@tickernelz/paperclip-pro-server 2026.1014.2 → 2026.1016.0

package/node_modules/qs/CHANGELOG.md

@@ -1,17 +1,41 @@
+## **6.16.1**
+ - [Fix] `parse`: do not mutate an object input
+ - [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
+ - [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
+ - [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
+ - [Fix] `stringify`: ignore inherited array format names (#622)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
+ - [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
+ - [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
+ - [Fix] `parse`: only treat `[]` as array syntax when it ends the key
+ - [Perf] `decode`: skip decoders when there is no percent sign (#583)
+ - [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
+ - [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts
+ - [Docs] document that `qs` and flat parsers disagree about parameter names
+ - [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
+ - [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
+ - [meta] fix changelog indents
+ - [actions] set least-privilege `cache-mode`
+ - [Tests] `utils`: `decode`: add missing cases
+ - [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
+ - [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
+ - [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
+
 ## **6.16.0**
- - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
- - [Fix] stringify: serialize Date values when a filter is provided
- - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
- - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
- - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
- - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
- - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
- - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
- - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
- - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
- - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
- - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
- - [Dev Deps] update `eslint`, `evalmd`
+- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
+- [Fix] stringify: serialize Date values when a filter is provided
+- [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
+- [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
+- [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
+- [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
+- [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
+- [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
+- [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
+- [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
+- [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint`
+- [Dev Deps] update `eslint`, `evalmd`
 
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
@@ -29,7 +53,7 @@
 - [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
 - [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
 - [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
-- [Fix] `parse`: handle nested bracket groups and add regression tests (#530)
+- [Fix] `parse`: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
 - [readme] fix grammar (#550)
 - [Dev Deps] update `@ljharb/eslint-config`
 - [Tests] add regression tests for keys containing percent-encoded bracket text

package/node_modules/qs/README.md

@@ -85,6 +85,23 @@ assert.deepEqual(qs.parse('foo[bar][baz]=foobarbaz'), {
 });
 ```
 
+Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently. Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1; see [#558](https://github.com/ljharb/qs/issues/558).
+
+Because of that bracket grammar,
+**qs** does not agree with `URLSearchParams`,
+`node:querystring`, or any other flat parser about what the "name" of a parameter is,
+and it never has.
+`URLSearchParams` reads `'foo[bar]=baz'` as one flat name `foo[bar]`;
+**qs** reads it as the path `foo.bar`.
+Text that **qs**'s grammar cannot place,
+such as the `extra` in `'foo[bar]extra=baz'`,
+is currently dropped, so several distinct flat names can resolve to the same **qs** path
+(see [#619](https://github.com/ljharb/qs/issues/619)).
+
+So validating, authorizing, filtering,
+or signing a query string with one parser and then consuming it with another is unsafe: a deny list or signature computed over `URLSearchParams` names does not constrain what **qs** will produce from the same string.
+Parse the input once, with **qs**, and apply your checks to the resulting object.
+
 By default, when nesting objects **qs** will only parse up to 5 children deep.
 This means if you attempt to parse a string like `'a[b][c][d][e][f][g][h][i]=j'` your resulting object will be:
 
@@ -135,7 +152,7 @@ var limited = qs.parse('a=b&c=d', { parameterLimit: 1 });
 assert.deepEqual(limited, { a: 'b' });
 ```
 
-If you want an error to be thrown whenever the a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a=1&b=2&c=3&d=4', { parameterLimit: 3, throwOnLimitExceeded: true });
@@ -147,7 +164,7 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
 
-Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. To bound the total element count from untrusted input, set `throwOnLimitExceeded: true` (see `arrayLimit` below), and always bound the input size at the transport layer (e.g. an HTTP body-size limit).
+Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
 
 To bypass the leading question mark, use `ignoreQueryPrefix`:
 
@@ -293,6 +310,8 @@ assert.deepEqual(withIndexedEmptyString, { a: ['b', '', 'c'] });
 Any array members with an index of `20` or greater will instead be converted to an object with the index as the key.
 This is needed to handle cases when someone sent, for example, `a[999999999]` and it will take significant time to iterate over this huge array.
 
+Since v6.14.1 and v6.15.2, the arrayLimit now applies to arrays specified using both the `[]` and `[0]` syntaxes.
+
 ```javascript
 var withMaxIndex = qs.parse('a[100]=b');
 assert.deepEqual(withMaxIndex, { a: { '100': 'b' } });
@@ -317,7 +336,7 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
 
-Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object — it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized input from untrusted sources, set `throwOnLimitExceeded: true`.
+Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`. `throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
 
 To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
 Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
@@ -361,6 +380,15 @@ assert.deepEqual(arraysOfObjects, { a: ['b', 'c'] })
 ```
 (_this cannot convert nested objects, such as `a={b:1},{c:d}`_)
 
+With `[]` or index notation, the values from each comma-separated group stay together as one element of the array, while repeated plain keys flatten into one array:
+```javascript
+var nestedGroups = qs.parse('a[]=b,c&a[]=d', { comma: true });
+assert.deepEqual(nestedGroups, { a: [['b', 'c'], 'd'] });
+
+var flatGroups = qs.parse('a=b,c&a=d', { comma: true });
+assert.deepEqual(flatGroups, { a: ['b', 'c', 'd'] });
+```
+
 ### Parsing primitive/scalar values (numbers, booleans, null, etc)
 
 By default, all values are parsed as strings.

package/node_modules/qs/dist/qs.js

@@ -5,13 +5,13 @@
 "use strict";var stringify=require(4),parse=require(3),formats=require(1);module.exports={formats:formats,parse:parse,stringify:stringify};
 
