@quantiya/codevibe-claude-plugin 2.0.27 → 2.0.28

package/node_modules/es-toolkit/dist/object/merge.js

@@ -2,6 +2,46 @@ const require_isPlainObject = require("../predicate/isPlainObject.js");
 const require_isMergeableValue = require("../_internal/isMergeableValue.js");
 const require_isUnsafeProperty = require("../_internal/isUnsafeProperty.js");
 //#region src/object/merge.ts
+/**
+* Merges the properties of the source object into the target object.
+*
+* This function performs a deep merge, meaning nested objects and arrays are merged recursively.
+* If a property in the source object is an array or an object and the corresponding property in the target object is also an array or object, they will be merged.
+* If a property in the source object is undefined, it will not overwrite a defined property in the target object.
+*
+* Note that this function mutates the target object.
+*
+* @param target - The target object into which the source object properties will be merged. This object is modified in place.
+* @param source - The source object whose properties will be merged into the target object.
+* @returns The updated target object with properties from the source object merged in.
+*
+* @template T - Type of the target object.
+* @template S - Type of the source object.
+*
+* @example
+* const target = { a: 1, b: { x: 1, y: 2 } };
+* const source = { b: { y: 3, z: 4 }, c: 5 };
+*
+* const result = merge(target, source);
+* console.log(result);
+* // Output: { a: 1, b: { x: 1, y: 3, z: 4 }, c: 5 }
+*
+* @example
+* const target = { a: [1, 2], b: { x: 1 } };
+* const source = { a: [3], b: { y: 2 } };
+*
+* const result = merge(target, source);
+* console.log(result);
+* // Output: { a: [3, 2], b: { x: 1, y: 2 } }
+*
+* @example
+* const target = { a: null };
+* const source = { a: [1, 2, 3] };
+*
+* const result = merge(target, source);
+* console.log(result);
+* // Output: { a: [1, 2, 3] }
+*/
 function merge(target, source) {
 	const sourceKeys = Object.keys(source);
 	for (let i = 0; i < sourceKeys.length; i++) {

package/node_modules/es-toolkit/dist/object/merge.mjs

@@ -2,6 +2,46 @@ import { isPlainObject } from "../predicate/isPlainObject.mjs";
 import { isMergeableValue } from "../_internal/isMergeableValue.mjs";
 import { isUnsafeProperty } from "../_internal/isUnsafeProperty.mjs";
 //#region src/object/merge.ts
+/**
+* Merges the properties of the source object into the target object.
+*
+* This function performs a deep merge, meaning nested objects and arrays are merged recursively.
+* If a property in the source object is an array or an object and the corresponding property in the target object is also an array or object, they will be merged.
+* If a property in the source object is undefined, it will not overwrite a defined property in the target object.
+*
+* Note that this function mutates the target object.
+*
+* @param target - The target object into which the source object properties will be merged. This object is modified in place.
+* @param source - The source object whose properties will be merged into the target object.
+* @returns The updated target object with properties from the source object merged in.
+*
+* @template T - Type of the target object.
+* @template S - Type of the source object.
+*
+* @example
+* const target = { a: 1, b: { x: 1, y: 2 } };
+* const source = { b: { y: 3, z: 4 }, c: 5 };
+*
+* const result = merge(target, source);
+* console.log(result);
+* // Output: { a: 1, b: { x: 1, y: 3, z: 4 }, c: 5 }
+*
+* @example
+* const target = { a: [1, 2], b: { x: 1 } };
+* const source = { a: [3], b: { y: 2 } };
+*
+* const result = merge(target, source);
+* console.log(result);
+* // Output: { a: [3, 2], b: { x: 1, y: 2 } }
+*
+* @example
+* const target = { a: null };
+* const source = { a: [1, 2, 3] };
+*
+* const result = merge(target, source);
+* console.log(result);
+* // Output: { a: [1, 2, 3] }
+*/
 function merge(target, source) {
 	const sourceKeys = Object.keys(source);
 	for (let i = 0; i < sourceKeys.length; i++) {

