@quantiya/codevibe-claude-plugin 2.0.26 → 2.0.27

package/node_modules/es-toolkit/dist/types/index.d.mts

@@ -1,3 +1,6 @@
+import { Simplify } from "./Simplify.mjs";
+import { Merge } from "./Merge.mjs";
+import { ObjectKeys } from "./ObjectKeys.mjs";
 import { ToCamelCaseKeys } from "./ToCamelCaseKeys.mjs";
 import { ToConstantCaseKeys } from "./ToConstantCaseKeys.mjs";
 import { ToKebabCaseKeys } from "./ToKebabCaseKeys.mjs";
@@ -5,8 +8,14 @@ import { ToPascalCaseKeys } from "./ToPascalCaseKeys.mjs";
 import { ToSnakeCaseKeys } from "./ToSnakeCaseKeys.mjs";
 import { DeepPartial } from "./DeepPartial.mjs";
 import { DeepReadonly } from "./DeepReadonly.mjs";
+import { EmptyObject } from "./EmptyObject.mjs";
+import { IsEqual } from "./IsEqual.mjs";
+import { JSONValue } from "./JSONValue.mjs";
 import { NonEmptyArray } from "./NonEmptyArray.mjs";
-import { Simplify } from "./Simplify.mjs";
+import { Primitive } from "./Primitive.mjs";
+import { SetOptional } from "./SetOptional.mjs";
+import { SetRequired } from "./SetRequired.mjs";
+import { UnknownRecord } from "./UnknownRecord.mjs";
 import { ValueOf } from "./ValueOf.mjs";
 import { Writable } from "./Writable.mjs";
-export { type DeepPartial, type DeepReadonly, type NonEmptyArray, type Simplify, type ToCamelCaseKeys, type ToConstantCaseKeys, type ToKebabCaseKeys, type ToPascalCaseKeys, type ToSnakeCaseKeys, type ValueOf, type Writable };
+export { type DeepPartial, type DeepReadonly, type EmptyObject, type IsEqual, type JSONValue, type Merge, type NonEmptyArray, type ObjectKeys, type Primitive, type SetOptional, type SetRequired, type Simplify, type ToCamelCaseKeys, type ToConstantCaseKeys, type ToKebabCaseKeys, type ToPascalCaseKeys, type ToSnakeCaseKeys, type UnknownRecord, type ValueOf, type Writable };

package/node_modules/es-toolkit/dist/types/index.d.ts

@@ -1,3 +1,6 @@
+import { Simplify } from "./Simplify.js";
+import { Merge } from "./Merge.js";
+import { ObjectKeys } from "./ObjectKeys.js";
 import { ToCamelCaseKeys } from "./ToCamelCaseKeys.js";
 import { ToConstantCaseKeys } from "./ToConstantCaseKeys.js";
 import { ToKebabCaseKeys } from "./ToKebabCaseKeys.js";
@@ -5,8 +8,14 @@ import { ToPascalCaseKeys } from "./ToPascalCaseKeys.js";
 import { ToSnakeCaseKeys } from "./ToSnakeCaseKeys.js";
 import { DeepPartial } from "./DeepPartial.js";
 import { DeepReadonly } from "./DeepReadonly.js";
+import { EmptyObject } from "./EmptyObject.js";
+import { IsEqual } from "./IsEqual.js";
+import { JSONValue } from "./JSONValue.js";
 import { NonEmptyArray } from "./NonEmptyArray.js";
-import { Simplify } from "./Simplify.js";
+import { Primitive } from "./Primitive.js";
+import { SetOptional } from "./SetOptional.js";
+import { SetRequired } from "./SetRequired.js";
+import { UnknownRecord } from "./UnknownRecord.js";
 import { ValueOf } from "./ValueOf.js";
 import { Writable } from "./Writable.js";
-export { type DeepPartial, type DeepReadonly, type NonEmptyArray, type Simplify, type ToCamelCaseKeys, type ToConstantCaseKeys, type ToKebabCaseKeys, type ToPascalCaseKeys, type ToSnakeCaseKeys, type ValueOf, type Writable };
+export { type DeepPartial, type DeepReadonly, type EmptyObject, type IsEqual, type JSONValue, type Merge, type NonEmptyArray, type ObjectKeys, type Primitive, type SetOptional, type SetRequired, type Simplify, type ToCamelCaseKeys, type ToConstantCaseKeys, type ToKebabCaseKeys, type ToPascalCaseKeys, type ToSnakeCaseKeys, type UnknownRecord, type ValueOf, type Writable };