 },{"1":1,"3":3,"4":4}],3:[function(require,module,exports){
-"use strict";var utils=require(5),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,defaults={allowDots:!1,allowEmptyArrays:!1,allowPrototypes:!1,allowSparse:!1,arrayLimit:20,charset:"utf-8",charsetSentinel:!1,comma:!1,decodeDotInKeys:!1,decoder:utils.decode,delimiter:"&",depth:5,duplicates:"combine",ignoreQueryPrefix:!1,interpretNumericEntities:!1,parameterLimit:1e3,parseArrays:!0,plainObjects:!1,strictDepth:!1,strictMerge:!0,strictNullHandling:!1,throwOnLimitExceeded:!1},interpretNumericEntities=function(e){return e.replace(/&#(\d+);/g,function(e,t){return String.fromCharCode(parseInt(t,10))})},parseArrayValue=function(e,t,r){if(e&&"string"==typeof e&&t.comma&&e.indexOf(",")>-1){if(t.throwOnLimitExceeded)for(var i=0,a=e.indexOf(",");a>-1;){if((i+=1)>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");a=e.indexOf(",",a+1)}return e.split(",")}if(t.throwOnLimitExceeded&&r>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return e},isoSentinel="utf8=%26%2310003%3B",charsetSentinel="utf8=%E2%9C%93",parseValues=function parseQueryStringValues(e,t){var r={__proto__:null},i=t.ignoreQueryPrefix?e.replace(/^\?/,""):e;i=i.replace(/%5B/gi,"[").replace(/%5D/gi,"]");var a=t.parameterLimit===1/0?void 0:t.parameterLimit,o=i.split(t.delimiter,t.throwOnLimitExceeded&&void 0!==a?a+1:a);if(t.throwOnLimitExceeded&&void 0!==a&&o.length>a)throw new RangeError("Parameter limit exceeded. Only "+a+" parameter"+(1===a?"":"s")+" allowed.");var l,n=-1,s=t.charset;if(t.charsetSentinel)for(l=0;l<o.length;++l)0===o[l].indexOf("utf8=")&&(o[l]===charsetSentinel?s="utf-8":o[l]===isoSentinel&&(s="iso-8859-1"),n=l,l=o.length);for(l=0;l<o.length;++l)if(l!==n){var d,c,p=o[l],u=p.indexOf("]="),y=-1===u?p.indexOf("="):u+1;if(-1===y?(d=t.decoder(p,defaults.decoder,s,"key"),c=t.strictNullHandling?null:""):null!==(d=t.decoder(p.slice(0,y),defaults.decoder,s,"key"))&&(c=utils.maybeMap(parseArrayValue(p.slice(y+1),t,isArray(r[d])?r[d].length:0),function(e){return t.decoder(e,defaults.decoder,s,"value")})),c&&t.interpretNumericEntities&&"iso-8859-1"===s&&(c=interpretNumericEntities(String(c))),p.indexOf("[]=")>-1&&(c=isArray(c)?[c]:c),t.comma&&isArray(c)&&c.length>t.arrayLimit&&(c=utils.combine([],c,t.arrayLimit,t.plainObjects,t.throwOnLimitExceeded)),null!==d){var f=has.call(r,d);f&&("combine"===t.duplicates||p.indexOf("[]=")>-1)?r[d]=utils.combine(r[d],c,t.arrayLimit,t.plainObjects,t.throwOnLimitExceeded):f&&"last"!==t.duplicates||(r[d]=c)}}return r},parseObject=function(e,t,r,i){var a=0;if(e.length>0&&"[]"===e[e.length-1]){var o=e.slice(0,-1).join("");a=Array.isArray(t)&&t[o]?t[o].length:0}for(var l=i?t:parseArrayValue(t,r,a),n=e.length-1;n>=0;--n){var s,d=e[n];if("[]"===d&&r.parseArrays)s=utils.isOverflow(l)?l:r.allowEmptyArrays&&(""===l||r.strictNullHandling&&null===l)?[]:utils.combine([],l,r.arrayLimit,r.plainObjects,r.throwOnLimitExceeded);else{s=r.plainObjects?{__proto__:null}:{};var c="["===d.charAt(0)&&"]"===d.charAt(d.length-1)?d.slice(1,-1):d,p=r.decodeDotInKeys?c.replace(/%2E/g,"."):c,u=parseInt(p,10),y=!isNaN(u)&&d!==p&&String(u)===p&&u>=0&&r.parseArrays;if(r.parseArrays||""!==p)if(y&&u<r.arrayLimit)(s=[])[u]=l;else{if(y&&r.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+r.arrayLimit+" element"+(1===r.arrayLimit?"":"s")+" allowed in an array.");y?(s[u]=l,utils.markOverflow(s,u)):"__proto__"!==p&&(s[p]=l)}else s={0:l}}l=s}return l},splitKeyIntoSegments=function splitKeyIntoSegments(e,t){var r=t.allowDots?e.replace(/\.([^.[]+)/g,"[$1]"):e;if(t.depth<=0){if(!t.plainObjects&&has.call(Object.prototype,r)&&!t.allowPrototypes)return;return[r]}var i=[],a=r.indexOf("["),o=a>=0?r.slice(0,a):r;if(o){if(!t.plainObjects&&has.call(Object.prototype,o)&&!t.allowPrototypes)return;i[i.length]=o}for(var l=r.length,n=a,s=0;n>=0&&s<t.depth;){for(var d=1,c=n+1,p=-1;c<l&&p<0;){var u=r.charCodeAt(c);91===u?d+=1:93===u&&0==(d-=1)&&(p=c),c+=1}if(p<0)return i[i.length]="["+r.slice(n)+"]",i;var y=r.slice(n,p+1),f=y.slice(1,-1);if(!t.plainObjects&&has.call(Object.prototype,f)&&!t.allowPrototypes)return;i[i.length]=y,s+=1,n=r.indexOf("[",p+1)}if(n>=0){if(!0===t.strictDepth)throw new RangeError("Input depth exceeded depth option of "+t.depth+" and strictDepth is true");i[i.length]="["+r.slice(n)+"]"}return i},parseKeys=function parseQueryStringKeys(e,t,r,i){if(e){var a=splitKeyIntoSegments(e,r);if(a)return parseObject(a,t,r,i)}},normalizeParseOptions=function normalizeParseOptions(e){if(!e)return defaults;if(void 0!==e.allowEmptyArrays&&"boolean"!=typeof e.allowEmptyArrays)throw new TypeError("`allowEmptyArrays` option can only be `true` or `false`, when provided");if(void 0!==e.decodeDotInKeys&&"boolean"!=typeof e.decodeDotInKeys)throw new TypeError("`decodeDotInKeys` option can only be `true` or `false`, when provided");if(null!==e.decoder&&void 0!==e.decoder&&"function"!=typeof e.decoder)throw new TypeError("Decoder has to be a function.");if(void 0!==e.charset&&"utf-8"!==e.charset&&"iso-8859-1"!==e.charset)throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");if(void 0!==e.throwOnLimitExceeded&&"boolean"!=typeof e.throwOnLimitExceeded)throw new TypeError("`throwOnLimitExceeded` option must be a boolean");var t=void 0===e.charset?defaults.charset:e.charset,r=void 0===e.duplicates?defaults.duplicates:e.duplicates;if("combine"!==r&&"first"!==r&&"last"!==r)throw new TypeError("The duplicates option must be either combine, first, or last");return{allowDots:void 0===e.allowDots?!0===e.decodeDotInKeys||defaults.allowDots:!!e.allowDots,allowEmptyArrays:"boolean"==typeof e.allowEmptyArrays?!!e.allowEmptyArrays:defaults.allowEmptyArrays,allowPrototypes:"boolean"==typeof e.allowPrototypes?e.allowPrototypes:defaults.allowPrototypes,allowSparse:"boolean"==typeof e.allowSparse?e.allowSparse:defaults.allowSparse,arrayLimit:"number"==typeof e.arrayLimit?e.arrayLimit:defaults.arrayLimit,charset:t,charsetSentinel:"boolean"==typeof e.charsetSentinel?e.charsetSentinel:defaults.charsetSentinel,comma:"boolean"==typeof e.comma?e.comma:defaults.comma,decodeDotInKeys:"boolean"==typeof e.decodeDotInKeys?e.decodeDotInKeys:defaults.decodeDotInKeys,decoder:"function"==typeof e.decoder?e.decoder:defaults.decoder,delimiter:"string"==typeof e.delimiter||utils.isRegExp(e.delimiter)?e.delimiter:defaults.delimiter,depth:"number"==typeof e.depth||!1===e.depth?+e.depth:defaults.depth,duplicates:r,ignoreQueryPrefix:!0===e.ignoreQueryPrefix,interpretNumericEntities:"boolean"==typeof e.interpretNumericEntities?e.interpretNumericEntities:defaults.interpretNumericEntities,parameterLimit:"number"==typeof e.parameterLimit?e.parameterLimit:defaults.parameterLimit,parseArrays:!1!==e.parseArrays,plainObjects:"boolean"==typeof e.plainObjects?e.plainObjects:defaults.plainObjects,strictDepth:"boolean"==typeof e.strictDepth?!!e.strictDepth:defaults.strictDepth,strictMerge:"boolean"==typeof e.strictMerge?!!e.strictMerge:defaults.strictMerge,strictNullHandling:"boolean"==typeof e.strictNullHandling?e.strictNullHandling:defaults.strictNullHandling,throwOnLimitExceeded:"boolean"==typeof e.throwOnLimitExceeded&&e.throwOnLimitExceeded}};module.exports=function(e,t){var r=normalizeParseOptions(t);if(""===e||null==e)return r.plainObjects?{__proto__:null}:{};for(var i="string"==typeof e?parseValues(e,r):e,a=r.plainObjects?{__proto__:null}:{},o=Object.keys(i),l=0;l<o.length;++l){var n=o[l],s=parseKeys(n,i[n],r,"string"==typeof e);a=utils.merge(a,s,r)}return!0===r.allowSparse?a:utils.compact(a)};