package/node_modules/es-toolkit/dist/object/omitBy.d.mts

@@ -1,5 +1,3 @@
-import { ObjectKeys } from "../types/ObjectKeys.mjs";
-
 //#region src/object/omitBy.d.ts
 /**
  * Creates a new object composed of the properties that do not satisfy the predicate function.
@@ -11,7 +9,7 @@ import { ObjectKeys } from "../types/ObjectKeys.mjs";
  * @param obj - The object to omit properties from.
  * @param shouldOmit - A predicate function that determines
  * whether a property should be omitted. It takes the property's key and value as arguments and returns `true`
- * if the property should be omitted, and `false` otherwise. Numeric keys are passed as strings.
+ * if the property should be omitted, and `false` otherwise.
  * @returns A new object with the properties that do not satisfy the predicate function.
  *
  * @example
@@ -20,6 +18,6 @@ import { ObjectKeys } from "../types/ObjectKeys.mjs";
  * const result = omitBy(obj, shouldOmit);
  * // result will be { a: 1, c: 3 }
  */
-declare function omitBy<T extends Record<string, any>>(obj: T, shouldOmit: (value: T[keyof T], key: ObjectKeys<T>) => boolean): Partial<T>;
+declare function omitBy<T extends Record<string, any>>(obj: T, shouldOmit: (value: T[keyof T], key: keyof T) => boolean): Partial<T>;
 //#endregion
 export { omitBy };

package/node_modules/es-toolkit/dist/object/omitBy.d.ts

@@ -1,5 +1,3 @@
-import { ObjectKeys } from "../types/ObjectKeys.js";
-
 //#region src/object/omitBy.d.ts
 /**
  * Creates a new object composed of the properties that do not satisfy the predicate function.
@@ -11,7 +9,7 @@ import { ObjectKeys } from "../types/ObjectKeys.js";
  * @param obj - The object to omit properties from.
  * @param shouldOmit - A predicate function that determines
  * whether a property should be omitted. It takes the property's key and value as arguments and returns `true`
- * if the property should be omitted, and `false` otherwise. Numeric keys are passed as strings.
+ * if the property should be omitted, and `false` otherwise.
  * @returns A new object with the properties that do not satisfy the predicate function.
  *
  * @example
@@ -20,6 +18,6 @@ import { ObjectKeys } from "../types/ObjectKeys.js";
  * const result = omitBy(obj, shouldOmit);
  * // result will be { a: 1, c: 3 }
  */
-declare function omitBy<T extends Record<string, any>>(obj: T, shouldOmit: (value: T[keyof T], key: ObjectKeys<T>) => boolean): Partial<T>;
+declare function omitBy<T extends Record<string, any>>(obj: T, shouldOmit: (value: T[keyof T], key: keyof T) => boolean): Partial<T>;
 //#endregion
 export { omitBy };

package/node_modules/es-toolkit/dist/object/omitBy.js

@@ -9,7 +9,7 @@
 * @param obj - The object to omit properties from.
 * @param shouldOmit - A predicate function that determines
 * whether a property should be omitted. It takes the property's key and value as arguments and returns `true`
-* if the property should be omitted, and `false` otherwise. Numeric keys are passed as strings.
+* if the property should be omitted, and `false` otherwise.
 * @returns A new object with the properties that do not satisfy the predicate function.
 *
 * @example
@@ -23,9 +23,8 @@ function omitBy(obj, shouldOmit) {
 	const keys = Object.keys(obj);
 	for (let i = 0; i < keys.length; i++) {
 		const key = keys[i];
-		const objectKey = key;
-		const value = obj[objectKey];
-		if (!shouldOmit(value, key)) result[objectKey] = value;
+		const value = obj[key];
+		if (!shouldOmit(value, key)) result[key] = value;
 	}
 	return result;
 }