package/node_modules/es-toolkit/dist/util/attempt.d.mts

@@ -38,6 +38,6 @@
  * });
  * ```
  */
-declare function attempt<T, E>(func: () => T): [null, T] | [E, null];
+declare function attempt<T, E = unknown>(func: () => T): [null, T] | [E, null];
 //#endregion
 export { attempt };

package/node_modules/es-toolkit/dist/util/attempt.d.ts

@@ -38,6 +38,6 @@
  * });
  * ```
  */
-declare function attempt<T, E>(func: () => T): [null, T] | [E, null];
+declare function attempt<T, E = unknown>(func: () => T): [null, T] | [E, null];
 //#endregion
 export { attempt };

package/node_modules/es-toolkit/dist/util/attemptAsync.d.mts

@@ -31,6 +31,6 @@
  * });
  * // users is typed as User[]
  */
-declare function attemptAsync<T, E>(func: () => Promise<T>): Promise<[null, T] | [E, null]>;
+declare function attemptAsync<T, E = unknown>(func: () => Promise<T>): Promise<[null, T] | [E, null]>;
 //#endregion
 export { attemptAsync };

package/node_modules/es-toolkit/dist/util/attemptAsync.d.ts

@@ -31,6 +31,6 @@
  * });
  * // users is typed as User[]
  */
-declare function attemptAsync<T, E>(func: () => Promise<T>): Promise<[null, T] | [E, null]>;
+declare function attemptAsync<T, E = unknown>(func: () => Promise<T>): Promise<[null, T] | [E, null]>;
 //#endregion
 export { attemptAsync };

package/node_modules/es-toolkit/dist/util/defer.d.mts

@@ -0,0 +1,27 @@
+//#region src/util/defer.d.ts
+/**
+ * Creates a `Disposable` object that runs the given callback when it is disposed.
+ *
+ * Use it with `using` declarations from
+ * [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management)
+ * to ensure cleanup code runs when the enclosing scope exits, even if an error is thrown.
+ *
+ * For asynchronous cleanup, use {@link deferAsync} with `await using` instead.
+ *
+ * @param callback - The cleanup function to run on dispose.
+ * @returns A `Disposable` object that invokes `callback` when disposed.
+ *
+ * @example
+ * const logs: string[] = [];
+ *
+ * function run() {
+ *   using cleanup = defer(() => logs.push('cleanup'));
+ *   logs.push('body');
+ * }
+ *
+ * run();
+ * console.log(logs); // ['body', 'cleanup']
+ */
+declare function defer(callback: () => void): Disposable;
+//#endregion
+export { defer };

package/node_modules/es-toolkit/dist/util/defer.d.ts

@@ -0,0 +1,27 @@
+//#region src/util/defer.d.ts
+/**
+ * Creates a `Disposable` object that runs the given callback when it is disposed.
+ *
+ * Use it with `using` declarations from
+ * [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management)
+ * to ensure cleanup code runs when the enclosing scope exits, even if an error is thrown.
+ *
+ * For asynchronous cleanup, use {@link deferAsync} with `await using` instead.
+ *
+ * @param callback - The cleanup function to run on dispose.
+ * @returns A `Disposable` object that invokes `callback` when disposed.
+ *
+ * @example
+ * const logs: string[] = [];
+ *
+ * function run() {
+ *   using cleanup = defer(() => logs.push('cleanup'));
+ *   logs.push('body');
+ * }
+ *
+ * run();
+ * console.log(logs); // ['body', 'cleanup']
+ */
+declare function defer(callback: () => void): Disposable;
+//#endregion
+export { defer };

