@openclaw/slack 2026.11.3 → 2026.11.5-beta.2

package/node_modules/@slack/bolt/node_modules/content-type/README.md

@@ -1,81 +1,57 @@
 # content-type
 
-[![NPM Version][npm-version-image]][npm-url]
-[![NPM Downloads][npm-downloads-image]][npm-url]
-[![Node.js Version][node-image]][node-url]
-[![Build Status][ci-image]][ci-url]
-[![Coverage Status][coveralls-image]][coveralls-url]
+[![NPM version][npm-image]][npm-url]
+[![NPM downloads][downloads-image]][downloads-url]
+[![Build status][build-image]][build-url]
+[![Build coverage][coverage-image]][coverage-url]
+[![License][license-image]][license-url]
 
-Create and parse HTTP Content-Type header according to RFC 7231
+Create and parse HTTP `Content-Type` header.
 
 ## Installation
 
 ```sh
-$ npm install content-type
+npm install content-type
 ```
 
 ## API
 
 ```js
-var contentType = require('content-type')
+const contentType = require("content-type");
 ```
 
-### contentType.parse(string)
+### contentType.parse(string, options?)
 
 ```js
-var obj = contentType.parse('image/svg+xml; charset=utf-8')
+const obj = contentType.parse("image/svg+xml; charset=utf-8");
 ```
 
-Parse a `Content-Type` header. This will return an object with the following
-properties (examples are shown for the string `'image/svg+xml; charset=utf-8'`):
+Parse a `Content-Type` header. This will return an object with the following properties (examples are shown for the string `'image/svg+xml; charset=utf-8'`):
 
- - `type`: The media type (the type and subtype, always lower case).
-   Example: `'image/svg+xml'`
+- `type`: The media type. Example: `'image/svg+xml'`.
+- `parameters`: An object of the parameters in the media type (parameter name is always lower case). Example: `{charset: 'utf-8'}`.
 
- - `parameters`: An object of the parameters in the media type (name of parameter
-   always lower case). Example: `{charset: 'utf-8'}`
+The parser is lenient and does not error. You should validate `type` and `parameters` before trusting them.
 
-Throws a `TypeError` if the string is missing or invalid.
+#### Options
 
-### contentType.parse(req)
-
-```js
-var obj = contentType.parse(req)
-```
-
-Parse the `Content-Type` header from the given `req`. Short-cut for
-`contentType.parse(req.headers['content-type'])`.
-
-Throws a `TypeError` if the `Content-Type` header is missing or invalid.
-
-### contentType.parse(res)
-
-```js
-var obj = contentType.parse(res)
-```
-
-Parse the `Content-Type` header set on the given `res`. Short-cut for
-`contentType.parse(res.getHeader('content-type'))`.
-
-Throws a `TypeError` if the `Content-Type` header is missing or invalid.
+- `parameters` (default: `true`): Set to `false` to skip parameters.
+- `comma` (default: `false`): Set to `true` to stop on a comma. This can be used to parse the media range in an `Accept` header.
+- `start` (default: `0`): Set index to start parsing from.
 
 ### contentType.format(obj)
 
 ```js
-var str = contentType.format({
-  type: 'image/svg+xml',
-  parameters: { charset: 'utf-8' }
-})
+const str = contentType.format({
+  type: "image/svg+xml",
+  parameters: { charset: "utf-8" },
+});
 ```
 
-Format an object into a `Content-Type` header. This will return a string of the
-content type for the given object with the following properties (examples are
-shown that produce the string `'image/svg+xml; charset=utf-8'`):
-
- - `type`: The media type (will be lower-cased). Example: `'image/svg+xml'`
+Format an object into a `Content-Type` header. This will return a string of the content type for the given object with the following properties (examples are shown that produce the string `'image/svg+xml; charset=utf-8'`):
 
- - `parameters`: An object of the parameters in the media type (name of the
-   parameter will be lower-cased). Example: `{charset: 'utf-8'}`
+- `type`: The media type. Example: `'image/svg+xml'`.
+- `parameters`: An optional object of the parameters in the media type. Example: `{charset: 'utf-8'}`.
 
 Throws a `TypeError` if the object contains an invalid type or parameter names.
 
@@ -83,12 +59,13 @@ Throws a `TypeError` if the object contains an invalid type or parameter names.
 