package/node_modules/es-toolkit/dist/object/omitBy.mjs

@@ -9,7 +9,7 @@
 * @param obj - The object to omit properties from.
 * @param shouldOmit - A predicate function that determines
 * whether a property should be omitted. It takes the property's key and value as arguments and returns `true`
-* if the property should be omitted, and `false` otherwise. Numeric keys are passed as strings.
+* if the property should be omitted, and `false` otherwise.
 * @returns A new object with the properties that do not satisfy the predicate function.
 *
 * @example
@@ -23,9 +23,8 @@ function omitBy(obj, shouldOmit) {
 	const keys = Object.keys(obj);
 	for (let i = 0; i < keys.length; i++) {
 		const key = keys[i];
-		const objectKey = key;
-		const value = obj[objectKey];
-		if (!shouldOmit(value, key)) result[objectKey] = value;
+		const value = obj[key];
+		if (!shouldOmit(value, key)) result[key] = value;
 	}
 	return result;
 }

package/node_modules/es-toolkit/dist/object/pickBy.d.mts

@@ -1,5 +1,3 @@
-import { ObjectKeys } from "../types/ObjectKeys.mjs";
-
 //#region src/object/pickBy.d.ts
 /**
  * Creates a new object composed of the properties that satisfy the predicate function.
@@ -11,7 +9,7 @@ import { ObjectKeys } from "../types/ObjectKeys.mjs";
  * @param obj - The object to pick properties from.
  * @param shouldPick - A predicate function that determines
  * whether a property should be picked. It takes the property's key and value as arguments and returns `true`
- * if the property should be picked, and `false` otherwise. Numeric keys are passed as strings.
+ * if the property should be picked, and `false` otherwise.
  * @returns A new object with the properties that satisfy the predicate function.
  *
  * @example
@@ -20,6 +18,6 @@ import { ObjectKeys } from "../types/ObjectKeys.mjs";
  * const result = pickBy(obj, shouldPick);
  * // result will be { b: 'pick' }
  */
-declare function pickBy<T extends Record<string, any>>(obj: T, shouldPick: (value: T[keyof T], key: ObjectKeys<T>) => boolean): Partial<T>;
+declare function pickBy<T extends Record<string, any>>(obj: T, shouldPick: (value: T[keyof T], key: keyof T) => boolean): Partial<T>;
 //#endregion
 export { pickBy };

package/node_modules/es-toolkit/dist/object/pickBy.d.ts

@@ -1,5 +1,3 @@
-import { ObjectKeys } from "../types/ObjectKeys.js";
-
 //#region src/object/pickBy.d.ts
 /**
  * Creates a new object composed of the properties that satisfy the predicate function.
@@ -11,7 +9,7 @@ import { ObjectKeys } from "../types/ObjectKeys.js";
  * @param obj - The object to pick properties from.
  * @param shouldPick - A predicate function that determines
  * whether a property should be picked. It takes the property's key and value as arguments and returns `true`
- * if the property should be picked, and `false` otherwise. Numeric keys are passed as strings.
+ * if the property should be picked, and `false` otherwise.
  * @returns A new object with the properties that satisfy the predicate function.
  *
  * @example
@@ -20,6 +18,6 @@ import { ObjectKeys } from "../types/ObjectKeys.js";
  * const result = pickBy(obj, shouldPick);
  * // result will be { b: 'pick' }
  */
-declare function pickBy<T extends Record<string, any>>(obj: T, shouldPick: (value: T[keyof T], key: ObjectKeys<T>) => boolean): Partial<T>;
+declare function pickBy<T extends Record<string, any>>(obj: T, shouldPick: (value: T[keyof T], key: keyof T) => boolean): Partial<T>;
 //#endregion
 export { pickBy };

package/node_modules/es-toolkit/dist/object/pickBy.js

@@ -9,7 +9,7 @@
 * @param obj - The object to pick properties from.
 * @param shouldPick - A predicate function that determines
 * whether a property should be picked. It takes the property's key and value as arguments and returns `true`
-* if the property should be picked, and `false` otherwise. Numeric keys are passed as strings.
+* if the property should be picked, and `false` otherwise.
 * @returns A new object with the properties that satisfy the predicate function.
 *
 * @example
@@ -23,9 +23,8 @@ function pickBy(obj, shouldPick) {
 	const keys = Object.keys(obj);
 	for (let i = 0; i < keys.length; i++) {
 		const key = keys[i];
-		const objectKey = key;
-		const value = obj[objectKey];
-		if (shouldPick(value, key)) result[objectKey] = value;
+		const value = obj[key];
+		if (shouldPick(value, key)) result[key] = value;
 	}
 	return result;
 }