package/node_modules/es-toolkit/dist/util/defer.js

@@ -0,0 +1,31 @@
+//#region src/util/defer.ts
+/**
+* Creates a `Disposable` object that runs the given callback when it is disposed.
+*
+* Use it with `using` declarations from
+* [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management)
+* to ensure cleanup code runs when the enclosing scope exits, even if an error is thrown.
+*
+* For asynchronous cleanup, use {@link deferAsync} with `await using` instead.
+*
+* @param callback - The cleanup function to run on dispose.
+* @returns A `Disposable` object that invokes `callback` when disposed.
+*
+* @example
+* const logs: string[] = [];
+*
+* function run() {
+*   using cleanup = defer(() => logs.push('cleanup'));
+*   logs.push('body');
+* }
+*
+* run();
+* console.log(logs); // ['body', 'cleanup']
+*/
+function defer(callback) {
+	return { [Symbol.dispose]: () => {
+		callback();
+	} };
+}
+//#endregion
+exports.defer = defer;

package/node_modules/es-toolkit/dist/util/defer.mjs

@@ -0,0 +1,31 @@
+//#region src/util/defer.ts
+/**
+* Creates a `Disposable` object that runs the given callback when it is disposed.
+*
+* Use it with `using` declarations from
+* [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management)
+* to ensure cleanup code runs when the enclosing scope exits, even if an error is thrown.
+*
+* For asynchronous cleanup, use {@link deferAsync} with `await using` instead.
+*
+* @param callback - The cleanup function to run on dispose.
+* @returns A `Disposable` object that invokes `callback` when disposed.
+*
+* @example
+* const logs: string[] = [];
+*
+* function run() {
+*   using cleanup = defer(() => logs.push('cleanup'));
+*   logs.push('body');
+* }
+*
+* run();
+* console.log(logs); // ['body', 'cleanup']
+*/
+function defer(callback) {
+	return { [Symbol.dispose]: () => {
+		callback();
+	} };
+}
+//#endregion
+export { defer };

package/node_modules/es-toolkit/dist/util/deferAsync.d.mts

@@ -0,0 +1,30 @@
+//#region src/util/deferAsync.d.ts
+/**
+ * Creates an `AsyncDisposable` object that runs the given callback when it is disposed.
+ *
+ * Use it with `await using` declarations from
+ * [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management)
+ * to ensure asynchronous cleanup code runs and is awaited when the enclosing scope exits,
+ * even if an error is thrown.
+ *
+ * For synchronous cleanup, use {@link defer} with `using` instead.
+ *
+ * @param callback - The cleanup function to run on dispose. Its result is awaited.
+ * @returns An `AsyncDisposable` object that invokes and awaits `callback` when disposed.
+ *
+ * @example
+ * const connection = await connect();
+ *
+ * async function run() {
+ *   await using cleanup = deferAsync(async () => {
+ *     await connection.close();
+ *   });
+ *
+ *   await connection.query('SELECT 1');
+ * }
+ *
+ * await run(); // The connection is closed after `run` finishes.
+ */
+declare function deferAsync(callback: () => void | PromiseLike<void>): AsyncDisposable;
+//#endregion
+export { deferAsync };

package/node_modules/es-toolkit/dist/util/deferAsync.d.ts

@@ -0,0 +1,30 @@
+//#region src/util/deferAsync.d.ts
+/**
+ * Creates an `AsyncDisposable` object that runs the given callback when it is disposed.
+ *
+ * Use it with `await using` declarations from
+ * [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management)
+ * to ensure asynchronous cleanup code runs and is awaited when the enclosing scope exits,
+ * even if an error is thrown.
+ *
+ * For synchronous cleanup, use {@link defer} with `using` instead.
+ *
+ * @param callback - The cleanup function to run on dispose. Its result is awaited.
+ * @returns An `AsyncDisposable` object that invokes and awaits `callback` when disposed.
+ *
+ * @example
+ * const connection = await connect();
+ *
+ * async function run() {
+ *   await using cleanup = deferAsync(async () => {
+ *     await connection.close();
+ *   });
+ *
+ *   await connection.query('SELECT 1');
+ * }
+ *
+ * await run(); // The connection is closed after `run` finishes.
+ */
+declare function deferAsync(callback: () => void | PromiseLike<void>): AsyncDisposable;
+//#endregion
+export { deferAsync };

