charsets (e.g., `"utf-8, iso-8859-1"`)
+ *
+ * Examples:
+ *
+ *     // Accept-Charset: utf-8, iso-8859-1
+ *     req.acceptsCharsets('utf-8');
+ *     // => "utf-8"
+ *
+ *     req.acceptsCharsets('utf-8', 'iso-8859-1');
+ *     // => "utf-8"
+ *
+ *     req.acceptsCharsets('utf-8, utf-16');
+ *     // => "utf-8"
+ *
+ * @param {...String} charsets - The charset(s) to check against the `Accept-Charset` header.
+ * @return {String|Array} - The best matching charset, or an array of acceptable charsets.
  * @public
  */
 
-req.acceptsCharsets = function(){
-  var accept = accepts(this);
-  return accept.charsets.apply(accept, arguments);
+req.acceptsCharsets = function(...charsets) {
+  const accept = accepts(this);
+  return accept.charsets(...charsets);
 };
 
 /**
@@ -317,7 +330,7 @@ defineGetter(req, 'secure', function secure(){
 /**
  * Return the remote address from the trusted proxy.
  *
- * The is the remote address on the socket unless
+ * This is the remote address on the socket unless
  * "trust proxy" is set.
  *
  * @return {String}
@@ -411,7 +424,7 @@ defineGetter(req, 'host', function host(){
   } else if (val.indexOf(',') !== -1) {
     // Note: X-Forwarded-Host is normally only ever a
     //       single value, but this is to be safe.
-    val = val.substring(0, val.indexOf(',')).trimRight()
+    val = val.substring(0, val.indexOf(',')).trimEnd()
   }
 
   return val || undefined;
@@ -458,8 +471,8 @@ defineGetter(req, 'fresh', function(){
   var res = this.res
   var status = res.statusCode
 
-  // GET or HEAD for weak freshness validation only
-  if ('GET' !== method && 'HEAD' !== method) return false;
+  // GET, HEAD, or QUERY for weak freshness validation only
+  if ('GET' !== method && 'HEAD' !== method && 'QUERY' !== method) return false;
 
   // 2xx or 304 as per rfc2616 14.26
   if ((status >= 200 && status < 300) || 304 === status) {

package/node_modules/@slack/bolt/node_modules/express/lib/response.js

@@ -31,6 +31,7 @@ var cookie = require('cookie');
 var send = require('send');
 var extname = path.extname;
 var resolve = path.resolve;
+var basename = path.basename;
 var vary = require('vary');
 const { Buffer } = require('node:buffer');
 
@@ -126,7 +127,6 @@ res.send = function send(body) {
   var chunk = body;
   var encoding;
   var req = this.req;
-  var type;
 
   // settings
   var app = this.app;
@@ -134,7 +134,12 @@ res.send = function send(body) {
   switch (typeof chunk) {
     // string defaulting to html
     case 'string':
-      if (!this.get('Content-Type')) {
+      encoding = 'utf8';
+      const type = this.get('Content-Type');
+
+      if (typeof type === 'string') {
+        this.set('Content-Type', setCharset(type, 'utf-8'));
+      } else {
         this.type('html');
       }
       break;
@@ -153,23 +158,11 @@ res.send = function send(body) {
       break;
   }
 
-  // write strings in utf-8
-  if (typeof chunk === 'string') {
-    encoding = 'utf8';
-    type = this.get('Content-Type');
-
-    // reflect this in content-type
-    if (typeof type === 'string') {
-      this.set('Content-Type', setCharset(type, 'utf-8'));
-    }
-  }
-
   // determine if ETag should be generated
   var etagFn = app.get('etag fn')
   var generateETag = !this.get('ETag') && typeof etagFn === 'function'
 
-  // populate Content-Length
-  var len
+  var len;
   if (chunk !== undefined) {
     if (Buffer.isBuffer(chunk)) {
       // get length of Buffer
@@ -184,7 +177,11 @@ res.send = function send(body) {
       len = chunk.length
     }
 
-    this.set('Content-Length', len);
+    // Because Content-Length and Transfer-Encoding can't be present in the response headers together,
+    // Content-Length should be added only if there is no Transfer-Encoding header
+    if (!this.get('Transfer-Encoding')) {
+      this.set('Content-Length', len);
+    }
   }
 
