@sap/cds-dk 10.1.2 → 10.2.1

package/node_modules/on-finished/package.json

@@ -1,38 +1,42 @@
 {
   "name": "on-finished",
   "description": "Execute a callback when a request closes, finishes, or errors",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
   ],
   "license": "MIT",
   "repository": "jshttp/on-finished",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
+  "type": "commonjs",
   "dependencies": {
     "ee-first": "1.1.1"
   },
   "devDependencies": {
-    "eslint": "7.32.0",
+    "eslint": "8.17.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.25.4",
+    "eslint-plugin-import": "2.26.0",
     "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "5.2.0",
+    "eslint-plugin-promise": "6.0.0",
     "eslint-plugin-standard": "4.1.0",
-    "mocha": "9.2.1",
+    "mocha": "12.0.3",
     "nyc": "15.1.0"
   },
   "engines": {
     "node": ">= 0.8"
   },
   "files": [
-    "HISTORY.md",
     "LICENSE",
     "index.js"
   ],
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test": "mocha --reporter spec --check-leaks test/",
     "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
     "test-cov": "nyc --reporter=html --reporter=text npm test"
   }

package/node_modules/qs/.editorconfig

@@ -39,7 +39,7 @@ indent_style = off
 indent = off
 max_line_length = off
 
-[.nycrc]
+[{.nycrc,*.mjs}]
 indent_style = tab
 
 [tea.yaml]

package/node_modules/qs/.github/THREAT_MODEL.md

@@ -24,7 +24,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 ```
 
 **Trust Boundaries:**
-- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
+- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests). `qs` defines its own key grammar, where bracket groups denote nesting, so the parameter names it derives are deliberately not the flat names produced by `URLSearchParams`, `node:querystring`, or a WHATWG-conformant parser. The parsed object, not the raw string, is the only thing a caller should make trust decisions about; see "Interpretation conflict" below.
 - **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
 - **Options:** Provided by the caller
 - **Cycle Tracking:** Used only during stringification to detect and handle circular references
@@ -51,6 +51,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 - **Information Disclosure:** Error messages may expose internal details or sensitive data.
 - **Denial of Service:** Large or malformed input can exhaust memory or CPU.
 - **Elevation of Privilege:** Prototype pollution can lead to unintended privilege escalation in the host application[3][4][8].
+- **Interpretation conflict (out of scope):** An application that parses the same query string with two different parsers, and makes a trust decision on one result while consuming the other, can be attacked by any input the two parsers read differently. `qs`'s bracket grammar guarantees such inputs exist, so this is a property of the deployment, not a defect `qs` can remove. It is the calling application's responsibility to parse once and validate the parsed object.
 
 ### 6. Mitigation/Countermeasures
 
@@ -58,8 +59,9 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 |---------------------------------------------------|---------------------|
 | Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
 | Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For a hard cap that rejects oversized untrusted input, opt in to `throwOnLimitExceeded: true` (default `false`), and always bound input size at the transport layer[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
+| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For hard caps on the number of parameters and on each array's length, opt in to `throwOnLimitExceeded: true` (default `false`), which rejects a query string with more than `parameterLimit` parameters, or one that would produce any array longer than `arrayLimit`. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values can still reach `parameterLimit` times `arrayLimit`; always bound input size at the transport layer as well[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
 | Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
+| Interpretation conflict (validate-then-use across two parsers) | None available inside `qs`, by construction: `qs` and a flat parser disagree about parameter names for well-formed input, so no hardening can make the two views equal. Parse untrusted input once, with `qs`, and apply deny lists, authorization, and signature checks to the parsed object rather than to raw key text. Text that `qs` cannot place in its grammar is currently dropped, so distinct raw names can share one parsed path ([#619](https://github.com/ljharb/qs/issues/619)). |
 