package/node_modules/es-toolkit/dist/util/deferAsync.js

@@ -0,0 +1,34 @@
+//#region src/util/deferAsync.ts
+/**
+* Creates an `AsyncDisposable` object that runs the given callback when it is disposed.
+*
+* Use it with `await using` declarations from
+* [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management)
+* to ensure asynchronous cleanup code runs and is awaited when the enclosing scope exits,
+* even if an error is thrown.
+*
+* For synchronous cleanup, use {@link defer} with `using` instead.
+*
+* @param callback - The cleanup function to run on dispose. Its result is awaited.
+* @returns An `AsyncDisposable` object that invokes and awaits `callback` when disposed.
+*
+* @example
+* const connection = await connect();
+*
+* async function run() {
+*   await using cleanup = deferAsync(async () => {
+*     await connection.close();
+*   });
+*
+*   await connection.query('SELECT 1');
+* }
+*
+* await run(); // The connection is closed after `run` finishes.
+*/
+function deferAsync(callback) {
+	return { [Symbol.asyncDispose]: async () => {
+		await callback();
+	} };
+}
+//#endregion
+exports.deferAsync = deferAsync;

package/node_modules/es-toolkit/dist/util/deferAsync.mjs

@@ -0,0 +1,34 @@
+//#region src/util/deferAsync.ts
+/**
+* Creates an `AsyncDisposable` object that runs the given callback when it is disposed.
+*
+* Use it with `await using` declarations from
+* [Explicit Resource Management](https://github.com/tc39/proposal-explicit-resource-management)
+* to ensure asynchronous cleanup code runs and is awaited when the enclosing scope exits,
+* even if an error is thrown.
+*
+* For synchronous cleanup, use {@link defer} with `using` instead.
+*
+* @param callback - The cleanup function to run on dispose. Its result is awaited.
+* @returns An `AsyncDisposable` object that invokes and awaits `callback` when disposed.
+*
+* @example
+* const connection = await connect();
+*
+* async function run() {
+*   await using cleanup = deferAsync(async () => {
+*     await connection.close();
+*   });
+*
+*   await connection.query('SELECT 1');
+* }
+*
+* await run(); // The connection is closed after `run` finishes.
+*/
+function deferAsync(callback) {
+	return { [Symbol.asyncDispose]: async () => {
+		await callback();
+	} };
+}
+//#endregion
+export { deferAsync };

package/node_modules/es-toolkit/dist/util/index.d.mts

@@ -1,4 +1,6 @@
 import { attempt } from "./attempt.mjs";
 import { attemptAsync } from "./attemptAsync.mjs";
+import { defer } from "./defer.mjs";
+import { deferAsync } from "./deferAsync.mjs";
 import { invariant } from "./invariant.mjs";
-export { invariant as assert, attempt, attemptAsync, invariant };
+export { invariant as assert, attempt, attemptAsync, defer, deferAsync, invariant };

package/node_modules/es-toolkit/dist/util/index.d.ts

@@ -1,4 +1,6 @@
 import { attempt } from "./attempt.js";
 import { attemptAsync } from "./attemptAsync.js";
+import { defer } from "./defer.js";
+import { deferAsync } from "./deferAsync.js";
 import { invariant } from "./invariant.js";
-export { invariant as assert, attempt, attemptAsync, invariant };
+export { invariant as assert, attempt, attemptAsync, defer, deferAsync, invariant };