package/node_modules/es-toolkit/dist/object/pickBy.mjs

@@ -9,7 +9,7 @@
 * @param obj - The object to pick properties from.
 * @param shouldPick - A predicate function that determines
 * whether a property should be picked. It takes the property's key and value as arguments and returns `true`
-* if the property should be picked, and `false` otherwise. Numeric keys are passed as strings.
+* if the property should be picked, and `false` otherwise.
 * @returns A new object with the properties that satisfy the predicate function.
 *
 * @example
@@ -23,9 +23,8 @@ function pickBy(obj, shouldPick) {
 	const keys = Object.keys(obj);
 	for (let i = 0; i < keys.length; i++) {
 		const key = keys[i];
-		const objectKey = key;
-		const value = obj[objectKey];
-		if (shouldPick(value, key)) result[objectKey] = value;
+		const value = obj[key];
+		if (shouldPick(value, key)) result[key] = value;
 	}
 	return result;
 }

package/node_modules/es-toolkit/dist/types/index.d.mts

@@ -1,6 +1,3 @@
-import { Simplify } from "./Simplify.mjs";
-import { Merge } from "./Merge.mjs";
-import { ObjectKeys } from "./ObjectKeys.mjs";
 import { ToCamelCaseKeys } from "./ToCamelCaseKeys.mjs";
 import { ToConstantCaseKeys } from "./ToConstantCaseKeys.mjs";
 import { ToKebabCaseKeys } from "./ToKebabCaseKeys.mjs";
@@ -8,14 +5,8 @@ import { ToPascalCaseKeys } from "./ToPascalCaseKeys.mjs";
 import { ToSnakeCaseKeys } from "./ToSnakeCaseKeys.mjs";
 import { DeepPartial } from "./DeepPartial.mjs";
 import { DeepReadonly } from "./DeepReadonly.mjs";
-import { EmptyObject } from "./EmptyObject.mjs";
-import { IsEqual } from "./IsEqual.mjs";
-import { JSONValue } from "./JSONValue.mjs";
 import { NonEmptyArray } from "./NonEmptyArray.mjs";
-import { Primitive } from "./Primitive.mjs";
-import { SetOptional } from "./SetOptional.mjs";
-import { SetRequired } from "./SetRequired.mjs";
-import { UnknownRecord } from "./UnknownRecord.mjs";
+import { Simplify } from "./Simplify.mjs";
 import { ValueOf } from "./ValueOf.mjs";
 import { Writable } from "./Writable.mjs";
-export { type DeepPartial, type DeepReadonly, type EmptyObject, type IsEqual, type JSONValue, type Merge, type NonEmptyArray, type ObjectKeys, type Primitive, type SetOptional, type SetRequired, type Simplify, type ToCamelCaseKeys, type ToConstantCaseKeys, type ToKebabCaseKeys, type ToPascalCaseKeys, type ToSnakeCaseKeys, type UnknownRecord, type ValueOf, type Writable };
+export { type DeepPartial, type DeepReadonly, type NonEmptyArray, type Simplify, type ToCamelCaseKeys, type ToConstantCaseKeys, type ToKebabCaseKeys, type ToPascalCaseKeys, type ToSnakeCaseKeys, type ValueOf, type Writable };