 [MIT](LICENSE)
 
-[ci-image]: https://badgen.net/github/checks/jshttp/content-type/master?label=ci
-[ci-url]: https://github.com/jshttp/content-type/actions/workflows/ci.yml
-[coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/content-type/master
-[coveralls-url]: https://coveralls.io/r/jshttp/content-type?branch=master
-[node-image]: https://badgen.net/npm/node/content-type
-[node-url]: https://nodejs.org/en/download
-[npm-downloads-image]: https://badgen.net/npm/dm/content-type
+[npm-image]: https://img.shields.io/npm/v/content-type
 [npm-url]: https://npmjs.org/package/content-type
-[npm-version-image]: https://badgen.net/npm/v/content-type
+[downloads-image]: https://img.shields.io/npm/dm/content-type
+[downloads-url]: https://npmjs.org/package/content-type
+[build-image]: https://img.shields.io/github/actions/workflow/status/jshttp/content-type/ci.yml?branch=master
+[build-url]: https://github.com/jshttp/content-type/actions/workflows/ci.yml?query=branch%3Amaster
+[coverage-image]: https://img.shields.io/codecov/c/gh/jshttp/content-type
+[coverage-url]: https://codecov.io/gh/jshttp/content-type
+[license-image]: http://img.shields.io/npm/l/content-type.svg?style=flat
+[license-url]: LICENSE

package/node_modules/@slack/bolt/node_modules/content-type/package.json

@@ -1,42 +1,52 @@
 {
   "name": "content-type",
+  "version": "2.1.0",
   "description": "Create and parse HTTP Content-Type header",
-  "version": "1.0.5",
-  "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
-  "license": "MIT",
   "keywords": [
     "content-type",
     "http",
     "req",
     "res",
-    "rfc7231"
+    "rfc7231",
+    "rfc9110"
   ],
   "repository": "jshttp/content-type",
-  "devDependencies": {
-    "deep-equal": "1.0.1",
-    "eslint": "8.32.0",
-    "eslint-config-standard": "15.0.1",
-    "eslint-plugin-import": "2.27.5",
-    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "6.1.1",
-    "eslint-plugin-standard": "4.1.0",
-    "mocha": "10.2.0",
-    "nyc": "15.1.0"
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
   },
+  "license": "MIT",
+  "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
+  "type": "commonjs",
+  "exports": "./dist/index.js",
+  "main": "./dist/index.js",
+  "typings": "./dist/index.d.ts",
   "files": [
-    "LICENSE",
-    "HISTORY.md",
-    "README.md",
-    "index.js"
+    "dist/"
   ],
+  "scripts": {
+    "bench": "vitest bench",
+    "build": "ts-scripts build",
+    "format": "ts-scripts format",
+    "prepare": "ts-scripts install && npm run build",
+    "specs": "ts-scripts specs",
+    "test": "ts-scripts test"
+  },
+  "devDependencies": {
+    "@borderless/ts-scripts": "^0.15.0",
+    "@vitest/coverage-v8": "^3.0.5",
+    "typescript": "^5.7.3",
+    "vitest": "^3.2.4"
+  },
   "engines": {
-    "node": ">= 0.6"
+    "node": ">=18"
   },
-  "scripts": {
-    "lint": "eslint .",
-    "test": "mocha --reporter spec --check-leaks --bail test/",
-    "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
-    "test-cov": "nyc --reporter=html --reporter=text npm test",
-    "version": "node scripts/version-history.js && git add HISTORY.md"
+  "ts-scripts": {
+    "dist": [
+      "dist"
+    ],
+    "project": [
+      "tsconfig.build.json"
+    ]
   }
 }

package/node_modules/@slack/bolt/node_modules/express/Readme.md

@@ -1,12 +1,14 @@
-[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](https://expressjs.com/)
+<a href="https://expressjs.com/">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://expressjs.com/images/logos/logo-express-white.svg">
+    <img alt="Express Logo" src="https://expressjs.com/images/logos/logo-express-black.svg" width="280">
+  </picture>
+</a>
 
 **Fast, unopinionated, minimalist web framework for [Node.js](https://nodejs.org).**
 
-**This project has a [Code of Conduct].**
-
 ## Table of contents
 
-- [Table of contents](#table-of-contents)
 - [Installation](#installation)
 - [Features](#features)
 - [Docs \& Community](#docs--community)
@@ -57,7 +59,7 @@ If this is a brand new project, make sure to create a `package.json` first with
 the [`npm init` command](https://docs.npmjs.com/creating-a-package-json-file).
 