+"use strict";var getSideChannel=require(46),utils=require(5),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,getPrototypeOf=Object.getPrototypeOf,isPlainContainer=function isPlainContainer(e){if(!e||"object"!=typeof e)return!1;if(isArray(e))return!0;var t=getPrototypeOf(e);return t===Object.prototype||null===t},emptyCopyOf=function emptyCopyOf(e){if(isArray(e)){var t=[];return t.length=e.length,t}return null===getPrototypeOf(e)?{__proto__:null}:{}},copyInput=function copyInput(e){for(var t=getSideChannel(),r={},i=[{source:e,target:r}],a=0;a<i.length;++a)for(var o=i[a].source,n=i[a].target,l=Object.keys(o),s=0;s<l.length;++s){var c=o[l[s]];if(isPlainContainer(c)){if(!t.has(c)){var p=emptyCopyOf(c);t.set(c,p),i[i.length]={source:c,target:p}}n[l[s]]=t.get(c)}else n[l[s]]=c}return r},defaults={allowDots:!1,allowEmptyArrays:!1,allowPrototypes:!1,allowSparse:!1,arrayLimit:20,charset:"utf-8",charsetSentinel:!1,comma:!1,decodeDotInKeys:!1,decoder:utils.decode,delimiter:"&",depth:5,duplicates:"combine",ignoreQueryPrefix:!1,interpretNumericEntities:!1,parameterLimit:1e3,parseArrays:!0,plainObjects:!1,strictDepth:!1,strictMerge:!0,strictNullHandling:!1,throwOnLimitExceeded:!1},interpretNumericEntities=function(e){return e.replace(/&#(\d+);/g,function(e,t){return String.fromCharCode(parseInt(t,10))})},parseArrayValue=function(e,t,r){if(e&&"string"==typeof e&&t.comma&&e.indexOf(",")>-1){if(t.throwOnLimitExceeded)for(var i=0,a=e.indexOf(",");a>-1;){if((i+=1)>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");a=e.indexOf(",",a+1)}return e.split(",")}if(t.throwOnLimitExceeded&&r>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return e},isoSentinel="utf8=%26%2310003%3B",charsetSentinel="utf8=%E2%9C%93",parseValues=function parseQueryStringValues(e,t){var r={__proto__:null},i=t.ignoreQueryPrefix?e.replace(/^\?/,""):e;i=i.replace(/%5B/gi,"[").replace(/%5D/gi,"]");var a=t.parameterLimit===1/0?void 0:t.parameterLimit,o=i.split(t.delimiter,t.throwOnLimitExceeded&&void 0!==a?a+1:a);if(t.throwOnLimitExceeded&&void 0!==a&&o.length>a)throw new RangeError("Parameter limit exceeded. Only "+a+" parameter"+(1===a?"":"s")+" allowed.");var n,l=-1,s=t.charset;if(t.charsetSentinel)for(n=0;n<o.length;++n)0===o[n].indexOf("utf8=")&&(o[n]===charsetSentinel?s="utf-8":o[n]===isoSentinel&&(s="iso-8859-1"),l=n,n=o.length);for(n=0;n<o.length;++n)if(n!==l){var c,p,d=o[n],u=d.indexOf("]="),y=-1===u?d.indexOf("="):u+1,f=y>1&&"[]"===d.slice(y-2,y);if(-1===y?(c=t.decoder(d,defaults.decoder,s,"key"),p=t.strictNullHandling?null:""):null!==(c=t.decoder(d.slice(0,y),defaults.decoder,s,"key"))&&(p=utils.maybeMap(parseArrayValue(d.slice(y+1),t,isArray(r[c])?r[c].length:0),function(e){return t.decoder(e,defaults.decoder,s,"value")})),p&&t.interpretNumericEntities&&"iso-8859-1"===s&&(p=interpretNumericEntities(String(p))),f&&(p=isArray(p)?[p]:p),t.comma&&isArray(p)&&p.length>t.arrayLimit&&(p=utils.combine([],p,t.arrayLimit,t.plainObjects,t.throwOnLimitExceeded)),null!==c){var m=has.call(r,c);m&&("combine"===t.duplicates||f)?r[c]=utils.combine(r[c],p,t.arrayLimit,t.plainObjects,t.throwOnLimitExceeded):m&&"last"!==t.duplicates||(r[c]=p)}}return r},parseObject=function(e,t,r,i){var a=0;if(e.length>0&&"[]"===e[e.length-1]){var o=e.slice(0,-1).join("");a=Array.isArray(t)&&t[o]?t[o].length:0}for(var n=i?t:parseArrayValue(t,r,a),l=e.length-1;l>=0;--l){var s,c=e[l];if("[]"===c&&r.parseArrays)s=utils.isOverflow(n)?n:r.allowEmptyArrays&&(""===n||r.strictNullHandling&&null===n)?[]:utils.combine([],n,r.arrayLimit,r.plainObjects,r.throwOnLimitExceeded);else{s=r.plainObjects?{__proto__:null}:{};var p="["===c.charAt(0)&&"]"===c.charAt(c.length-1)?c.slice(1,-1):c,d=r.decodeDotInKeys?p.replace(/%2E/g,"."):p,u=parseInt(d,10),y=!isNaN(u)&&c!==d&&String(u)===d&&u>=0&&r.parseArrays;if(r.parseArrays||""!==d)if(y&&u<r.arrayLimit)(s=[])[u]=n;else{if(y&&r.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+r.arrayLimit+" element"+(1===r.arrayLimit?"":"s")+" allowed in an array.");y?(s[u]=n,utils.markOverflow(s,u)):"__proto__"!==d&&(s[d]=n)}else s={0:n}}n=s}return n},topLevelDotsToBrackets=function topLevelDotsToBrackets(e){for(var t="",r=0,i=0;i<e.length;i+=1){var a=e.charCodeAt(i);if(91===a)r+=1,t+="[";else if(93===a)r>0&&(r-=1),t+="]";else if(46===a&&0===r&&i+1<e.length&&46!==e.charCodeAt(i+1)&&91!==e.charCodeAt(i+1)){for(var o=i+1,n=o;n<e.length&&46!==e.charCodeAt(n)&&91!==e.charCodeAt(n);)n+=1;t+="["+e.slice(o,n)+"]",i=n-1}else t+=e.charAt(i)}return t},splitKeyIntoSegments=function splitKeyIntoSegments(e,t){var r=t.allowDots?topLevelDotsToBrackets(e):e;if(t.depth<=0){if(!t.plainObjects&&has.call(Object.prototype,r)&&!t.allowPrototypes)return;return[r]}var i=[],a=r.indexOf("["),o=a>=0?r.slice(0,a):r;if(o){if(!t.plainObjects&&has.call(Object.prototype,o)&&!t.allowPrototypes)return;i[i.length]=o}for(var n=r.length,l=a,s=0;l>=0&&s<t.depth;){for(var c=1,p=l+1,d=-1;p<n&&d<0;){var u=r.charCodeAt(p);91===u?c+=1:93===u&&0==(c-=1)&&(d=p),p+=1}if(d<0)return i[i.length]="["+r.slice(l)+"]",i;var y=r.slice(l,d+1),f=y.slice(1,-1);if(!t.plainObjects&&has.call(Object.prototype,f)&&!t.allowPrototypes)return;i[i.length]=y,s+=1,l=r.indexOf("[",d+1)}if(l>=0){if(!0===t.strictDepth)throw new RangeError("Input depth exceeded depth option of "+t.depth+" and strictDepth is true");i[i.length]="["+r.slice(l)+"]"}return i},parseKeys=function parseQueryStringKeys(e,t,r,i){if(e){var a=splitKeyIntoSegments(e,r);if(a)return parseObject(a,t,r,i)}},normalizeParseOptions=function normalizeParseOptions(e){if(!e)return defaults;if(void 0!==e.allowEmptyArrays&&"boolean"!=typeof e.allowEmptyArrays)throw new TypeError("`allowEmptyArrays` option can only be `true` or `false`, when provided");if(void 0!==e.decodeDotInKeys&&"boolean"!=typeof e.decodeDotInKeys)throw new TypeError("`decodeDotInKeys` option can only be `true` or `false`, when provided");if(null!==e.decoder&&void 0!==e.decoder&&"function"!=typeof e.decoder)throw new TypeError("Decoder has to be a function.");if(void 0!==e.charset&&"utf-8"!==e.charset&&"iso-8859-1"!==e.charset)throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");if(void 0!==e.throwOnLimitExceeded&&"boolean"!=typeof e.throwOnLimitExceeded)throw new TypeError("`throwOnLimitExceeded` option must be a boolean");var t=void 0===e.charset?defaults.charset:e.charset,r=void 0===e.duplicates?defaults.duplicates:e.duplicates;if("combine"!==r&&"first"!==r&&"last"!==r)throw new TypeError("The duplicates option must be either combine, first, or last");return{allowDots:void 0===e.allowDots?!0===e.decodeDotInKeys||defaults.allowDots:!!e.allowDots,allowEmptyArrays:"boolean"==typeof e.allowEmptyArrays?!!e.allowEmptyArrays:defaults.allowEmptyArrays,allowPrototypes:"boolean"==typeof e.allowPrototypes?e.allowPrototypes:defaults.allowPrototypes,allowSparse:"boolean"==typeof e.allowSparse?e.allowSparse:defaults.allowSparse,arrayLimit:"number"==typeof e.arrayLimit?e.arrayLimit:defaults.arrayLimit,charset:t,charsetSentinel:"boolean"==typeof e.charsetSentinel?e.charsetSentinel:defaults.charsetSentinel,comma:"boolean"==typeof e.comma?e.comma:defaults.comma,decodeDotInKeys:"boolean"==typeof e.decodeDotInKeys?e.decodeDotInKeys:defaults.decodeDotInKeys,decoder:"function"==typeof e.decoder?e.decoder:defaults.decoder,delimiter:"string"==typeof e.delimiter||utils.isRegExp(e.delimiter)?e.delimiter:defaults.delimiter,depth:"number"==typeof e.depth||!1===e.depth?+e.depth:defaults.depth,duplicates:r,ignoreQueryPrefix:!0===e.ignoreQueryPrefix,interpretNumericEntities:"boolean"==typeof e.interpretNumericEntities?e.interpretNumericEntities:defaults.interpretNumericEntities,parameterLimit:"number"==typeof e.parameterLimit?e.parameterLimit:defaults.parameterLimit,parseArrays:!1!==e.parseArrays,plainObjects:"boolean"==typeof e.plainObjects?e.plainObjects:defaults.plainObjects,strictDepth:"boolean"==typeof e.strictDepth?!!e.strictDepth:defaults.strictDepth,strictMerge:"boolean"==typeof e.strictMerge?!!e.strictMerge:defaults.strictMerge,strictNullHandling:"boolean"==typeof e.strictNullHandling?e.strictNullHandling:defaults.strictNullHandling,throwOnLimitExceeded:"boolean"==typeof e.throwOnLimitExceeded&&e.throwOnLimitExceeded}};module.exports=function(e,t){var r=normalizeParseOptions(t);if(""===e||null==e)return r.plainObjects?{__proto__:null}:{};for(var i="string"==typeof e?parseValues(e,r):copyInput(e),a=r.plainObjects?{__proto__:null}:{},o=Object.keys(i),n=0;n<o.length;++n){var l=o[n],s=parseKeys(l,i[l],r,"string"==typeof e);a=utils.merge(a,s,r)}return!0===r.allowSparse?a:utils.compact(a)};
 