 ### 7. Risk Ranking
 

package/node_modules/qs/CHANGELOG.md

@@ -1,17 +1,85 @@
+## **6.17.1**
+- [Fix] `parse`: `interpretNumericEntities`: decode code points above U+FFFF as surrogate pairs (#640)
+- [Fix] `parse`: respect `plainObjects` for `[]` with `parseArrays: false` (#639)
+- [Fix] `utils`: `merge`: count the elements of a sparse array against `arrayLimit`, not its holes
+- [Fix] `parse`: guard bracket-wrapped prototype keys at depth 0 (#638)
+- [Refactor] `parse`: extract wrapping-bracket stripping helper
+- [readme] document that `depth: 0` and `depth: false` keep keys flat
+- [Tests] `parse`: pin depth-0 bracket stripping and prototype keys kept by `allowPrototypes`/`plainObjects`
+
+## **6.17.0**
+- [New] `stringify`: add `WHATWG` format (#623)
+- [Fix] `stringify`: do not sort the caller's `filter` array in place (#637)
+- [Fix] `parse`: copy an own `__proto__` key as data (#636)
+- [Fix] `parse`: decode percent-encoded dots case-insensitively (#635)
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [Fix] `parse`: preserve comma arrays when interpreting numeric entities (#630)
+- [Fix] `parse`: allow scalar fields with a zero array limit (#627)
+- [Fix] `parse`: do not count an existing comma array toward `arrayLimit` when `duplicates` discards or replaces it
+- [Fix] `utils`: `encode`: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
+- [eslint] fix indentation
+- [readme] document the encoder's `format` argument
+- [meta] add changelog acknowledgement
+- [meta] fix changelog indents
+- [Dev Deps] update `eslint`, `evalmd`, `npmignore`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+- [Tests] `stringify`: pin `sort` order for nested keys selected by an array `filter`
+- [Tests] `parse`: cover `interpretNumericEntities` across value shapes, keys, and the charset sentinel
+- [Tests] `parse`: cover more input that builds no array at a zero or negative `arrayLimit`
+- [Tests] `parse`: cover `comma` with a zero or negative `arrayLimit`, and combining a full comma array
+- [Tests] `parse`: pin the behavior of a zero or negative `arrayLimit`
+- [Tests] `utils`/`stringify`: pin `~`, `*`, and parens encoding in RFC3986 and RFC1738
+
+## **6.16.2**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Dev Deps] update `evalmd`, `npmignore`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
+## **6.16.1**
+- [Fix] `parse`: do not mutate an object input
+- [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
+- [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
+- [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
+- [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
+- [Fix] `stringify`: ignore inherited array format names (#622)
+- [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
+- [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
+- [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
+- [Fix] `parse`: only treat `[]` as array syntax when it ends the key
+- [Perf] `decode`: skip decoders when there is no percent sign (#583)
+- [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
+- [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts (credit @Yeaseen)
+- [Docs] document that `qs` and flat parsers disagree about parameter names
+- [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
+- [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
+- [meta] fix changelog indents
+- [actions] set least-privilege `cache-mode`
+- [Tests] `utils`: `decode`: add missing cases
+- [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
+- [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
+
 ## **6.16.0**
- - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
- - [Fix] stringify: serialize Date values when a filter is provided
- - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
- - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
- - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
- - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
- - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
- - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
- - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
- - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
- - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
- - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
- - [Dev Deps] update `eslint`, `evalmd`
+- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
+- [Fix] stringify: serialize Date values when a filter is provided
+- [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
+- [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
+- [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
+- [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
+- [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
+- [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
+- [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
+- [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
+- [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint`
+- [Dev Deps] update `eslint`, `evalmd`
+
+## **6.15.4**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Dev Deps] update `@ljharb/eslint-config`, `evalmd`, `npmignore`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
 
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
@@ -29,7 +97,7 @@
 - [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
 - [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
 - [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
-- [Fix] `parse`: handle nested bracket groups and add regression tests (#530)
+- [Fix] `parse`: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
 - [readme] fix grammar (#550)
 - [Dev Deps] update `@ljharb/eslint-config`
 - [Tests] add regression tests for keys containing percent-encoded bracket text
@@ -44,6 +112,13 @@
 - [New] `parse`: add `strictMerge` option to wrap object/primitive conflicts in an array (#425, #122)
 - [Fix] `duplicates` option should not apply to bracket notation keys (#514)
 
+## **6.14.3**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `mock-property`, `npmignore`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.14.2**
 - [Fix] `parse`: mark overflow objects for indexed notation exceeding `arrayLimit` (#546)
 - [Fix] `arrayLimit` means max count, not max index, in `combine`/`merge`/`parseArrayValue`
@@ -76,6 +151,13 @@
 - [Dev Deps] update `es-value-fixtures`, `has-bigints`, `has-proto`, `has-symbols`
 - [Tests] increase coverage
 
+## **6.13.4**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `for-each`, `has-symbols`, `mock-property`, `npmignore`, `object-inspect`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.13.3**
 [Fix] fix regressions from robustness refactor
 [actions] update reusable workflows
@@ -103,6 +185,13 @@
 - [New] `parse`: add `strictDepth` option (#511)
 - [Tests] use `npm audit` instead of `aud`
 