 Installation is done using the
-[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+[`npm install` command](https://docs.npmjs.com/downloading-and-installing-packages-locally):
 
 ```bash
 npm install express
@@ -80,7 +82,7 @@ for more information.
 
   * [Website and Documentation](https://expressjs.com/) - [[website repo](https://github.com/expressjs/expressjs.com)]
   * [GitHub Organization](https://github.com/expressjs) for Official Middleware & Modules
-  * [Github Discussions](https://github.com/expressjs/discussions) for discussion on the development and usage of Express
+  * [GitHub Discussions](https://github.com/expressjs/discussions) for discussion on the development and usage of Express
 
 **PROTIP** Be sure to read the [migration guide to v5](https://expressjs.com/en/guide/migrating-5)
 
@@ -152,9 +154,11 @@ tests, triaging incoming pull requests and issues, and more!
 
 See the [Contributing Guide] for more technical details on contributing.
 
+This project has a [Code of Conduct]. By participating, you are expected to uphold this code.
+
 ### Security Issues
 
-If you discover a security vulnerability in Express, please see [Security Policies and Procedures](SECURITY.md).
+If you discover a security vulnerability in Express, please see [Security Policies and Procedures](https://github.com/expressjs/express/security/policy).
 
 ### Running Tests
 
@@ -212,7 +216,9 @@ The original author of Express is [TJ Holowaychuk](https://github.com/tj)
 * [IamLizu](https://github.com/IamLizu) - **S M Mahmudul Hasan** (he/him)
 * [Phillip9587](https://github.com/Phillip9587) - **Phillip Barta**
 * [efekrskl](https://github.com/efekrskl) - **Efe Karasakal**
-
+* [rxmarbles](https://github.com/rxmarbles) - **Rick Markins** (he/him)
+* [krzysdz](https://github.com/krzysdz)
+* [GroophyLifefor](https://github.com/GroophyLifefor) - **Murat Kirazkaya**
 
 <details>
 <summary>Triagers emeriti members</summary>
@@ -247,7 +253,7 @@ The original author of Express is [TJ Holowaychuk](https://github.com/tj)
   * [tunniclm](https://github.com/tunniclm) - **Mike Tunnicliffe**
   * [enyoghasim](https://github.com/enyoghasim) - **David Enyoghasim**
   * [0ss](https://github.com/0ss) - **Salah**
-  * [import-brain](https://github.com/import-brain) - **Eric Cheng** (he/him)
+  * [ejcheng](https://github.com/ejcheng)- **Eric Cheng** (he/him)
   * [dakshkhetan](https://github.com/dakshkhetan) - **Daksh Khetan** (he/him)
   * [lucasraziel](https://github.com/lucasraziel) - **Lucas Soares Do Rego**
   * [mertcanaltin](https://github.com/mertcanaltin) - **Mert Can Altin**

package/node_modules/@slack/bolt/node_modules/express/lib/application.js

@@ -523,7 +523,7 @@ app.render = function render(name, options, callback) {
   var cache = this.cache;
   var done = callback;
   var engines = this.engines;
-  var opts = options;
+  var opts = options || {};
   var view;
 
   // support callback function as second arg
@@ -614,7 +614,7 @@ app.listen = function listen() {
 
 function logerror(err) {
   /* istanbul ignore next */
-  if (this.get('env') !== 'test') console.error(err.stack || err.toString());
+  if (this.get('env') !== 'test') console.error(err);
 }
 
 /**

package/node_modules/@slack/bolt/node_modules/express/lib/request.js

@@ -83,16 +83,13 @@ req.header = function header(name) {
 };
 
 /**
- * To do: update docs.
- *
  * Check if the given `type(s)` is acceptable, returning
- * the best match when true, otherwise `undefined`, in which
+ * the best match when true, otherwise `false`, in which
  * case you should respond with 406 "Not Acceptable".
  *
  * The `type` value may be a single MIME type string
  * such as "application/json", an extension name
- * such as "json", a comma-delimited list such as "json, html, text/plain",
- * an argument list such as `"json", "html", "text/plain"`,
+ * such as "json", an argument list such as `"json", "html", "text/plain"`,
  * or an array `["json", "html", "text/plain"]`. When a list
  * or array is given, the _best_ match, if any is returned.
  *
@@ -107,7 +104,7 @@ req.header = function header(name) {
  *     // => "html"
  *     req.accepts('text/html');
  *     // => "text/html"
- *     req.accepts('json, text');
+ *     req.accepts('json', 'text');
  *     // => "json"
  *     req.accepts('application/json');
