@zuplo/cli 7.13.1 → 7.13.3

package/node_modules/@zuplo/runtime/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{G as p,L as c,O as u}from"../chunk-3CVOCJ3Y.js";import"../chunk-ZCJ5QBVD.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{aa as i}from"../chunk-FQIUJWH2.js";import"../chunk-UKQQD2JN.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
+import{G as p,L as c,O as u}from"../chunk-DVFQRFED.js";import"../chunk-ZCJ5QBVD.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{aa as i}from"../chunk-FQIUJWH2.js";import"../chunk-UKQQD2JN.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.13.1",
+  "version": "7.13.3",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/ansi-regex/index.js

@@ -1,15 +1,24 @@
 export default function ansiRegex({onlyFirst = false} = {}) {
 	// Valid string terminator sequences are BEL, ESC\, and 0x9c
-	const ST = '(?:\\u0007|\\u001B\\u005C|\\u009C)';
+	const ST = String.raw`(?:\u0007|\u001B\u005C|\u009C)`;
 
 	// OSC sequences only: ESC ] ... ST (or the C1 introducer 0x9d ... ST)
 	// The payload stops at the first terminator character rather than scanning ahead for one, so an unterminated `ESC ]` cannot rescan the rest of the input. Terminals likewise abort a control string on an unexpected ESC. The payload also stops at 0x9d so an unterminated C1 OSC cannot swallow the next one.
-	const osc = `(?:(?:\\u001B\\]|\\u009D)[^\\u0007\\u001B\\u009C\\u009D]*${ST})`;
+	const osc = String.raw`(?:(?:\u001B\]|\u009D)[^\u0007\u001B\u009C\u009D]*${ST})`;
 
 	// CSI and related: ESC/C1, optional intermediates, optional params (supports ; and :) then final byte
-	const csi = '[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]';
+	// The final byte class is deliberately narrow, so that ESC followed by an arbitrary character is not read as a sequence. It must
+	// not include the parameter digits though: when the real final byte is outside the class the engine backtracks and takes the last
+	// parameter digit as the final byte instead, leaving the real one behind as visible text. `ESC [ 5 d` stripped to a bare `d`.
+	const csi = String.raw`[\u001B\u009B][[\]()#;?]*(?:\d{1,4}(?:[;:]\d{0,4})*)?[A-PR-TZcf-nq-uy=><~]`;
 
-	const pattern = `${osc}|${csi}`;
+	// `= < >` are final bytes in the two byte VT52 escapes (`ESC >`) but parameter bytes in a CSI
+	// (`ESC [ > 0 ; 276 ; 0 c`, the device attributes reply). Matching them as a final byte always
+	// wins and leaves the rest of the reply behind as visible text, so the private parameter form is
+	// matched first, where the `[` makes the two unambiguous.
+	const csiPrivate = String.raw`(?:\u001B\[|\u009B)[<=>][0-9;:]*[A-PR-TZcf-nq-uy~]`;
+
+	const pattern = `${osc}|${csiPrivate}|${csi}`;
 