package/node_modules/es-toolkit/dist/util/index.js

@@ -1,8 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_attempt = require("./attempt.js");
 const require_attemptAsync = require("./attemptAsync.js");
+const require_defer = require("./defer.js");
+const require_deferAsync = require("./deferAsync.js");
 const require_invariant = require("./invariant.js");
 exports.assert = require_invariant.invariant;
 exports.attempt = require_attempt.attempt;
 exports.attemptAsync = require_attemptAsync.attemptAsync;
+exports.defer = require_defer.defer;
+exports.deferAsync = require_deferAsync.deferAsync;
 exports.invariant = require_invariant.invariant;

package/node_modules/es-toolkit/dist/util/index.mjs

@@ -1,4 +1,6 @@
 import { attempt } from "./attempt.mjs";
 import { attemptAsync } from "./attemptAsync.mjs";
+import { defer } from "./defer.mjs";
+import { deferAsync } from "./deferAsync.mjs";
 import { invariant } from "./invariant.mjs";
-export { invariant as assert, attempt, attemptAsync, invariant };
+export { invariant as assert, attempt, attemptAsync, defer, deferAsync, invariant };

package/node_modules/es-toolkit/fp/iterator.d.ts

@@ -0,0 +1 @@
+export * from '../dist/fp/iterator';

package/node_modules/es-toolkit/fp/iterator.js

@@ -0,0 +1 @@
+module.exports = require('../dist/fp/iterator');

package/node_modules/es-toolkit/iterator.d.ts

@@ -0,0 +1 @@
+export * from './dist/iterator';

package/node_modules/es-toolkit/iterator.js

@@ -0,0 +1 @@
+module.exports = require('./dist/iterator');

package/node_modules/es-toolkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "es-toolkit",
-  "version": "1.51.0",
+  "version": "1.52.0",
   "description": "A state-of-the-art, high-performance JavaScript utility library with a small bundle size and strong type annotations.",
   "homepage": "https://es-toolkit.dev",
   "bugs": "https://github.com/toss/es-toolkit/issues",
@@ -94,6 +94,16 @@
         "default": "./dist/fp/index.js"
       }
     },
+    "./fp/iterator": {
+      "import": {
+        "types": "./dist/fp/iterator/index.d.mts",
+        "default": "./dist/fp/iterator/index.mjs"
+      },
+      "require": {
+        "types": "./dist/fp/iterator/index.d.ts",
+        "default": "./dist/fp/iterator/index.js"
+      }
+    },
     "./function": {
       "import": {
         "types": "./dist/function/index.d.mts",
@@ -104,6 +114,16 @@
         "default": "./dist/function/index.js"
       }
     },
+    "./iterator": {
+      "import": {
+        "types": "./dist/iterator/index.d.mts",
+        "default": "./dist/iterator/index.mjs"
+      },
+      "require": {
+        "types": "./dist/iterator/index.d.ts",
+        "default": "./dist/iterator/index.js"
+      }
+    },
     "./map": {
       "import": {
         "types": "./dist/map/index.d.mts",
@@ -204,7 +224,10 @@
     "compat.js",
     "error.js",
     "fp.js",
+    "fp/iterator.js",
+    "fp/iterator.d.ts",
     "function.js",
+    "iterator.js",
     "map.js",
     "math.js",
     "object.js",
@@ -358,6 +381,16 @@
           "default": "./dist/fp/index.js"
         }
       },
+      "./fp/iterator": {
+        "import": {
+          "types": "./dist/fp/iterator/index.d.mts",
+          "default": "./dist/fp/iterator/index.mjs"
+        },
+        "require": {
+          "types": "./dist/fp/iterator/index.d.ts",
+          "default": "./dist/fp/iterator/index.js"
+        }
+      },
       "./function": {
         "import": {
           "types": "./dist/function/index.d.mts",
@@ -368,6 +401,16 @@
           "default": "./dist/function/index.js"
         }
       },
+      "./iterator": {
+        "import": {
+          "types": "./dist/iterator/index.d.mts",
+          "default": "./dist/iterator/index.mjs"
+        },
+        "require": {
+          "types": "./dist/iterator/index.d.ts",
+          "default": "./dist/iterator/index.js"
+        }
+      },
       "./map": {
         "import": {
           "types": "./dist/map/index.d.mts",