  *     // => "application/json"
@@ -115,12 +112,11 @@ req.header = function header(name) {
  *     // Accept: text/*, application/json
  *     req.accepts('image/png');
  *     req.accepts('png');
- *     // => undefined
+ *     // => false
  *
  *     // Accept: text/*;q=.5, application/json
  *     req.accepts(['html', 'json']);
  *     req.accepts('html', 'json');
- *     req.accepts('html, json');
  *     // => "json"
  *
  * @param {String|Array} type(s)
@@ -147,17 +143,34 @@ req.acceptsEncodings = function(){
 };
 
 /**
- * Check if the given `charset`s are acceptable,
- * otherwise you should respond with 406 "Not Acceptable".
+ * Checks if the specified `charset`s are acceptable based on the request's `Accept-Charset` header.
+ * Returns the best matching charset or an array of acceptable charsets.
  *
- * @param {String} ...charset
- * @return {String|Array}
+ * The `charset` argument(s) can be:
+ * - A single charset string (e.g., "utf-8")
+ * - Multiple charset strings as arguments (e.g., `"utf-8", "iso-8859-1"`)
+ * - A comma-delimited list of charsets (e.g., `"utf-8, iso-8859-1"`)
+ *
+ * Examples:
+ *
+ *     // Accept-Charset: utf-8, iso-8859-1
+ *     req.acceptsCharsets('utf-8');
+ *     // => "utf-8"
+ *
+ *     req.acceptsCharsets('utf-8', 'iso-8859-1');
+ *     // => "utf-8"
+ *
+ *     req.acceptsCharsets('utf-8, utf-16');
+ *     // => "utf-8"
+ *
+ * @param {...String} charsets - The charset(s) to check against the `Accept-Charset` header.
+ * @return {String|Array} - The best matching charset, or an array of acceptable charsets.
  * @public
  */
 
-req.acceptsCharsets = function(){
-  var accept = accepts(this);
-  return accept.charsets.apply(accept, arguments);
+req.acceptsCharsets = function(...charsets) {
+  const accept = accepts(this);
+  return accept.charsets(...charsets);
 };
 
 /**
@@ -317,7 +330,7 @@ defineGetter(req, 'secure', function secure(){
 /**
  * Return the remote address from the trusted proxy.
  *
- * The is the remote address on the socket unless
+ * This is the remote address on the socket unless
  * "trust proxy" is set.
  *
  * @return {String}
@@ -411,7 +424,7 @@ defineGetter(req, 'host', function host(){
   } else if (val.indexOf(',') !== -1) {
     // Note: X-Forwarded-Host is normally only ever a
     //       single value, but this is to be safe.
-    val = val.substring(0, val.indexOf(',')).trimRight()
+    val = val.substring(0, val.indexOf(',')).trimEnd()
   }
 
   return val || undefined;
@@ -458,8 +471,8 @@ defineGetter(req, 'fresh', function(){
   var res = this.res
   var status = res.statusCode
 
-  // GET or HEAD for weak freshness validation only
-  if ('GET' !== method && 'HEAD' !== method) return false;
+  // GET, HEAD, or QUERY for weak freshness validation only
+  if ('GET' !== method && 'HEAD' !== method && 'QUERY' !== method) return false;
 
   // 2xx or 304 as per rfc2616 14.26
   if ((status >= 200 && status < 300) || 304 === status) {

package/node_modules/@slack/bolt/node_modules/express/lib/response.js

@@ -31,6 +31,7 @@ var cookie = require('cookie');
 var send = require('send');
 var extname = path.extname;
 var resolve = path.resolve;
+var basename = path.basename;
 var vary = require('vary');
 const { Buffer } = require('node:buffer');
 
@@ -126,7 +127,6 @@ res.send = function send(body) {
   var chunk = body;
   var encoding;
   var req = this.req;
-  var type;
 
   // settings
   var app = this.app;
@@ -134,7 +134,12 @@ res.send = function send(body) {
   switch (typeof chunk) {
     // string defaulting to html
     case 'string':
-      if (!this.get('Content-Type')) {
+      encoding = 'utf8';
+      const type = this.get('Content-Type');
+
+      if (typeof type === 'string') {
+        this.set('Content-Type', setCharset(type, 'utf-8'));
+      } else {
         this.type('html');
       }
       break;
@@ -153,23 +158,11 @@ res.send = function send(body) {
       break;
   }
 
-  // write strings in utf-8
-  if (typeof chunk === 'string') {
-    encoding = 'utf8';
-    type = this.get('Content-Type');
-
-    // reflect this in content-type
-    if (typeof type === 'string') {
-      this.set('Content-Type', setCharset(type, 'utf-8'));
-    }
-  }
-
   // determine if ETag should be generated
   var etagFn = app.get('etag fn')
   var generateETag = !this.get('ETag') && typeof etagFn === 'function'
 