-},{"5":5}],4:[function(require,module,exports){
-"use strict";var getSideChannel=require(46),utils=require(5),formats=require(1),has=Object.prototype.hasOwnProperty,arrayPrefixGenerators={brackets:function brackets(e){return e+"[]"},comma:"comma",indices:function indices(e,r){return e+"["+r+"]"},repeat:function repeat(e){return e}},isArray=Array.isArray,push=Array.prototype.push,pushToArray=function(e,r){push.apply(e,isArray(r)?r:[r])},toISO=Date.prototype.toISOString,defaultFormat=formats.default,defaults={addQueryPrefix:!1,allowDots:!1,allowEmptyArrays:!1,arrayFormat:"indices",charset:"utf-8",charsetSentinel:!1,commaRoundTrip:!1,delimiter:"&",depth:1/0,encode:!0,encodeDotInKeys:!1,encoder:utils.encode,encodeValuesOnly:!1,filter:void 0,format:defaultFormat,formatter:formats.formatters[defaultFormat],indices:!1,serializeDate:function serializeDate(e){return toISO.call(e)},skipNulls:!1,strictNullHandling:!1},isNonNullishPrimitive=function isNonNullishPrimitive(e){return"string"==typeof e||"number"==typeof e||"boolean"==typeof e||"symbol"==typeof e||"bigint"==typeof e},sentinel={},stringify=function stringify(e,r,t,o,n,a,i,l,s,f,u,d,y,c,p,m,h,v,g,w){var b=e;if(w>g)throw new RangeError("Input depth exceeded depth option of "+g);for(var D=v,A=0,S=!1;void 0!==(D=D.get(sentinel))&&!S;){var E=D.get(e);if(A+=1,void 0!==E){if(E===A)throw new RangeError("Cyclic object value");S=!0}void 0===D.get(sentinel)&&(A=0)}if((b="function"==typeof f?f(r,b):b)instanceof Date?b=y(b):"comma"===t&&isArray(b)&&(b=utils.maybeMap(b,function(e){return e instanceof Date?y(e):e})),null===b){if(a)return p(s&&!m?s(r,defaults.encoder,h,"key",c):r);b=""}if(isNonNullishPrimitive(b)||utils.isBuffer(b))return s?[p(m?r:s(r,defaults.encoder,h,"key",c))+"="+p(s(b,defaults.encoder,h,"value",c))]:[p(r)+"="+p(String(b))];var N,O=[];if(void 0===b)return O;if("comma"===t&&isArray(b))m&&s&&(b=utils.maybeMap(b,function(e){return null==e?e:s(e)})),N=[{value:b.length>0?b.join(",")||null:void 0}];else if(isArray(f))N=f;else{var T=Object.keys(b);N=u?T.sort(u):T}var k=l?String(r).replace(/\./g,"%2E"):String(r),I=o&&isArray(b)&&1===b.length?k+"[]":k;if(n&&isArray(b)&&0===b.length&&0===Object.keys(b).length)return I+"[]";for(var P=0;P<N.length;++P){var x=N[P],K="object"==typeof x&&x&&void 0!==x.value?x.value:b[x];if(!i||null!==K){var z=d&&l?String(x).replace(/\./g,"%2E"):String(x),j=isArray(b)?"function"==typeof t?t(I,z):I:I+(d?"."+z:"["+z+"]");v.set(e,A);var F=getSideChannel();F.set(sentinel,v),pushToArray(O,stringify(K,j,t,o,n,a,i,l,"comma"===t&&m&&isArray(b)?null:s,f,u,d,y,c,p,m,h,F,g,w+1))}}return O},normalizeStringifyOptions=function normalizeStringifyOptions(e){if(!e)return defaults;if(void 0!==e.allowEmptyArrays&&"boolean"!=typeof e.allowEmptyArrays)throw new TypeError("`allowEmptyArrays` option can only be `true` or `false`, when provided");if(void 0!==e.encodeDotInKeys&&"boolean"!=typeof e.encodeDotInKeys)throw new TypeError("`encodeDotInKeys` option can only be `true` or `false`, when provided");if(null!==e.encoder&&void 0!==e.encoder&&"function"!=typeof e.encoder)throw new TypeError("Encoder has to be a function.");var r=e.charset||defaults.charset;if(void 0!==e.charset&&"utf-8"!==e.charset&&"iso-8859-1"!==e.charset)throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");var t=formats.default;if(void 0!==e.format){if(!has.call(formats.formatters,e.format))throw new TypeError("Unknown format option provided.");t=e.format}var o,n=formats.formatters[t],a=defaults.filter;if(("function"==typeof e.filter||isArray(e.filter))&&(a=e.filter),o=e.arrayFormat in arrayPrefixGenerators?e.arrayFormat:"indices"in e?e.indices?"indices":"repeat":defaults.arrayFormat,"commaRoundTrip"in e&&"boolean"!=typeof e.commaRoundTrip)throw new TypeError("`commaRoundTrip` must be a boolean, or absent");var i=void 0===e.allowDots?!0===e.encodeDotInKeys||defaults.allowDots:!!e.allowDots;return{addQueryPrefix:"boolean"==typeof e.addQueryPrefix?e.addQueryPrefix:defaults.addQueryPrefix,allowDots:i,allowEmptyArrays:"boolean"==typeof e.allowEmptyArrays?!!e.allowEmptyArrays:defaults.allowEmptyArrays,arrayFormat:o,charset:r,charsetSentinel:"boolean"==typeof e.charsetSentinel?e.charsetSentinel:defaults.charsetSentinel,commaRoundTrip:!!e.commaRoundTrip,delimiter:void 0===e.delimiter?defaults.delimiter:e.delimiter,depth:"number"==typeof e.depth?e.depth:defaults.depth,encode:"boolean"==typeof e.encode?e.encode:defaults.encode,encodeDotInKeys:"boolean"==typeof e.encodeDotInKeys?e.encodeDotInKeys:defaults.encodeDotInKeys,encoder:"function"==typeof e.encoder?e.encoder:defaults.encoder,encodeValuesOnly:"boolean"==typeof e.encodeValuesOnly?e.encodeValuesOnly:defaults.encodeValuesOnly,filter:a,format:t,formatter:n,serializeDate:"function"==typeof e.serializeDate?e.serializeDate:defaults.serializeDate,skipNulls:"boolean"==typeof e.skipNulls?e.skipNulls:defaults.skipNulls,sort:"function"==typeof e.sort?e.sort:null,strictNullHandling:"boolean"==typeof e.strictNullHandling?e.strictNullHandling:defaults.strictNullHandling}};module.exports=function(e,r){var t,o=e,n=normalizeStringifyOptions(r);"function"==typeof n.filter?o=(0,n.filter)("",o):isArray(n.filter)&&(t=n.filter);var a=[];if("object"!=typeof o||null===o)return"";var i=arrayPrefixGenerators[n.arrayFormat],l="comma"===i&&n.commaRoundTrip;t||(t=Object.keys(o)),n.sort&&t.sort(n.sort);for(var s=getSideChannel(),f=0;f<t.length;++f){var u=t[f];if(null!=u){var d=o[u];if(!n.skipNulls||null!==d){var y=n.encodeDotInKeys?String(u).replace(/\./g,"%2E"):String(u);pushToArray(a,stringify(d,y,i,l,n.allowEmptyArrays,n.strictNullHandling,n.skipNulls,n.encodeDotInKeys,n.encode?n.encoder:null,n.filter,n.sort,n.allowDots,n.serializeDate,n.format,n.formatter,n.encodeValuesOnly,n.charset,s,n.depth,0))}}}var c=a.join(n.delimiter),p=!0===n.addQueryPrefix?"?":"";return n.charsetSentinel&&("iso-8859-1"===n.charset?p+="utf8=%26%2310003%3B"+n.delimiter:p+="utf8=%E2%9C%93"+n.delimiter),c.length>0?p+c:""};
+},{"46":46,"5":5}],4:[function(require,module,exports){
+"use strict";var getSideChannel=require(46),utils=require(5),formats=require(1),has=Object.prototype.hasOwnProperty,arrayPrefixGenerators={brackets:function brackets(e){return e+"[]"},comma:"comma",indices:function indices(e,r){return e+"["+r+"]"},repeat:function repeat(e){return e}},isArray=Array.isArray,push=Array.prototype.push,pushToArray=function(e,r){push.apply(e,isArray(r)?r:[r])},toISO=Date.prototype.toISOString,defaultFormat=formats.default,defaults={addQueryPrefix:!1,allowDots:!1,allowEmptyArrays:!1,arrayFormat:"indices",charset:"utf-8",charsetSentinel:!1,commaRoundTrip:!1,delimiter:"&",depth:1/0,encode:!0,encodeDotInKeys:!1,encoder:utils.encode,encodeValuesOnly:!1,filter:void 0,format:defaultFormat,formatter:formats.formatters[defaultFormat],indices:!1,serializeDate:function serializeDate(e){return toISO.call(e)},skipNulls:!1,strictNullHandling:!1},isNonNullishPrimitive=function isNonNullishPrimitive(e){return"string"==typeof e||"number"==typeof e||"boolean"==typeof e||"symbol"==typeof e||"bigint"==typeof e},sentinel={},stringify=function stringify(e,r,t,o,n,a,i,l,s,f,u,d,c,y,p,m,h,v,g,b){var w=e;if(b>g)throw new RangeError("Input depth exceeded depth option of "+g);for(var D=v,A=0,S=!1;void 0!==(D=D.get(sentinel))&&!S;){var E=D.get(e);if(A+=1,void 0!==E){if(E===A)throw new RangeError("Cyclic object value");S=!0}void 0===D.get(sentinel)&&(A=0)}if((w="function"==typeof f?f(r,w):w)instanceof Date?w=c(w):"comma"===t&&isArray(w)&&(w=utils.maybeMap(w,function(e){return e instanceof Date?c(e):e})),null===w){if(a)return p(s&&!m?s(r,defaults.encoder,h,"key",y):r);w=""}if(isNonNullishPrimitive(w)||utils.isBuffer(w))return s?[p(m?r:s(r,defaults.encoder,h,"key",y))+"="+p(s(w,defaults.encoder,h,"value",y))]:[p(r)+"="+p(String(w))];var N,O=[];if(void 0===w)return O;if("comma"===t&&isArray(w))m&&s&&(w=utils.maybeMap(w,function(e){return null==e?e:s(e,defaults.encoder,h,"value",y)})),N=[{value:w.length>0?utils.toCoercible(w).join(",")||null:void 0}];else if(isArray(f))N=f;else{var T=Object.keys(w);N=u?T.sort(u):T}var k=String(r),I=o&&isArray(w)&&1===w.length?k+"[]":k;if(n&&isArray(w)&&0===w.length&&0===Object.keys(w).length)return I+"[]";for(var P=0;P<N.length;++P){var x=N[P],K="object"==typeof x&&x&&void 0!==x.value?x.value:w[x];if(!i||null!==K){var z=d&&l?String(x).replace(/\./g,"%2E"):String(x),j=isArray(w)?"function"==typeof t?t(I,z):I:I+(d?"."+z:"["+z+"]");v.set(e,A);var F=getSideChannel();F.set(sentinel,v),pushToArray(O,stringify(K,j,t,o,n,a,i,l,"comma"===t&&m&&isArray(w)?null:s,f,u,d,c,y,p,m,h,F,g,b+1))}}return O},normalizeStringifyOptions=function normalizeStringifyOptions(e){if(!e)return defaults;if(void 0!==e.allowEmptyArrays&&"boolean"!=typeof e.allowEmptyArrays)throw new TypeError("`allowEmptyArrays` option can only be `true` or `false`, when provided");if(void 0!==e.encodeDotInKeys&&"boolean"!=typeof e.encodeDotInKeys)throw new TypeError("`encodeDotInKeys` option can only be `true` or `false`, when provided");if(null!==e.encoder&&void 0!==e.encoder&&"function"!=typeof e.encoder)throw new TypeError("Encoder has to be a function.");var r=e.charset||defaults.charset;if(void 0!==e.charset&&"utf-8"!==e.charset&&"iso-8859-1"!==e.charset)throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");var t=formats.default;if(void 0!==e.format){if(!has.call(formats.formatters,e.format))throw new TypeError("Unknown format option provided.");t=e.format}var o,n=formats.formatters[t],a=defaults.filter;if(("function"==typeof e.filter||isArray(e.filter))&&(a=e.filter),o=has.call(arrayPrefixGenerators,e.arrayFormat)?e.arrayFormat:"indices"in e?e.indices?"indices":"repeat":defaults.arrayFormat,"commaRoundTrip"in e&&"boolean"!=typeof e.commaRoundTrip)throw new TypeError("`commaRoundTrip` must be a boolean, or absent");var i=void 0===e.allowDots?!0===e.encodeDotInKeys||defaults.allowDots:!!e.allowDots;return{addQueryPrefix:"boolean"==typeof e.addQueryPrefix?e.addQueryPrefix:defaults.addQueryPrefix,allowDots:i,allowEmptyArrays:"boolean"==typeof e.allowEmptyArrays?!!e.allowEmptyArrays:defaults.allowEmptyArrays,arrayFormat:o,charset:r,charsetSentinel:"boolean"==typeof e.charsetSentinel?e.charsetSentinel:defaults.charsetSentinel,commaRoundTrip:!!e.commaRoundTrip,delimiter:void 0===e.delimiter?defaults.delimiter:e.delimiter,depth:"number"==typeof e.depth?e.depth:defaults.depth,encode:"boolean"==typeof e.encode?e.encode:defaults.encode,encodeDotInKeys:"boolean"==typeof e.encodeDotInKeys?e.encodeDotInKeys:defaults.encodeDotInKeys,encoder:"function"==typeof e.encoder?e.encoder:defaults.encoder,encodeValuesOnly:"boolean"==typeof e.encodeValuesOnly?e.encodeValuesOnly:defaults.encodeValuesOnly,filter:a,format:t,formatter:n,serializeDate:"function"==typeof e.serializeDate?e.serializeDate:defaults.serializeDate,skipNulls:"boolean"==typeof e.skipNulls?e.skipNulls:defaults.skipNulls,sort:"function"==typeof e.sort?e.sort:null,strictNullHandling:"boolean"==typeof e.strictNullHandling?e.strictNullHandling:defaults.strictNullHandling}};module.exports=function(e,r){var t,o=e,n=normalizeStringifyOptions(r);"function"==typeof n.filter?o=(0,n.filter)("",o):isArray(n.filter)&&(t=n.filter);var a=[];if("object"!=typeof o||null===o)return"";var i=arrayPrefixGenerators[n.arrayFormat],l="comma"===i&&n.commaRoundTrip;t||(t=Object.keys(o)),n.sort&&t.sort(n.sort);for(var s=getSideChannel(),f=0;f<t.length;++f){var u=t[f];if(null!=u){var d=o[u];if(!n.skipNulls||null!==d){var c=n.encodeDotInKeys?String(u).replace(/\./g,"%2E"):String(u);pushToArray(a,stringify(d,c,i,l,n.allowEmptyArrays,n.strictNullHandling,n.skipNulls,n.encodeDotInKeys,n.encode?n.encoder:null,n.filter,n.sort,n.allowDots,n.serializeDate,n.format,n.formatter,n.encodeValuesOnly,n.charset,s,n.depth,0))}}}var y=a.join(n.delimiter),p=!0===n.addQueryPrefix?"?":"";return n.charsetSentinel&&("iso-8859-1"===n.charset?p+="utf8=%26%2310003%3B"+n.delimiter:p+="utf8=%E2%9C%93"+n.delimiter),y.length>0?p+y:""};
 