package/node_modules/es-toolkit/dist/types/index.d.ts

@@ -1,6 +1,3 @@
-import { Simplify } from "./Simplify.js";
-import { Merge } from "./Merge.js";
-import { ObjectKeys } from "./ObjectKeys.js";
 import { ToCamelCaseKeys } from "./ToCamelCaseKeys.js";
 import { ToConstantCaseKeys } from "./ToConstantCaseKeys.js";
 import { ToKebabCaseKeys } from "./ToKebabCaseKeys.js";
@@ -8,14 +5,8 @@ import { ToPascalCaseKeys } from "./ToPascalCaseKeys.js";
 import { ToSnakeCaseKeys } from "./ToSnakeCaseKeys.js";
 import { DeepPartial } from "./DeepPartial.js";
 import { DeepReadonly } from "./DeepReadonly.js";
-import { EmptyObject } from "./EmptyObject.js";
-import { IsEqual } from "./IsEqual.js";
-import { JSONValue } from "./JSONValue.js";
 import { NonEmptyArray } from "./NonEmptyArray.js";
-import { Primitive } from "./Primitive.js";
-import { SetOptional } from "./SetOptional.js";
-import { SetRequired } from "./SetRequired.js";
-import { UnknownRecord } from "./UnknownRecord.js";
+import { Simplify } from "./Simplify.js";
 import { ValueOf } from "./ValueOf.js";
 import { Writable } from "./Writable.js";
-export { type DeepPartial, type DeepReadonly, type EmptyObject, type IsEqual, type JSONValue, type Merge, type NonEmptyArray, type ObjectKeys, type Primitive, type SetOptional, type SetRequired, type Simplify, type ToCamelCaseKeys, type ToConstantCaseKeys, type ToKebabCaseKeys, type ToPascalCaseKeys, type ToSnakeCaseKeys, type UnknownRecord, type ValueOf, type Writable };
+export { type DeepPartial, type DeepReadonly, type NonEmptyArray, type Simplify, type ToCamelCaseKeys, type ToConstantCaseKeys, type ToKebabCaseKeys, type ToPascalCaseKeys, type ToSnakeCaseKeys, type ValueOf, type Writable };

package/node_modules/es-toolkit/dist/util/attempt.d.mts

@@ -38,6 +38,6 @@
  * });
  * ```
  */
-declare function attempt<T, E = unknown>(func: () => T): [null, T] | [E, null];
+declare function attempt<T, E>(func: () => T): [null, T] | [E, null];
 //#endregion
 export { attempt };

package/node_modules/es-toolkit/dist/util/attempt.d.ts

@@ -38,6 +38,6 @@
  * });
  * ```
  */
-declare function attempt<T, E = unknown>(func: () => T): [null, T] | [E, null];
+declare function attempt<T, E>(func: () => T): [null, T] | [E, null];
 //#endregion
 export { attempt };

package/node_modules/es-toolkit/dist/util/attemptAsync.d.mts

@@ -31,6 +31,6 @@
  * });
  * // users is typed as User[]
  */
-declare function attemptAsync<T, E = unknown>(func: () => Promise<T>): Promise<[null, T] | [E, null]>;
+declare function attemptAsync<T, E>(func: () => Promise<T>): Promise<[null, T] | [E, null]>;
 //#endregion
 export { attemptAsync };

package/node_modules/es-toolkit/dist/util/attemptAsync.d.ts

@@ -31,6 +31,6 @@
  * });
  * // users is typed as User[]
  */
-declare function attemptAsync<T, E = unknown>(func: () => Promise<T>): Promise<[null, T] | [E, null]>;
+declare function attemptAsync<T, E>(func: () => Promise<T>): Promise<[null, T] | [E, null]>;
 //#endregion
 export { attemptAsync };

package/node_modules/es-toolkit/dist/util/index.d.mts

@@ -1,6 +1,4 @@
 import { attempt } from "./attempt.mjs";
 import { attemptAsync } from "./attemptAsync.mjs";
-import { defer } from "./defer.mjs";
-import { deferAsync } from "./deferAsync.mjs";
 import { invariant } from "./invariant.mjs";
-export { invariant as assert, attempt, attemptAsync, defer, deferAsync, invariant };
+export { invariant as assert, attempt, attemptAsync, invariant };