-  // populate Content-Length
-  var len
+  var len;
   if (chunk !== undefined) {
     if (Buffer.isBuffer(chunk)) {
       // get length of Buffer
@@ -184,7 +177,11 @@ res.send = function send(body) {
       len = chunk.length
     }
 
-    this.set('Content-Length', len);
+    // Because Content-Length and Transfer-Encoding can't be present in the response headers together,
+    // Content-Length should be added only if there is no Transfer-Encoding header
+    if (!this.get('Transfer-Encoding')) {
+      this.set('Content-Length', len);
+    }
   }
 
   // populate ETag
@@ -367,7 +364,7 @@ res.sendStatus = function sendStatus(statusCode) {
  *         if (yes) {
  *           res.sendFile('/uploads/' + uid + '/' + file);
  *         } else {
- *           res.send(403, 'Sorry! you cant see that.');
+ *           res.send(403, 'Sorry! you can\'t see that.');
  *         }
  *       });
  *     });
@@ -452,7 +449,7 @@ res.download = function download (path, filename, options, callback) {
     opts = null
   }
 
-  // support optional filename, where options may be in it's place
+  // support optional filename, where options may be in its place
   if (typeof filename === 'object' &&
     (typeof options === 'function' || options === undefined)) {
     name = null
@@ -461,7 +458,7 @@ res.download = function download (path, filename, options, callback) {
 
   // set Content-Disposition when file is sent
   var headers = {
-    'Content-Disposition': contentDisposition(name || path)
+    'Content-Disposition': contentDisposition.create(basename(name || path))
   };
 
   // merge user-provided headers
@@ -491,7 +488,7 @@ res.download = function download (path, filename, options, callback) {
 /**
  * Set _Content-Type_ response header with `type` through `mime.contentType()`
  * when it does not contain "/", or set the Content-Type to `type` otherwise.
- * When no mapping is found though `mime.contentType()`, the type is set to
+ * When no mapping is found through `mime.contentType()`, the type is set to
  * "application/octet-stream".
  *
  * Examples:
@@ -520,8 +517,9 @@ res.type = function contentType(type) {
  * Respond to the Acceptable formats using an `obj`
  * of mime-type callbacks.
  *
- * This method uses `req.accepted`, an array of
- * acceptable types ordered by their quality values.
+ * This method uses `req.accepts()`, which returns the
+ * best match from the acceptable types ordered by
+ * their quality values.
  * When "Accept" is not present the _first_ callback
  * is invoked, otherwise the first match is used. When
  * no match is performed the server responds with
@@ -609,11 +607,12 @@ res.format = function(obj){
  */
 
 res.attachment = function attachment(filename) {
-  if (filename) {
-    this.type(extname(filename));
+  const name = filename !== undefined ? basename(filename) : undefined;
+  if (name) {
+    this.type(extname(name));
   }
 
-  this.set('Content-Disposition', contentDisposition(filename));
+  this.set('Content-Disposition', contentDisposition.create(name));
 
   return this;
 };
@@ -784,12 +783,9 @@ res.cookie = function (name, value, options) {
 /**
  * Set the location header to `url`.
  *
- * The given `url` can also be "back", which redirects
- * to the _Referrer_ or _Referer_ headers or "/".
- *
  * Examples:
  *
- *    res.location('/foo/bar').;
+ *    res.location('/foo/bar');
  *    res.location('http://example.com');
  *    res.location('../login');
  *
@@ -850,7 +846,8 @@ res.redirect = function redirect(url) {
 
     html: function(){
       var u = escapeHtml(address);
-      body = '<p>' + statuses.message[status] + '. Redirecting to ' + u + '</p>'
+      body = '<!DOCTYPE html><head><title>' + statuses.message[status] + '</title></head>'
+       + '<body><p>' + statuses.message[status] + '. Redirecting to ' + u + '</p></body>'
     },
 
     default: function(){

package/node_modules/@slack/bolt/node_modules/express/package.json

@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "5.2.1",
+  "version": "5.3.0",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",
@@ -33,9 +33,9 @@
   ],
   "dependencies": {
     "accepts": "^2.0.0",
-    "body-parser": "^2.2.1",
-    "content-disposition": "^1.0.0",
-    "content-type": "^1.0.5",
+    "body-parser": "^2.3.0",