 },{"1":1,"46":46,"5":5}],5:[function(require,module,exports){
-"use strict";var formats=require(1),getSideChannel=require(46),defineProperty=require(14),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,overflowChannel=getSideChannel(),markOverflow=function markOverflow(e,r){return overflowChannel.set(e,r),e},isOverflow=function isOverflow(e){return overflowChannel.has(e)},getMaxIndex=function getMaxIndex(e){return overflowChannel.get(e)},setMaxIndex=function setMaxIndex(e,r){overflowChannel.set(e,r)},hexTable=function(){for(var e=[],r=0;r<256;++r)e[e.length]="%"+((r<16?"0":"")+r.toString(16)).toUpperCase();return e}(),compactQueue=function compactQueue(e){for(;e.length>1;){var r=e.pop(),t=r.obj[r.prop];if(isArray(t)){for(var n=[],a=0;a<t.length;++a)void 0!==t[a]&&(n[n.length]=t[a]);r.obj[r.prop]=n}}},arrayToObject=function arrayToObject(e,r){for(var t=r&&r.plainObjects?{__proto__:null}:{},n=0;n<e.length;++n)void 0!==e[n]&&(t[n]=e[n]);return t},setProperty=function setProperty(e,r,t){"__proto__"===r&&defineProperty?defineProperty(e,r,{configurable:!0,enumerable:!0,value:t,writable:!0}):e[r]=t},merge=function merge(e,r,t){if(!r)return e;if("object"!=typeof r&&"function"!=typeof r){if(isArray(e)){var n=e.length;if(t&&"number"==typeof t.arrayLimit&&n>=t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(e.concat(r),t),n)}e[n]=r}else{if(!e||"object"!=typeof e)return[e,r];if(isOverflow(e)){var a=getMaxIndex(e)+1;e[a]=r,setMaxIndex(e,a)}else{if(t&&t.strictMerge)return[e,r];(t&&(t.plainObjects||t.allowPrototypes)||!has.call(Object.prototype,r))&&(e[r]=!0)}}return e}if(!e||"object"!=typeof e){if(isOverflow(r)){for(var o=Object.keys(r),i=t&&t.plainObjects?{__proto__:null,0:e}:{0:e},l=0;l<o.length;l++)i[parseInt(o[l],10)+1]=r[o[l]];return markOverflow(i,getMaxIndex(r)+1)}var c=[e].concat(r);if(t&&"number"==typeof t.arrayLimit&&c.length>t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(c,t),c.length-1)}return c}var f=e;if(isArray(e)&&!isArray(r)&&(f=arrayToObject(e,t)),isArray(e)&&isArray(r)){if(r.forEach(function(r,n){if(has.call(e,n)){var a=e[n];a&&"object"==typeof a&&r&&"object"==typeof r?e[n]=merge(a,r,t):e[e.length]=r}else e[n]=r}),t&&"number"==typeof t.arrayLimit&&e.length>t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(e,t),e.length-1)}return e}return Object.keys(r).reduce(function(e,n){var a=r[n];if(has.call(e,n)?setProperty(e,n,merge(e[n],a,t)):setProperty(e,n,a),isOverflow(r)&&!isOverflow(e)&&markOverflow(e,getMaxIndex(r)),isOverflow(e)){var o=parseInt(n,10);String(o)===n&&o>=0&&o>getMaxIndex(e)&&setMaxIndex(e,o)}return e},f)},assign=function assignSingleSource(e,r){return Object.keys(r).reduce(function(e,t){return setProperty(e,t,r[t]),e},e)},decode=function(e,r,t){var n=e.replace(/\+/g," ");if("iso-8859-1"===t)return n.replace(/%[0-9a-f]{2}/gi,unescape);try{return decodeURIComponent(n)}catch(e){return n}},limit=1024,encode=function encode(e,r,t,n,a){if(0===e.length)return e;var o=e;if("symbol"==typeof e?o=Symbol.prototype.toString.call(e):"string"!=typeof e&&(o=String(e)),"iso-8859-1"===t)return escape(o).replace(/%u[0-9a-f]{4}/gi,function(e){return"%26%23"+parseInt(e.slice(2),16)+"%3B"});for(var i="",l=0;l<o.length;l+=limit){var c=o.length>=limit?o.slice(l,l+limit):o;if(l+limit<o.length){var f=c.charCodeAt(c.length-1);f>=55296&&f<=56319&&(c=c.slice(0,-1),l-=1)}for(var s=[],u=0;u<c.length;++u){var y=c.charCodeAt(u);45===y||46===y||95===y||126===y||y>=48&&y<=57||y>=65&&y<=90||y>=97&&y<=122||a===formats.RFC1738&&(40===y||41===y)?s[s.length]=c.charAt(u):y<128?s[s.length]=hexTable[y]:y<2048?s[s.length]=hexTable[192|y>>6]+hexTable[128|63&y]:y<55296||y>=57344?s[s.length]=hexTable[224|y>>12]+hexTable[128|y>>6&63]+hexTable[128|63&y]:(u+=1,y=65536+((1023&y)<<10|1023&c.charCodeAt(u)),s[s.length]=hexTable[240|y>>18]+hexTable[128|y>>12&63]+hexTable[128|y>>6&63]+hexTable[128|63&y])}i+=s.join("")}return i},compact=function compact(e){for(var r=[{obj:{o:e},prop:"o"}],t=getSideChannel(),n=0;n<r.length;++n)for(var a=r[n],o=a.obj[a.prop],i=Object.keys(o),l=0;l<i.length;++l){var c=i[l],f=o[c];"object"!=typeof f||null===f||t.has(f)||(r[r.length]={obj:o,prop:c},t.set(f,!0))}return compactQueue(r),e},isRegExp=function isRegExp(e){return"[object RegExp]"===Object.prototype.toString.call(e)},isBuffer=function isBuffer(e){return!(!e||"object"!=typeof e||!e.constructor||"function"!=typeof e.constructor.isBuffer||!e.constructor.isBuffer(e))},combine=function combine(e,r,t,n,a){if(isOverflow(e)){if(a)throw new RangeError("Array limit exceeded. Only "+t+" element"+(1===t?"":"s")+" allowed in an array.");for(var o=isArray(r)?r:[r],i=getMaxIndex(e),l=0;l<o.length;++l)e[i+=1]=o[l];return setMaxIndex(e,i),e}var c=[].concat(e,r);if(c.length>t){if(a)throw new RangeError("Array limit exceeded. Only "+t+" element"+(1===t?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(c,{plainObjects:n}),c.length-1)}return c},maybeMap=function maybeMap(e,r){if(isArray(e)){for(var t=[],n=0;n<e.length;n+=1)t[t.length]=r(e[n]);return t}return r(e)};module.exports={/* common-shake removed: arrayToObject:arrayToObject *//* common-shake removed: assign:assign */combine:combine,compact:compact,decode:decode,encode:encode,isBuffer:isBuffer,isOverflow:isOverflow,isRegExp:isRegExp,markOverflow:markOverflow,maybeMap:maybeMap,merge:merge};
+"use strict";var formats=require(1),getSideChannel=require(46),defineProperty=require(14),has=Object.prototype.hasOwnProperty,isArray=Array.isArray,overflowChannel=getSideChannel(),markOverflow=function markOverflow(e,r){return overflowChannel.set(e,r),e},isOverflow=function isOverflow(e){return overflowChannel.has(e)},getMaxIndex=function getMaxIndex(e){return overflowChannel.get(e)},setMaxIndex=function setMaxIndex(e,r){overflowChannel.set(e,r)},conflictChannel=getSideChannel(),markConflict=function markConflict(e,r){return conflictChannel.set(e,r),e},isConflict=function isConflict(e){return conflictChannel.has(e)},getConflictIndex=function getConflictIndex(e){return conflictChannel.get(e)},hexTable=function(){for(var e=[],r=0;r<256;++r)e[e.length]="%"+((r<16?"0":"")+r.toString(16)).toUpperCase();return e}(),compactQueue=function compactQueue(e){for(;e.length>1;){var r=e.pop(),t=r.obj[r.prop];if(isArray(t)){for(var n=[],i=0;i<t.length;++i)void 0!==t[i]&&(n[n.length]=t[i]);r.obj[r.prop]=n}}},arrayToObject=function arrayToObject(e,r){for(var t=r&&r.plainObjects?