 	return new RegExp(pattern, onlyFirst ? undefined : 'g');
 }

package/node_modules/ansi-regex/package.json

@@ -1,24 +1,23 @@
 {
 	"name": "ansi-regex",
-	"version": "6.4.0",
+	"version": "6.5.0",
 	"description": "Regular expression for matching ANSI escape codes",
 	"license": "MIT",
 	"repository": "chalk/ansi-regex",
 	"funding": "https://github.com/chalk/ansi-regex?sponsor=1",
-	"author": {
-		"name": "Sindre Sorhus",
-		"email": "sindresorhus@gmail.com",
-		"url": "https://sindresorhus.com"
-	},
+	"author": "Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)",
 	"type": "module",
-	"exports": "./index.js",
+	"exports": {
+		"types": "./index.d.ts",
+		"default": "./index.js"
+	},
 	"types": "./index.d.ts",
 	"sideEffects": false,
 	"engines": {
 		"node": ">=12"
 	},
 	"scripts": {
-		"test": "xo && ava && tsd",
+		"test": "xo && node --test",
 		"view-supported": "node fixtures/view-codes.js"
 	},
 	"files": [
@@ -53,9 +52,27 @@
 		"pattern"
 	],
 	"devDependencies": {
-		"ansi-escapes": "^5.0.0",
-		"ava": "^3.15.0",
-		"tsd": "^0.21.0",
-		"xo": "^0.54.2"
-	}
+		"ansi-escapes": "^7.3.0",
+		"xo": "^5.0.1"
+	},
+	"xo": [
+		{
+			"rules": {
+				"node-test/no-conditional-assertion": "off",
+				"regexp/no-control-character": "off",
+				"regexp/no-useless-non-capturing-group": "off",
+				"regexp/prefer-regexp-exec": "off",
+				"regexp/sort-character-class-elements": "off",
+				"unicorn/prefer-https": "off"
+			}
+		},
+		{
+			"files": [
+				"package.json"
+			],
+			"rules": {
+				"package-json/prefer-exports": "off"
+			}
+		}
+	]
 }

package/node_modules/encodeurl/README.md

@@ -1,5 +1,10 @@
 # Encode URL
 
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Build Status][ci-image]][ci-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
 Encode a URL to a percent-encoded form, excluding already-encoded sequences.
 
 ## Installation
@@ -107,3 +112,12 @@ $ npm run lint
 ## License
 
 [MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/encodeurl
+[npm-url]: https://npmjs.org/package/encodeurl
+[downloads-image]: https://img.shields.io/npm/dm/encodeurl
+[downloads-url]: https://npmcharts.com/compare/encodeurl?minimal=true
+[ci-image]: https://img.shields.io/github/actions/workflow/status/pillarjs/encodeurl/ci.yml?branch=master
+[ci-url]: https://github.com/pillarjs/encodeurl/actions/workflows/ci.yml
+[coveralls-image]: https://img.shields.io/coverallsCoverage/github/pillarjs/encodeurl?branch=master
+[coveralls-url]: https://coveralls.io/r/pillarjs/encodeurl?branch=master

package/node_modules/encodeurl/index.js

@@ -22,18 +22,11 @@ module.exports = encodeUrl
 var ENCODE_CHARS_REGEXP = /(?:[^\x21\x23-\x3B\x3D\x3F-\x5F\x61-\x7A\x7C\x7E]|%(?:[^0-9A-Fa-f]|[0-9A-Fa-f][^0-9A-Fa-f]|$))+/g
 
 /**
- * RegExp to match unmatched surrogate pair.
+ * RegExp to match surrogate pairs and unpaired surrogates.
  * @private
  */
 
-var UNMATCHED_SURROGATE_PAIR_REGEXP = /(^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]|[\uD800-\uDBFF]([^\uDC00-\uDFFF]|$)/g
-
-/**
- * String to replace unmatched surrogate pair with.
- * @private
- */
-
-var UNMATCHED_SURROGATE_PAIR_REPLACE = '$1\uFFFD$2'
+var SURROGATE_REGEXP = /([\uD800-\uDBFF][\uDC00-\uDFFF])|[\uD800-\uDFFF]/g
 