+    "content-disposition": "^2.0.1",
+    "content-type": "^2.0.0",
     "cookie": "^0.7.1",
     "cookie-signature": "^1.2.1",
     "debug": "^4.4.0",
@@ -51,14 +51,14 @@
     "on-finished": "^2.4.1",
     "once": "^1.4.0",
     "parseurl": "^1.3.3",
-    "proxy-addr": "^2.0.7",
-    "qs": "^6.14.0",
+    "proxy-addr": "^2.0.8",
+    "qs": "^6.16.0",
     "range-parser": "^1.2.1",
     "router": "^2.2.0",
     "send": "^1.1.0",
     "serve-static": "^2.2.0",
     "statuses": "^2.0.1",
-    "type-is": "^2.0.1",
+    "type-is": "^2.1.0",
     "vary": "^1.1.2"
   },
   "devDependencies": {
@@ -69,11 +69,11 @@
     "ejs": "^3.1.10",
     "eslint": "8.47.0",
     "express-session": "^1.18.1",
-    "hbs": "4.2.0",
+    "hbs": "4.3.1",
     "marked": "^15.0.3",
     "method-override": "3.0.0",
-    "mocha": "^10.7.3",
-    "morgan": "1.10.1",
+    "mocha": "^11.7.5",
+    "morgan": "1.12.1",
     "nyc": "^17.1.0",
     "pbkdf2-password": "1.2.1",
     "supertest": "^6.3.0",

package/node_modules/@slack/bolt/node_modules/qs/.github/THREAT_MODEL.md

@@ -24,7 +24,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 ```
 
 **Trust Boundaries:**
-- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
+- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests). `qs` defines its own key grammar, where bracket groups denote nesting, so the parameter names it derives are deliberately not the flat names produced by `URLSearchParams`, `node:querystring`, or a WHATWG-conformant parser. The parsed object, not the raw string, is the only thing a caller should make trust decisions about; see "Interpretation conflict" below.
 - **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
 - **Options:** Provided by the caller
 - **Cycle Tracking:** Used only during stringification to detect and handle circular references
@@ -51,6 +51,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 - **Information Disclosure:** Error messages may expose internal details or sensitive data.
 - **Denial of Service:** Large or malformed input can exhaust memory or CPU.
 - **Elevation of Privilege:** Prototype pollution can lead to unintended privilege escalation in the host application[3][4][8].
+- **Interpretation conflict (out of scope):** An application that parses the same query string with two different parsers, and makes a trust decision on one result while consuming the other, can be attacked by any input the two parsers read differently. `qs`'s bracket grammar guarantees such inputs exist, so this is a property of the deployment, not a defect `qs` can remove. It is the calling application's responsibility to parse once and validate the parsed object.
 
 ### 6. Mitigation/Countermeasures
 
@@ -58,8 +59,9 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 |---------------------------------------------------|---------------------|
 | Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
 | Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For a hard cap that rejects oversized untrusted input, opt in to `throwOnLimitExceeded: true` (default `false`), and always bound input size at the transport layer[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
+| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For hard caps on the number of parameters and on each array's length, opt in to `throwOnLimitExceeded: true` (default `false`), which rejects a query string with more than `parameterLimit` parameters, or one that would produce any array longer than `arrayLimit`. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values can still reach `parameterLimit` times `arrayLimit`; always bound input size at the transport layer as well[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
 | Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
+| Interpretation conflict (validate-then-use across two parsers) | None available inside `qs`, by construction: `qs` and a flat parser disagree about parameter names for well-formed input, so no hardening can make the two views equal. Parse untrusted input once, with `qs`, and apply deny lists, authorization, and signature checks to the parsed object rather than to raw key text. Text that `qs` cannot place in its grammar is currently dropped, so distinct raw names can share one parsed path ([#619](https://github.com/ljharb/qs/issues/619)). |
 
 ### 7. Risk Ranking