+## **6.12.6**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use `npm audit` instead of `aud`
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `for-each`, `has-symbols`, `mock-property`, `npmignore`, `object-inspect`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.12.5**
 - [Fix] fix regressions from robustness refactor
 - [actions] update reusable workflows

package/node_modules/qs/README.md

@@ -85,6 +85,25 @@ assert.deepEqual(qs.parse('foo[bar][baz]=foobarbaz'), {
 });
 ```
 
+Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently.
+Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1;
+see [#558](https://github.com/ljharb/qs/issues/558).
+
+Because of that bracket grammar,
+**qs** does not agree with `URLSearchParams`,
+`node:querystring`, or any other flat parser about what the "name" of a parameter is,
+and it never has.
+`URLSearchParams` reads `'foo[bar]=baz'` as one flat name `foo[bar]`;
+**qs** reads it as the path `foo.bar`.
+Text that **qs**'s grammar cannot place,
+such as the `extra` in `'foo[bar]extra=baz'`,
+is currently dropped, so several distinct flat names can resolve to the same **qs** path
+(see [#619](https://github.com/ljharb/qs/issues/619)).
+
+So validating, authorizing, filtering,
+or signing a query string with one parser and then consuming it with another is unsafe: a deny list or signature computed over `URLSearchParams` names does not constrain what **qs** will produce from the same string.
+Parse the input once, with **qs**, and apply your checks to the resulting object.
+
 By default, when nesting objects **qs** will only parse up to 5 children deep.
 This means if you attempt to parse a string like `'a[b][c][d][e][f][g][h][i]=j'` your resulting object will be:
 
@@ -115,6 +134,15 @@ var deep = qs.parse('a[b][c][d][e][f][g][h][i]=j', { depth: 1 });
 assert.deepEqual(deep, { a: { b: { '[c][d][e][f][g][h][i]': 'j' } } });
 ```
 
+Setting `depth` to `0` or `false` turns off nesting,
+so keys are never split into nested objects or arrays,
+whether or not their brackets are percent-encoded:
+
+```javascript
+assert.deepEqual(qs.parse('a[b][c]=d', { depth: 0 }), { 'a[b][c]': 'd' });
+assert.deepEqual(qs.parse('a%5Bb%5D=c', { depth: false }), { 'a[b]': 'c' });
+```
+
 You can configure **qs** to throw an error when parsing nested input beyond this depth using the `strictDepth` option (defaulted to false):
 
 ```javascript
@@ -126,16 +154,22 @@ try {
 }
 ```
 
-The depth limit helps mitigate abuse when **qs** is used to parse user input, and it is recommended to keep it a reasonably small number. The strictDepth option adds a layer of protection by throwing an error when the limit is exceeded, allowing you to catch and handle such cases.
+The depth limit helps mitigate abuse when **qs** is used to parse user input,
+and it is recommended to keep it a reasonably small number.
+The strictDepth option adds a layer of protection by throwing an error when the limit is exceeded,
+allowing you to catch and handle such cases.
 
-For similar reasons, by default **qs** will only parse up to 1000 parameters. This can be overridden by passing a `parameterLimit` option:
+For similar reasons, by default **qs** will only parse up to 1000 parameters.
+This can be overridden by passing a `parameterLimit` option:
 
 ```javascript
 var limited = qs.parse('a=b&c=d', { parameterLimit: 1 });
 assert.deepEqual(limited, { a: 'b' });
 ```
 
-If you want an error to be thrown whenever the a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`),
+set the `throwOnLimitExceeded` option to `true`.
+This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a=1&b=2&c=3&d=4', { parameterLimit: 3, throwOnLimitExceeded: true });
@@ -147,7 +181,10 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
 
-Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. To bound the total element count from untrusted input, set `throwOnLimitExceeded: true` (see `arrayLimit` below), and always bound the input size at the transport layer (e.g. an HTTP body-size limit).
+Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into.
+In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain.
+Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting.
+`arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
 
 To bypass the leading question mark, use `ignoreQueryPrefix`:
 
@@ -293,6 +330,8 @@ assert.deepEqual(withIndexedEmptyString, { a: ['b', '', 'c'] });
 Any array members with an index of `20` or greater will instead be converted to an object with the index as the key.
 This is needed to handle cases when someone sent, for example, `a[999999999]` and it will take significant time to iterate over this huge array.
 