package/node_modules/node-abi/abi_registry.json

@@ -449,5 +449,12 @@
     "lts": false,
     "runtime": "electron",
     "target": "44.0.0-alpha.1"
+  },
+  {
+    "abi": "150",
+    "future": true,
+    "lts": false,
+    "runtime": "electron",
+    "target": "45.0.0-alpha.1"
   }
 ]

package/node_modules/node-abi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-abi",
-  "version": "3.95.0",
+  "version": "3.96.0",
   "description": "Get the Node ABI for a given target and runtime, and vice versa.",
   "main": "index.js",
   "scripts": {

package/node_modules/qs/.github/THREAT_MODEL.md

@@ -25,7 +25,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 
 **Trust Boundaries:**
 - **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
-- **Input object (stringify):** May contain cycles, which can lead to infinite loops during stringification
+- **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
 - **Options:** Provided by the caller
 - **Cycle Tracking:** Used only during stringification to detect and handle circular references
 
@@ -58,7 +58,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 |---------------------------------------------------|---------------------|
 | Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
 | Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | Enforce `arrayLimit` and `parameterLimit` with safe defaults; enable `throwOnLimitExceeded`; limit nesting depth[7]. |
+| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For a hard cap that rejects oversized untrusted input, opt in to `throwOnLimitExceeded: true` (default `false`), and always bound input size at the transport layer[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
 | Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
 
 ### 7. Risk Ranking
@@ -70,7 +70,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 ### 8. Next Steps & Review
 
 1. **Audit option validation logic.**
-2. **Add depth limiting to nested parsing and stringification.**
+2. **Depth limiting:** `parse` enforces a `depth` bound by default (with `strictDepth` to throw); `stringify` offers an opt-in `depth` bound (default `Infinity`, since its input is caller-produced) for defense-in-depth.
 3. **Implement fuzz testing for parser and stringifier edge cases.**
 4. **Regularly review dependencies for vulnerabilities.**
 5. **Keep documentation and threat model up to date.**

package/node_modules/qs/CHANGELOG.md

@@ -1,3 +1,18 @@
+## **6.16.0**
+ - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
+ - [Fix] stringify: serialize Date values when a filter is provided
+ - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
+ - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
+ - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
+ - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
+ - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
+ - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
+ - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
+ - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
+ - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
+ - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
+ - [Dev Deps] update `eslint`, `evalmd`
+
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
 - [Fix] `utils`: respect encoding of surrogate pairs across chunks (#559)

package/node_modules/qs/README.md

@@ -147,6 +147,8 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
 
+Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. To bound the total element count from untrusted input, set `throwOnLimitExceeded: true` (see `arrayLimit` below), and always bound the input size at the transport layer (e.g. an HTTP body-size limit).
+
 To bypass the leading question mark, use `ignoreQueryPrefix`:
 
 ```javascript
@@ -313,7 +315,9 @@ try {
 }
 ```
 
-When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key
+When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
+
+Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object — it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized input from untrusted sources, set `throwOnLimitExceeded: true`.
 
 To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
 Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
@@ -410,6 +414,20 @@ var encoded = qs.stringify({ a: { b: 'c' } }, { encoder: function (str) {
 
 _(Note: the `encoder` option does not apply if `encode` is `false`)_
 
+By default, `qs.stringify` serializes an object of any nesting depth.
+For backwards compatibility, and because its input is the caller's own object rather than a query string parsed by **qs**, this is unbounded.
+If you serialize objects whose nesting can be influenced by untrusted input, bound it with the numeric `depth` option (default `Infinity`);
+exceeding it throws a catchable `RangeError` instead of eventually overflowing the call stack:
+
+```javascript
+try {
+    qs.stringify({ a: { b: { c: { d: 'e' } } } }, { depth: 2 });
+} catch (err) {
+    assert(err instanceof RangeError);
+    assert.strictEqual(err.message, 'Input depth exceeded depth option of 2');
+}
+```
+
 Analogue to the `encoder` there is a `decoder` option for `parse` to override decoding of properties and values:
 
 ```javascript