 /**
  * Encode a URL to a percent-encoded form, excluding already-encoded sequences.
@@ -55,6 +48,8 @@ var UNMATCHED_SURROGATE_PAIR_REPLACE = '$1\uFFFD$2'
 
 function encodeUrl (url) {
   return String(url)
-    .replace(UNMATCHED_SURROGATE_PAIR_REGEXP, UNMATCHED_SURROGATE_PAIR_REPLACE)
+    .replace(SURROGATE_REGEXP, function (_, pair) {
+      return pair || '\uFFFD'
+    })
     .replace(ENCODE_CHARS_REGEXP, encodeURI)
 }

package/node_modules/encodeurl/package.json

@@ -1,7 +1,7 @@
 {
   "name": "encodeurl",
   "description": "Encode a URL to a percent-encoded form, excluding already-encoded sequences",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>"
   ],
@@ -12,6 +12,10 @@
     "url"
   ],
   "repository": "pillarjs/encodeurl",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "devDependencies": {
     "eslint": "5.11.1",
     "eslint-config-standard": "12.0.0",
@@ -19,8 +23,8 @@
     "eslint-plugin-node": "7.0.1",
     "eslint-plugin-promise": "4.0.1",
     "eslint-plugin-standard": "4.0.0",
-    "istanbul": "0.4.5",
-    "mocha": "2.5.3"
+    "mocha": "~11.7.0",
+    "nyc": "~17.1.0"
   },
   "files": [
     "LICENSE",
@@ -33,8 +37,8 @@
   },
   "scripts": {
     "lint": "eslint .",
-    "test": "mocha --reporter spec --bail --check-leaks test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/"
+    "test": "mocha --check-leaks --reporter spec",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

package/node_modules/express-rate-limit/dist/index.cjs

@@ -182,7 +182,7 @@ var MemoryStore = class {
    */
   resetClient(client, now = Date.now()) {
     client.totalHits = 0;
-    client.resetTime.setTime(now + this.windowMs);
+    client.resetTime = new Date(now + this.windowMs);
     return client;
   }
   /**
@@ -931,7 +931,11 @@ var rateLimit = (passedOptions) => {
       try {
         const incrementResult = await config.store.increment(key);
         totalHits = incrementResult.totalHits;
-        resetTime = incrementResult.resetTime;
+        if (incrementResult.resetTime && (config.skipFailedRequests || config.skipSuccessfulRequests)) {
+          resetTime = new Date(incrementResult.resetTime.getTime());
+        } else {
+          resetTime = incrementResult.resetTime;
+        }
       } catch (error) {
         if (config.passOnStoreError) {
           config.logger.error(

package/node_modules/express-rate-limit/dist/index.mjs

@@ -139,7 +139,7 @@ var MemoryStore = class {
    */
   resetClient(client, now = Date.now()) {
     client.totalHits = 0;
-    client.resetTime.setTime(now + this.windowMs);
+    client.resetTime = new Date(now + this.windowMs);
     return client;
   }
   /**
@@ -888,7 +888,11 @@ var rateLimit = (passedOptions) => {
       try {
         const incrementResult = await config.store.increment(key);
         totalHits = incrementResult.totalHits;
-        resetTime = incrementResult.resetTime;
+        if (incrementResult.resetTime && (config.skipFailedRequests || config.skipSuccessfulRequests)) {
+          resetTime = new Date(incrementResult.resetTime.getTime());
+        } else {
+          resetTime = incrementResult.resetTime;
+        }
       } catch (error) {
         if (config.passOnStoreError) {
           config.logger.error(

package/node_modules/express-rate-limit/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "8.7.1",
+	"version": "8.7.2",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -86,25 +86,25 @@
 		"@biomejs/biome": "2.4.6",
 		"@express-rate-limit/prettier": "1.1.1",
 		"@express-rate-limit/tsconfig": "1.0.5",
-		"@jest/globals": "30.5.1",
+		"@jest/globals": "30.5.2",
 		"@types/debug": "4.1.13",
 		"@types/express": "5.0.6",
 		"@types/jest": "30.0.0",
-		"@types/node": "26.4.1",
+		"@types/node": "26.6.4",
 		"@types/supertest": "7.2.1",
 		"del-cli": "7.0.0",
 		"dts-bundle-generator": "8.1.2",
 		"esbuild": "0.28.2",
 		"express": "5.2.1",
 		"husky": "9.1.7",
-		"jest": "30.5.1",
-		"lint-staged": "17.4.1",
-		"mintlify": "4.2.874",
+		"jest": "30.5.2",
+		"lint-staged": "17.6.0",
+		"mintlify": "4.2.988",
 		"npm-run-all": "4.1.5",
-		"prettier": "3.9.6",
-		"ratelimit-header-parser": "0.1.0",
-		"supertest": "7.2.2",
-		"ts-jest": "29.4.12",
+		"prettier": "3.9.9",
+		"ratelimit-header-parser": "0.2.1",
+		"supertest": "7.3.1",
+		"ts-jest": "29.4.14",
 		"ts-node": "10.9.2",
 		"typescript": "5.9.3"
 	},