   // populate ETag
@@ -367,7 +364,7 @@ res.sendStatus = function sendStatus(statusCode) {
  *         if (yes) {
  *           res.sendFile('/uploads/' + uid + '/' + file);
  *         } else {
- *           res.send(403, 'Sorry! you cant see that.');
+ *           res.send(403, 'Sorry! you can\'t see that.');
  *         }
  *       });
  *     });
@@ -452,7 +449,7 @@ res.download = function download (path, filename, options, callback) {
     opts = null
   }
 
-  // support optional filename, where options may be in it's place
+  // support optional filename, where options may be in its place
   if (typeof filename === 'object' &&
     (typeof options === 'function' || options === undefined)) {
     name = null
@@ -461,7 +458,7 @@ res.download = function download (path, filename, options, callback) {
 
   // set Content-Disposition when file is sent
   var headers = {
-    'Content-Disposition': contentDisposition(name || path)
+    'Content-Disposition': contentDisposition.create(basename(name || path))
   };
 
   // merge user-provided headers
@@ -491,7 +488,7 @@ res.download = function download (path, filename, options, callback) {
 /**
  * Set _Content-Type_ response header with `type` through `mime.contentType()`
  * when it does not contain "/", or set the Content-Type to `type` otherwise.
- * When no mapping is found though `mime.contentType()`, the type is set to
+ * When no mapping is found through `mime.contentType()`, the type is set to
  * "application/octet-stream".
  *
  * Examples:
@@ -520,8 +517,9 @@ res.type = function contentType(type) {
  * Respond to the Acceptable formats using an `obj`
  * of mime-type callbacks.
  *
- * This method uses `req.accepted`, an array of
- * acceptable types ordered by their quality values.
+ * This method uses `req.accepts()`, which returns the
+ * best match from the acceptable types ordered by
+ * their quality values.
  * When "Accept" is not present the _first_ callback
  * is invoked, otherwise the first match is used. When
  * no match is performed the server responds with
@@ -609,11 +607,12 @@ res.format = function(obj){
  */
 
 res.attachment = function attachment(filename) {
-  if (filename) {
-    this.type(extname(filename));
+  const name = filename !== undefined ? basename(filename) : undefined;
+  if (name) {
+    this.type(extname(name));
   }
 
-  this.set('Content-Disposition', contentDisposition(filename));
+  this.set('Content-Disposition', contentDisposition.create(name));
 
   return this;
 };
@@ -784,12 +783,9 @@ res.cookie = function (name, value, options) {
 /**
  * Set the location header to `url`.
  *
- * The given `url` can also be "back", which redirects
- * to the _Referrer_ or _Referer_ headers or "/".
- *
  * Examples:
  *
- *    res.location('/foo/bar').;
+ *    res.location('/foo/bar');
  *    res.location('http://example.com');
  *    res.location('../login');
  *
@@ -850,7 +846,8 @@ res.redirect = function redirect(url) {
 
     html: function(){
       var u = escapeHtml(address);
-      body = '<p>' + statuses.message[status] + '. Redirecting to ' + u + '</p>'
+      body = '<!DOCTYPE html><head><title>' + statuses.message[status] + '</title></head>'
+       + '<body><p>' + statuses.message[status] + '. Redirecting to ' + u + '</p></body>'
     },
 
     default: function(){

package/node_modules/@slack/bolt/node_modules/express/package.json

@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "5.2.1",
+  "version": "5.3.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",
@@ -33,9 +33,9 @@
   ],
   "dependencies": {
     "accepts": "^2.0.0",
-    "body-parser": "^2.2.1",
-    "content-disposition": "^1.0.0",
-    "content-type": "^1.0.5",
+    "body-parser": "^2.3.0",
+    "content-disposition": "^2.0.1",
+    "content-type": "^2.0.0",
     "cookie": "^0.7.1",
     "cookie-signature": "^1.2.1",
     "debug": "^4.4.0",
@@ -51,14 +51,14 @@
     "on-finished": "^2.4.1",
     "once": "^1.4.0",
     "parseurl": "^1.3.3",
-    "proxy-addr": "^2.0.7",
-    "qs": "^6.14.0",
+    "proxy-addr": "^2.0.8",
+    "qs": "^6.16.0",
     "range-parser": "^1.2.1",
     "router": "^2.2.0",
     "send": "^1.1.0",
     "serve-static": "^2.2.0",
     "statuses": "^2.0.1",
-    "type-is": "^2.0.1",
+    "type-is": "^2.1.0",
     "vary": "^1.1.2"
   },
   "devDependencies": {
@@ -69,11 +69,11 @@
     "ejs": "^3.1.10",
     "eslint": "8.47.0",
     "express-session": "^1.18.1",
-    "hbs": "4.2.0",
+    "hbs": "4.3.1",
     "marked": "^15.0.3",
     "method-override": "3.0.0",
-    "mocha": "^10.7.3",
-    "morgan": "1.10.1",
+    "mocha": "^11.7.5",
+    "morgan": "1.12.1",
     "nyc": "^17.1.0",
     "pbkdf2-password": "1.2.1",
     "supertest": "^6.3.0",