package/node_modules/es-toolkit/dist/util/index.d.ts

@@ -1,6 +1,4 @@
 import { attempt } from "./attempt.js";
 import { attemptAsync } from "./attemptAsync.js";
-import { defer } from "./defer.js";
-import { deferAsync } from "./deferAsync.js";
 import { invariant } from "./invariant.js";
-export { invariant as assert, attempt, attemptAsync, defer, deferAsync, invariant };
+export { invariant as assert, attempt, attemptAsync, invariant };

package/node_modules/es-toolkit/dist/util/index.js

@@ -1,12 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_attempt = require("./attempt.js");
 const require_attemptAsync = require("./attemptAsync.js");
-const require_defer = require("./defer.js");
-const require_deferAsync = require("./deferAsync.js");
 const require_invariant = require("./invariant.js");
 exports.assert = require_invariant.invariant;
 exports.attempt = require_attempt.attempt;
 exports.attemptAsync = require_attemptAsync.attemptAsync;
-exports.defer = require_defer.defer;
-exports.deferAsync = require_deferAsync.deferAsync;
 exports.invariant = require_invariant.invariant;

package/node_modules/es-toolkit/dist/util/index.mjs

@@ -1,6 +1,4 @@
 import { attempt } from "./attempt.mjs";
 import { attemptAsync } from "./attemptAsync.mjs";
-import { defer } from "./defer.mjs";
-import { deferAsync } from "./deferAsync.mjs";
 import { invariant } from "./invariant.mjs";
-export { invariant as assert, attempt, attemptAsync, defer, deferAsync, invariant };
+export { invariant as assert, attempt, attemptAsync, invariant };

package/node_modules/es-toolkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "es-toolkit",
-  "version": "1.52.0",
+  "version": "1.51.0",
   "description": "A state-of-the-art, high-performance JavaScript utility library with a small bundle size and strong type annotations.",
   "homepage": "https://es-toolkit.dev",
   "bugs": "https://github.com/toss/es-toolkit/issues",
@@ -94,16 +94,6 @@
         "default": "./dist/fp/index.js"
       }
     },
-    "./fp/iterator": {
-      "import": {
-        "types": "./dist/fp/iterator/index.d.mts",
-        "default": "./dist/fp/iterator/index.mjs"
-      },
-      "require": {
-        "types": "./dist/fp/iterator/index.d.ts",
-        "default": "./dist/fp/iterator/index.js"
-      }
-    },
     "./function": {
       "import": {
         "types": "./dist/function/index.d.mts",
@@ -114,16 +104,6 @@
         "default": "./dist/function/index.js"
       }
     },
-    "./iterator": {
-      "import": {
-        "types": "./dist/iterator/index.d.mts",
-        "default": "./dist/iterator/index.mjs"
-      },
-      "require": {
-        "types": "./dist/iterator/index.d.ts",
-        "default": "./dist/iterator/index.js"
-      }
-    },
     "./map": {
       "import": {
         "types": "./dist/map/index.d.mts",
@@ -224,10 +204,7 @@
     "compat.js",
     "error.js",
     "fp.js",
-    "fp/iterator.js",
-    "fp/iterator.d.ts",
     "function.js",
-    "iterator.js",
     "map.js",
     "math.js",
     "object.js",
@@ -381,16 +358,6 @@
           "default": "./dist/fp/index.js"
         }
       },
-      "./fp/iterator": {
-        "import": {
-          "types": "./dist/fp/iterator/index.d.mts",
-          "default": "./dist/fp/iterator/index.mjs"
-        },
-        "require": {
-          "types": "./dist/fp/iterator/index.d.ts",
-          "default": "./dist/fp/iterator/index.js"
-        }
-      },
       "./function": {
         "import": {
           "types": "./dist/function/index.d.mts",
@@ -401,16 +368,6 @@
           "default": "./dist/function/index.js"
         }
       },
-      "./iterator": {
-        "import": {
-          "types": "./dist/iterator/index.d.mts",
-          "default": "./dist/iterator/index.mjs"
-        },
-        "require": {
-          "types": "./dist/iterator/index.d.ts",
-          "default": "./dist/iterator/index.js"
-        }
-      },
       "./map": {
         "import": {
           "types": "./dist/map/index.d.mts",