+Since v6.14.1 and v6.15.2, the arrayLimit now applies to arrays specified using both the `[]` and `[0]` syntaxes.
+
 ```javascript
 var withMaxIndex = qs.parse('a[100]=b');
 assert.deepEqual(withMaxIndex, { a: { '100': 'b' } });
@@ -305,7 +344,8 @@ var withArrayLimit = qs.parse('a[1]=b', { arrayLimit: 0 });
 assert.deepEqual(withArrayLimit, { a: { '1': 'b' } });
 ```
 
-If you want to throw an error whenever the array limit is exceeded, set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want to throw an error whenever the array limit is exceeded, set the `throwOnLimitExceeded` option to `true`.
+This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a[1]=b', { arrayLimit: 0, throwOnLimitExceeded: true });
@@ -317,7 +357,11 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
 
-Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object — it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized input from untrusted sources, set `throwOnLimitExceeded: true`.
+Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed.
+With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input).
+This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`.
+If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`.
+`throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
 
 To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
 Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
@@ -361,6 +405,15 @@ assert.deepEqual(arraysOfObjects, { a: ['b', 'c'] })
 ```
 (_this cannot convert nested objects, such as `a={b:1},{c:d}`_)
 
+With `[]` or index notation, the values from each comma-separated group stay together as one element of the array, while repeated plain keys flatten into one array:
+```javascript
+var nestedGroups = qs.parse('a[]=b,c&a[]=d', { comma: true });
+assert.deepEqual(nestedGroups, { a: [['b', 'c'], 'd'] });
+
+var flatGroups = qs.parse('a=b,c&a=d', { comma: true });
+assert.deepEqual(flatGroups, { a: ['b', 'c', 'd'] });
+```
+
 ### Parsing primitive/scalar values (numbers, booleans, null, etc)
 
 By default, all values are parsed as strings.
@@ -380,7 +433,8 @@ If you wish to auto-convert values which look like numbers, booleans, and other
 qs.stringify(object, [options]);
 ```
 
-When stringifying, **qs** by default URI encodes output. Objects are stringified as you would expect:
+When stringifying, **qs** by default URI encodes output.
+Objects are stringified as you would expect:
 
 ```javascript
 assert.equal(qs.stringify({ a: 'b' }), 'a=b');
@@ -449,6 +503,20 @@ var encoded = qs.stringify({ a: { b: 'c' } }, { encoder: function (str, defaultE
 }})
 ```
 
+The encoder also receives the `format` option as a fifth argument.
+An encoder that wraps `defaultEncoder` should pass all of its arguments through,
+since the default encoding depends on `format` (for example, RFC1738 leaves parentheses unencoded):
+
+```javascript
+var wrapped = qs.stringify({ a: 'b(c)' }, {
+    format: 'RFC1738',
+    encoder: function (str, defaultEncoder, charset, type, format) {
+        return defaultEncoder(str, defaultEncoder, charset, type, format);
+    }
+});
+assert.equal(wrapped, 'a=b(c)');
+```
+
 The type argument is also provided to the decoder:
 
 ```javascript
@@ -662,7 +730,8 @@ var equalsInsensitive = qs.parse('a&b=');
 assert.deepEqual(equalsInsensitive, { a: '', b: '' });
 ```
 
-To distinguish between `null` values and empty strings use the `strictNullHandling` flag. In the result string the `null`
+To distinguish between `null` values and empty strings use the `strictNullHandling` flag.
+In the result string the `null`
 values have no `=` sign:
 
 ```javascript
@@ -730,7 +799,8 @@ var obj = qs.parse('a=%82%B1%82%F1%82%C9%82%BF%82%CD%81I', { decoder: decoder })
 assert.deepEqual(obj, { a: 'こんにちは！' });
 ```
 
-### RFC 3986 and RFC 1738 space encoding
+<a name="rfc-3986-and-rfc-1738-space-encoding"></a>
+### Encoding formats: RFC 3986, RFC 1738, and WHATWG
 
 RFC3986 used as default option and encodes ' ' to *%20* which is backward compatible.
 In the same time, output can be stringified as per RFC1738 with ' ' equal to '+'.
@@ -741,6 +811,17 @@ assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC3986' }), 'a=b%20c');
 assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC1738' }), 'a=b+c');
 ```
 
+To percent-encode keys and values the same way as the [WHATWG `application/x-www-form-urlencoded` serializer](https://url.spec.whatwg.org/#concept-urlencoded-serializer) (what `URLSearchParams` and HTML form submission use), use the `WHATWG` format.
+Like RFC1738 it encodes ' ' as '+'; it also leaves `*` unencoded, but percent-encodes `~`, `(`, and `)`.
+It only affects encoding; how `null`, dates, arrays, and objects are serialized is unchanged:
+
+```javascript
+assert.equal(qs.stringify({ a: 'b c~*()' }, { format: 'WHATWG' }), 'a=b+c%7E*%28%29');
+```
+
+_(Note: the `WHATWG` format matches `URLSearchParams` encoding only with the default `utf-8` charset, and only when keys are encoded too, so not with `encodeValuesOnly`.
+With `charset: 'iso-8859-1'`, every format uses the same `escape`-based encoding, which leaves characters like `@` and `/` unencoded; only the space handling differs)_
+
 ## Security
 
 Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report.