{__proto__:null}:{},n=0;n<e.length;++n)void 0!==e[n]&&(t[n]=e[n]);return t},setProperty=function setProperty(e,r,t){"__proto__"===r&&defineProperty?defineProperty(e,r,{configurable:!0,enumerable:!0,value:t,writable:!0}):e[r]=t},maxNumericIndex=function maxNumericIndex(e,r){for(var t=r,n=Object.keys(e),i=0;i<n.length;++i){var o=parseInt(n[i],10);String(o)===n[i]&&o>t&&(t=o)}return t},limitedPair=function limitedPair(e,r,t){var n=[e,r];if(t&&"number"==typeof t.arrayLimit&&n.length>t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(n,t),1)}return n},merge=function merge(e,r,t){if(!r)return e;if("object"!=typeof r&&"function"!=typeof r){if(isArray(e)){var n=e.length;if(t&&"number"==typeof t.arrayLimit&&n>=t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(e.concat(r),t),n)}e[n]=r}else{if(!e||"object"!=typeof e)return limitedPair(e,r,t);if(isOverflow(e)){var i=getMaxIndex(e)+1;e[i]=r,setMaxIndex(e,i)}else if(t&&t.strictMerge&&isConflict(e)){var o=getConflictIndex(e)+1;if(t.throwOnLimitExceeded&&"number"==typeof t.arrayLimit&&o>=t.arrayLimit)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");e[o]=r,markConflict(e,o)}else{if(t&&t.strictMerge){var a=limitedPair(e,r,t);return isArray(a)?markConflict(a,1):a}(t&&(t.plainObjects||t.allowPrototypes)||!has.call(Object.prototype,r))&&(e[r]=!0)}}return e}if(!e||"object"!=typeof e){if(isOverflow(r)){for(var l=Object.keys(r),f=t&&t.plainObjects?{__proto__:null,0:e}:{0:e},c=0;c<l.length;c++)f[parseInt(l[c],10)+1]=r[l[c]];return markOverflow(f,getMaxIndex(r)+1)}var y=[e].concat(r);if(t&&"number"==typeof t.arrayLimit&&y.length>t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(y,t),y.length-1)}return y}var u=e;if(isArray(e)&&!isArray(r)&&(u=arrayToObject(e,t),isConflict(e)&&markConflict(u,e.length-1)),isArray(e)&&isArray(r)){if(r.forEach(function(r,n){if(has.call(e,n)){var i=e[n];i&&"object"==typeof i&&r&&"object"==typeof r?e[n]=merge(i,r,t):e[e.length]=r}else e[n]=r}),t&&"number"==typeof t.arrayLimit&&e.length>t.arrayLimit){if(t.throwOnLimitExceeded)throw new RangeError("Array limit exceeded. Only "+t.arrayLimit+" element"+(1===t.arrayLimit?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(e,t),e.length-1)}return e}return Object.keys(r).reduce(function(e,n){var i=r[n];if(has.call(e,n)?setProperty(e,n,merge(e[n],i,t)):setProperty(e,n,i),isOverflow(r)&&!isOverflow(e)&&markOverflow(e,maxNumericIndex(e,getMaxIndex(r))),isOverflow(e)){var o=parseInt(n,10);String(o)===n&&o>=0&&o>getMaxIndex(e)&&setMaxIndex(e,o)}if(isConflict(e)){var a=parseInt(n,10);String(a)===n&&a>getConflictIndex(e)&&markConflict(e,a)}return e},u)},assign=function assignSingleSource(e,r){return Object.keys(r).reduce(function(e,t){return setProperty(e,t,r[t]),e},e)},decode=function(e,r,t){if("string"==typeof e&&-1===e.indexOf("%"))return-1===e.indexOf("+")?e:e.replace(/\+/g," ");var n=e.replace(/\+/g," ");if("iso-8859-1"===t)return n.replace(/%[0-9a-f]{2}/gi,unescape);try{return decodeURIComponent(n)}catch(e){return n}},hasToPrimitive="function"==typeof Symbol&&"symbol"==typeof Symbol.toPrimitive,arrayJoin=Array.prototype.join,arrayToString=Array.prototype.toString,objectToString=Object.prototype.toString,toCoercible=function toCoercible(e,r){if(!e||"object"!=typeof e&&"function"!=typeof e)return e;if(hasToPrimitive&&null!=e[Symbol.toPrimitive])return e;if(isArray(e)&&e.toString===arrayToString&&e.join===arrayJoin){var t,n=r||getSideChannel();if(n.has(e))return"";n.set(e,!0);for(var i=0;i<e.length;i+=1){var o=e[i],a=toCoercible(o,n);if(!t&&a!==o){t=[];for(var l=0;l<i;l+=1)t[l]=e[l]}t&&(t[i]=a)}return n.delete(e),t||e}if("function"==typeof e.toString)return e;var f=e.valueOf;if("function"==typeof f){var c=f.call(e);if(!c||"object"!=typeof c&&"function"!=typeof c)return String(c)}return objectToString.call(e)},limit=1024,encode=function encode(e,r,t,n,i){if(0===e.length)return e;var o=e;if("symbol"==typeof e?o=Symbol.prototype.toString.call(e):"string"!=typeof e&&(o=String(toCoercible(e))),"iso-8859-1"===t)return escape(o).replace(/%u[0-9a-f]{4}/gi,function(e){return"%26%23"+parseInt(e.slice(2),16)+"%3B"}).replace(/\+/g,"%2B");for(var a="",l=0;l<o.length;l+=limit){var f=o.length>=limit?o.slice(l,l+limit):o;if(l+limit<o.length){var c=f.charCodeAt(f.length-1);c>=55296&&c<=56319&&(f=f.slice(0,-1),l-=1)}for(var y=[],u=0;u<f.length;++u){var s=f.charCodeAt(u);45===s||46===s||95===s||126===s||s>=48&&s<=57||s>=65&&s<=90||s>=97&&s<=122||i===formats.RFC1738&&(40===s||41===s)?y[y.length]=f.charAt(u):s<128?y[y.length]=hexTable[s]:s<2048?y[y.length]=hexTable[192|s>>6]+hexTable[128|63&s]:s<55296||s>=57344?y[y.length]=hexTable[224|s>>12]+hexTable[128|s>>6&63]+hexTable[128|63&s]:(u+=1,s=65536+((1023&s)<<10|1023&f.charCodeAt(u)),y[y.length]=hexTable[240|s>>18]+hexTable[128|s>>12&63]+hexTable[128|s>>6&63]+hexTable[128|63&s])}a+=y.join("")}return a},compact=function compact(e){for(var r=[{obj:{o:e},prop:"o"}],t=getSideChannel(),n=0;n<r.length;++n)for(var i=r[n],o=i.obj[i.prop],a=Object.keys(o),l=0;l<a.length;++l){var f=a[l],c=o[f];"object"!=typeof c||null===c||t.has(c)||(r[r.length]={obj:o,prop:f},t.set(c,!0))}return compactQueue(r),e},isRegExp=function isRegExp(e){return"[object RegExp]"===Object.prototype.toString.call(e)},isBuffer=function isBuffer(e){return!(!e||"object"!=typeof e||!e.constructor||"function"!=typeof e.constructor.isBuffer||!e.constructor.isBuffer(e))},combine=function combine(e,r,t,n,i){if(isOverflow(e)){if(i)throw new RangeError("Array limit exceeded. Only "+t+" element"+(1===t?"":"s")+" allowed in an array.");for(var o=isArray(r)?r:[r],a=getMaxIndex(e),l=0;l<o.length;++l)e[a+=1]=o[l];return setMaxIndex(e,a),e}var f=[].concat(e,r);if(f.length>t){if(i)throw new RangeError("Array limit exceeded. Only "+t+" element"+(1===t?"":"s")+" allowed in an array.");return markOverflow(arrayToObject(f,{plainObjects:n}),f.length-1)}return f},maybeMap=function maybeMap(e,r){if(isArray(e)){for(var t=[],n=0;n<e.length;n+=1)t[t.length]=r(e[n]);return t}return r(e)};module.exports={/* common-shake removed: arrayToObject:arrayToObject *//* common-shake removed: assign:assign */combine:combine,compact:compact,decode:decode,encode:encode,isBuffer:isBuffer,isOverflow:isOverflow,isRegExp:isRegExp,markOverflow:markOverflow,maybeMap:maybeMap,merge:merge,toCoercible:toCoercible};
 