package/node_modules/@slack/bolt/node_modules/qs/.github/THREAT_MODEL.md

@@ -24,7 +24,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 ```
 
 **Trust Boundaries:**
-- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
+- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests). `qs` defines its own key grammar, where bracket groups denote nesting, so the parameter names it derives are deliberately not the flat names produced by `URLSearchParams`, `node:querystring`, or a WHATWG-conformant parser. The parsed object, not the raw string, is the only thing a caller should make trust decisions about; see "Interpretation conflict" below.
 - **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
 - **Options:** Provided by the caller
 - **Cycle Tracking:** Used only during stringification to detect and handle circular references
@@ -51,6 +51,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 - **Information Disclosure:** Error messages may expose internal details or sensitive data.
 - **Denial of Service:** Large or malformed input can exhaust memory or CPU.
 - **Elevation of Privilege:** Prototype pollution can lead to unintended privilege escalation in the host application[3][4][8].
+- **Interpretation conflict (out of scope):** An application that parses the same query string with two different parsers, and makes a trust decision on one result while consuming the other, can be attacked by any input the two parsers read differently. `qs`'s bracket grammar guarantees such inputs exist, so this is a property of the deployment, not a defect `qs` can remove. It is the calling application's responsibility to parse once and validate the parsed object.
 
 ### 6. Mitigation/Countermeasures
 
@@ -58,8 +59,9 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 |---------------------------------------------------|---------------------|
 | Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
 | Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For a hard cap that rejects oversized untrusted input, opt in to `throwOnLimitExceeded: true` (default `false`), and always bound input size at the transport layer[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
+| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For hard caps on the number of parameters and on each array's length, opt in to `throwOnLimitExceeded: true` (default `false`), which rejects a query string with more than `parameterLimit` parameters, or one that would produce any array longer than `arrayLimit`. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values can still reach `parameterLimit` times `arrayLimit`; always bound input size at the transport layer as well[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
 | Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
+| Interpretation conflict (validate-then-use across two parsers) | None available inside `qs`, by construction: `qs` and a flat parser disagree about parameter names for well-formed input, so no hardening can make the two views equal. Parse untrusted input once, with `qs`, and apply deny lists, authorization, and signature checks to the parsed object rather than to raw key text. Text that `qs` cannot place in its grammar is currently dropped, so distinct raw names can share one parsed path ([#619](https://github.com/ljharb/qs/issues/619)). |
 
 ### 7. Risk Ranking
 

package/node_modules/@slack/bolt/node_modules/qs/CHANGELOG.md

@@ -1,17 +1,41 @@
+## **6.16.1**
+ - [Fix] `parse`: do not mutate an object input
+ - [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
+ - [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
+ - [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
+ - [Fix] `stringify`: ignore inherited array format names (#622)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
+ - [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
+ - [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
+ - [Fix] `parse`: only treat `[]` as array syntax when it ends the key
+ - [Perf] `decode`: skip decoders when there is no percent sign (#583)
+ - [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
+ - [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts
+ - [Docs] document that `qs` and flat parsers disagree about parameter names
+ - [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
+ - [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
+ - [meta] fix changelog indents
+ - [actions] set least-privilege `cache-mode`
+ - [Tests] `utils`: `decode`: add missing cases
+ - [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
+ - [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
+ - [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
+
 ## **6.16.0**
- - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
- - [Fix] stringify: serialize Date values when a filter is provided
- - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
- - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
- - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
- - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
- - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
- - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
- - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
- - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
- - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
- - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
- - [Dev Deps] update `eslint`, `evalmd`
+- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
+- [Fix] stringify: serialize Date values when a filter is provided
+- [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
+- [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
+- [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
+- [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
+- [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
+- [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
+- [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
+- [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
+- [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint`
+- [Dev Deps] update `eslint`, `evalmd`
 
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
@@ -29,7 +53,7 @@
 - [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
 - [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
 - [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
-- [Fix] `parse`: handle nested bracket groups and add regression tests (#530)
+- [Fix] `parse`: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
 - [readme] fix grammar (#550)
 - [Dev Deps] update `@ljharb/eslint-config`
 - [Tests] add regression tests for keys containing percent-encoded bracket text