package/node_modules/node-abi/abi_registry.json

@@ -449,12 +449,5 @@
     "lts": false,
     "runtime": "electron",
     "target": "44.0.0-alpha.1"
-  },
-  {
-    "abi": "150",
-    "future": true,
-    "lts": false,
-    "runtime": "electron",
-    "target": "45.0.0-alpha.1"
   }
 ]

package/node_modules/node-abi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-abi",
-  "version": "3.96.0",
+  "version": "3.95.0",
   "description": "Get the Node ABI for a given target and runtime, and vice versa.",
   "main": "index.js",
   "scripts": {

package/node_modules/qs/.github/THREAT_MODEL.md

@@ -25,7 +25,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 
 **Trust Boundaries:**
 - **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
-- **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
+- **Input object (stringify):** May contain cycles, which can lead to infinite loops during stringification
 - **Options:** Provided by the caller
 - **Cycle Tracking:** Used only during stringification to detect and handle circular references
 
@@ -58,7 +58,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 |---------------------------------------------------|---------------------|
 | Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
 | Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For a hard cap that rejects oversized untrusted input, opt in to `throwOnLimitExceeded: true` (default `false`), and always bound input size at the transport layer[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
+| Denial of Service (memory/CPU exhaustion)         | Enforce `arrayLimit` and `parameterLimit` with safe defaults; enable `throwOnLimitExceeded`; limit nesting depth[7]. |
 | Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
 
 ### 7. Risk Ranking
@@ -70,7 +70,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 ### 8. Next Steps & Review
 
 1. **Audit option validation logic.**
-2. **Depth limiting:** `parse` enforces a `depth` bound by default (with `strictDepth` to throw); `stringify` offers an opt-in `depth` bound (default `Infinity`, since its input is caller-produced) for defense-in-depth.
+2. **Add depth limiting to nested parsing and stringification.**
 3. **Implement fuzz testing for parser and stringifier edge cases.**
 4. **Regularly review dependencies for vulnerabilities.**
 5. **Keep documentation and threat model up to date.**

package/node_modules/qs/CHANGELOG.md

@@ -1,18 +1,3 @@
-## **6.16.0**
- - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
- - [Fix] stringify: serialize Date values when a filter is provided
- - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
- - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
- - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
- - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
- - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
- - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
- - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
- - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
- - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
- - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
- - [Dev Deps] update `eslint`, `evalmd`
-
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
 - [Fix] `utils`: respect encoding of surrogate pairs across chunks (#559)

package/node_modules/qs/README.md

@@ -147,8 +147,6 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
 
-Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. To bound the total element count from untrusted input, set `throwOnLimitExceeded: true` (see `arrayLimit` below), and always bound the input size at the transport layer (e.g. an HTTP body-size limit).
-
 To bypass the leading question mark, use `ignoreQueryPrefix`:
 
 ```javascript
@@ -315,9 +313,7 @@ try {
 }
 ```
 
-When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
-
-Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object — it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized input from untrusted sources, set `throwOnLimitExceeded: true`.
+When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key
 
 To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
 Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
@@ -414,20 +410,6 @@ var encoded = qs.stringify({ a: { b: 'c' } }, { encoder: function (str) {
 
 _(Note: the `encoder` option does not apply if `encode` is `false`)_
 
-By default, `qs.stringify` serializes an object of any nesting depth.
-For backwards compatibility, and because its input is the caller's own object rather than a query string parsed by **qs**, this is unbounded.
-If you serialize objects whose nesting can be influenced by untrusted input, bound it with the numeric `depth` option (default `Infinity`);
-exceeding it throws a catchable `RangeError` instead of eventually overflowing the call stack:
-
-```javascript
-try {
-    qs.stringify({ a: { b: { c: { d: 'e' } } } }, { depth: 2 });
-} catch (err) {
-    assert(err instanceof RangeError);
-    assert.strictEqual(err.message, 'Input depth exceeded depth option of 2');
-}
-```
-
 Analogue to the `encoder` there is a `decoder` option for `parse` to override decoding of properties and values:
 
 ```javascript