 },{"1":1,"14":14,"46":46}],46:[function(require,module,exports){
 "use strict";var $TypeError=require(20),inspect=require(42),getSideChannelList=require(43),getSideChannelMap=require(44),getSideChannelWeakMap=require(45),makeChannel=getSideChannelWeakMap||getSideChannelMap||getSideChannelList;module.exports=function getSideChannel(){var e,n={assert:function(e){if(!n.has(e)){var t=e&&Object(e)===e?"the given object key":inspect(e);throw new $TypeError("Side channel does not contain "+t)}},delete:function(n){return!!e&&e.delete(n)},get:function(n){return e&&e.get(n)},has:function(n){return!!e&&e.has(n)},set:function(n,t){e||(e=makeChannel()),e.set(n,t)}};return n};
@@ -78,40 +78,40 @@
 },{}],23:[function(require,module,exports){
 "use strict";var ERROR_MESSAGE="Function.prototype.bind called on incompatible ",toStr=Object.prototype.toString,max=Math.max,funcType="[object Function]",concatty=function concatty(t,n){for(var r=[],o=0;o<t.length;o+=1)r[o]=t[o];for(var e=0;e<n.length;e+=1)r[e+t.length]=n[e];return r},slicy=function slicy(t,n){for(var r=[],o=n||0,e=0;o<t.length;o+=1,e+=1)r[e]=t[o];return r},joiny=function(t,n){for(var r="",o=0;o<t.length;o+=1)r+=t[o],o+1<t.length&&(r+=n);return r};module.exports=function bind(t){var n=this;if("function"!=typeof n||toStr.apply(n)!==funcType)throw new TypeError(ERROR_MESSAGE+n);for(var r,o=slicy(arguments,1),e=max(0,n.length-o.length),i=[],c=0;c<e;c++)i[c]="$"+c;if(r=Function("binder","return function ("+joiny(i,",")+"){ return binder.apply(this,arguments); }")(function(){if(this instanceof r){var e=n.apply(this,concatty(o,arguments));return Object(e)===e?e:this}return n.apply(t,concatty(o,arguments))}),n.prototype){var p=function Empty(){};p.prototype=n.prototype,r.prototype=new p,p.prototype=null}return r};
 
+},{}],39:[function(require,module,exports){
+"use strict";module.exports=Math.pow;
+
 },{}],35:[function(require,module,exports){
 "use strict";module.exports=Math.floor;
 
+},{}],38:[function(require,module,exports){
+"use strict";module.exports=Math.min;
+
 },{}],34:[function(require,module,exports){
 "use strict";module.exports=Math.abs;
 
-},{}],37:[function(require,module,exports){
-"use strict";module.exports=Math.max;
-
-},{}],39:[function(require,module,exports){
-"use strict";module.exports=Math.pow;
-
 },{}],40:[function(require,module,exports){
 "use strict";module.exports=Math.round;
 
-},{}],38:[function(require,module,exports){
-"use strict";module.exports=Math.min;
+},{}],37:[function(require,module,exports){
+"use strict";module.exports=Math.max;
 
 },{}],27:[function(require,module,exports){
 "use strict";module.exports="undefined"!=typeof Reflect&&Reflect.getPrototypeOf||null;
 
-},{}],26:[function(require,module,exports){
-"use strict";var $Object=require(22);module.exports=$Object.getPrototypeOf||null;
-
-},{"22":22}],41:[function(require,module,exports){
+},{}],41:[function(require,module,exports){
 "use strict";var $isNaN=require(36);module.exports=function sign(i){return $isNaN(i)||0===i?i:i<0?-1:1};
 
-},{"36":36}],33:[function(require,module,exports){
-"use strict";var call=Function.prototype.call,$hasOwn=Object.prototype.hasOwnProperty,bind=require(24);module.exports=bind.call(call,$hasOwn);
+},{"36":36}],26:[function(require,module,exports){
+"use strict";var $Object=require(22);module.exports=$Object.getPrototypeOf||null;
 
-},{"24":24}],31:[function(require,module,exports){
+},{"22":22}],31:[function(require,module,exports){
 "use strict";var origSymbol="undefined"!=typeof Symbol&&Symbol,hasSymbolSham=require(32);module.exports=function hasNativeSymbols(){return"function"==typeof origSymbol&&"function"==typeof Symbol&&"symbol"==typeof origSymbol("foo")&&"symbol"==typeof Symbol("bar")&&hasSymbolSham()};
 
-},{"32":32}],28:[function(require,module,exports){
+},{"32":32}],33:[function(require,module,exports){
+"use strict";var call=Function.prototype.call,$hasOwn=Object.prototype.hasOwnProperty,bind=require(24);module.exports=bind.call(call,$hasOwn);
+
+},{"24":24}],28:[function(require,module,exports){
 "use strict";var reflectGetProto=require(27),originalGetProto=require(26),getDunderProto=require(13);module.exports=reflectGetProto?function getProto(t){return reflectGetProto(t)}:originalGetProto?function getProto(t){if(!t||"object"!=typeof t&&"function"!=typeof t)throw new TypeError("getProto: not an object");return originalGetProto(t)}:getDunderProto?function getProto(t){return getDunderProto(t)}:null;
 
 },{"13":13,"26":26,"27":27}],29:[function(require,module,exports){

package/node_modules/qs/lib/parse.js

@@ -1,9 +1,59 @@
 'use strict';
 
+var getSideChannel = require('side-channel');
 var utils = require('./utils');
 
 var has = Object.prototype.hasOwnProperty;
 var isArray = Array.isArray;
+var getPrototypeOf = Object.getPrototypeOf;
+
+var isPlainContainer = function isPlainContainer(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    if (isArray(value)) {
+        return true;
+    }
+    var proto = getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+
+var emptyCopyOf = function emptyCopyOf(value) {
+    if (isArray(value)) {
+        var arr = [];
+        arr.length = value.length;
+        return arr;
+    }
+    return getPrototypeOf(value) === null ? { __proto__: null } : {};
+};
+
+// `merge` and `compact` modify the containers they are given, so copy the caller's arrays and plain objects first
+var copyInput = function copyInput(input) {
+    var copies = getSideChannel();
+    var result = {};
+    var queue = [{ source: input, target: result }];
+
+    for (var i = 0; i < queue.length; ++i) {
+        var source = queue[i].source;
+        var target = queue[i].target;
+        var keys = Object.keys(source);
+        for (var j = 0; j < keys.length; ++j) {
+            var value = source[keys[j]];
+            if (isPlainContainer(value)) {
+                if (!copies.has(value)) {
+                    var copy = emptyCopyOf(value);
+                    copies.set(value, copy);
+                    queue[queue.length] = { source: value, target: copy };
+                }
+                target[keys[j]] = copies.get(value);
+            } else {
+                target[keys[j]] = value;
+            }
+        }
+    }
+
+    return result;
+};
 
 var defaults = {
     allowDots: false,
@@ -112,6 +162,9 @@ var parseValues = function parseQueryStringValues(str, options) {
         var bracketEqualsPos = part.indexOf(']=');
         var pos = bracketEqualsPos === -1 ? part.indexOf('=') : bracketEqualsPos + 1;
 
+        // `[]` belongs to the key, so look for it at the split point, not anywhere in the part
+        var isEmptyBracketKey = pos > 1 && part.slice(pos - 2, pos) === '[]';
+
         var key;
         var val;
         if (pos === -1) {
@@ -138,7 +191,7 @@ var parseValues = function parseQueryStringValues(str, options) {
             val = interpretNumericEntities(String(val));
         }
 
-        if (part.indexOf('[]=') > -1) {
+        if (isEmptyBracketKey) {
             val = isArray(val) ? [val] : val;
         }
 
@@ -148,7 +201,7 @@ var parseValues = function parseQueryStringValues(str, options) {
 
         if (key !== null) {
             var existing = has.call(obj, key);
-            if (existing && (options.duplicates === 'combine' || part.indexOf('[]=') > -1)) {
+            if (existing && (options.duplicates === 'combine' || isEmptyBracketKey)) {
                 obj[key] = utils.combine(
                     obj[key],
                     val,
@@ -224,10 +277,47 @@ var parseObject = function (chain, val, options, valuesParsed) {
     return leaf;
 };
 
+// Behaves like `key.replace(/\.([^.[]+)/g, '[$1]')`, but only rewrites a dot
+// that sits at bracket depth 0. A literal dot already inside a `[...]` segment
+// is left untouched instead of corrupting the key (e.g. "outer[a.b]"). (#617)
+var topLevelDotsToBrackets = function topLevelDotsToBrackets(key) {
+    var result = '';
+    var depth = 0;
+    for (var i = 0; i < key.length; i += 1) {
+        var cu = key.charCodeAt(i);
+        if (cu === 0x5B) { // '['
+            depth += 1;
+            result += '[';
+        } else if (cu === 0x5D) { // ']'
+            if (depth > 0) {
+                depth -= 1;
+            }
+            result += ']';
+        } else if (
+            cu === 0x2E // '.'
+            && depth === 0
+            && i + 1 < key.length
+            && key.charCodeAt(i + 1) !== 0x2E // not another '.'
+            && key.charCodeAt(i + 1) !== 0x5B // not '['
+        ) {
+            var start = i + 1;
+            var j = start;
+            while (j < key.length && key.charCodeAt(j) !== 0x2E && key.charCodeAt(j) !== 0x5B) {
+                j += 1;
+            }
+            result += '[' + key.slice(start, j) + ']';
+            i = j - 1;
+        } else {
+            result += key.charAt(i);
+        }
+    }
+    return result;
+};
+
 // Split a key like "a[b][c[]]" into ['a', '[b]', '[c[]]'] while preserving
 // qs parse semantics for depth/prototype guards.
 var splitKeyIntoSegments = function splitKeyIntoSegments(originalKey, options) {
-    var key = options.allowDots ? originalKey.replace(/\.([^.[]+)/g, '[$1]') : originalKey;
+    var key = options.allowDots ? topLevelDotsToBrackets(originalKey) : originalKey;
 
     // depth <= 0 keeps the whole key as one segment
     if (options.depth <= 0) {
@@ -393,7 +483,7 @@ module.exports = function (str, opts) {
         return options.plainObjects ? { __proto__: null } : {};
     }
 
-    var tempObj = typeof str === 'string' ? parseValues(str, options) : str;
+    var tempObj = typeof str === 'string' ? parseValues(str, options) : copyInput(str);
     var obj = options.plainObjects ? { __proto__: null } : {};
 
     // Iterate over the keys and setup the new object

package/node_modules/qs/lib/stringify.js

@@ -150,10 +150,10 @@ var stringify = function stringify(
         // we need to join elements in
         if (encodeValuesOnly && encoder) {
             obj = utils.maybeMap(obj, function (v) {
-                return v == null ? v : encoder(v);
+                return v == null ? v : encoder(v, defaults.encoder, charset, 'value', format);
             });
         }
-        objKeys = [{ value: obj.length > 0 ? obj.join(',') || null : void undefined }];
+        objKeys = [{ value: obj.length > 0 ? utils.toCoercible(obj).join(',') || null : void undefined }];
     } else if (isArray(filter)) {
         objKeys = filter;
     } else {
@@ -161,7 +161,7 @@ var stringify = function stringify(
         objKeys = sort ? keys.sort(sort) : keys;
     }
 
-    var encodedPrefix = encodeDotInKeys ? String(prefix).replace(/\./g, '%2E') : String(prefix);
+    var encodedPrefix = String(prefix);
 
     var adjustedPrefix = commaRoundTrip && isArray(obj) && obj.length === 1 ? encodedPrefix + '[]' : encodedPrefix;
 
@@ -251,7 +251,7 @@ var normalizeStringifyOptions = function normalizeStringifyOptions(opts) {
     }
 
     var arrayFormat;
-    if (opts.arrayFormat in arrayPrefixGenerators) {
+    if (has.call(arrayPrefixGenerators, opts.arrayFormat)) {
         arrayFormat = opts.arrayFormat;
     } else if ('indices' in opts) {
         arrayFormat = opts.indices ? 'indices' : 'repeat';