package/node_modules/qs/CHANGELOG.md

@@ -1,3 +1,12 @@
+## **6.17.1**
+- [Fix] `parse`: `interpretNumericEntities`: decode code points above U+FFFF as surrogate pairs (#640)
+- [Fix] `parse`: respect `plainObjects` for `[]` with `parseArrays: false` (#639)
+- [Fix] `utils`: `merge`: count the elements of a sparse array against `arrayLimit`, not its holes
+- [Fix] `parse`: guard bracket-wrapped prototype keys at depth 0 (#638)
+- [Refactor] `parse`: extract wrapping-bracket stripping helper
+- [readme] document that `depth: 0` and `depth: false` keep keys flat
+- [Tests] `parse`: pin depth-0 bracket stripping and prototype keys kept by `allowPrototypes`/`plainObjects`
+
 ## **6.17.0**
 - [New] `stringify`: add `WHATWG` format (#623)
 - [Fix] `stringify`: do not sort the caller's `filter` array in place (#637)
@@ -21,6 +30,12 @@
 - [Tests] `parse`: pin the behavior of a zero or negative `arrayLimit`
 - [Tests] `utils`/`stringify`: pin `~`, `*`, and parens encoding in RFC3986 and RFC1738
 
+## **6.16.2**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Dev Deps] update `evalmd`, `npmignore`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.16.1**
 - [Fix] `parse`: do not mutate an object input
 - [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
@@ -60,6 +75,12 @@
 - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
 - [Dev Deps] update `eslint`, `evalmd`
 
+## **6.15.4**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Dev Deps] update `@ljharb/eslint-config`, `evalmd`, `npmignore`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
 - [Fix] `utils`: respect encoding of surrogate pairs across chunks (#559)
@@ -91,6 +112,13 @@
 - [New] `parse`: add `strictMerge` option to wrap object/primitive conflicts in an array (#425, #122)
 - [Fix] `duplicates` option should not apply to bracket notation keys (#514)
 
+## **6.14.3**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `mock-property`, `npmignore`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.14.2**
 - [Fix] `parse`: mark overflow objects for indexed notation exceeding `arrayLimit` (#546)
 - [Fix] `arrayLimit` means max count, not max index, in `combine`/`merge`/`parseArrayValue`
@@ -123,6 +151,13 @@
 - [Dev Deps] update `es-value-fixtures`, `has-bigints`, `has-proto`, `has-symbols`
 - [Tests] increase coverage
 
+## **6.13.4**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use double quotes for better OS support
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `for-each`, `has-symbols`, `mock-property`, `npmignore`, `object-inspect`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.13.3**
 [Fix] fix regressions from robustness refactor
 [actions] update reusable workflows
@@ -150,6 +185,13 @@
 - [New] `parse`: add `strictDepth` option (#511)
 - [Tests] use `npm audit` instead of `aud`
 
+## **6.12.6**
+- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
+- [meta] use `npm audit` instead of `aud`
+- [Deps] update `side-channel`
+- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `for-each`, `has-symbols`, `mock-property`, `npmignore`, `object-inspect`, `tape`
+- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
+
 ## **6.12.5**
 - [Fix] fix regressions from robustness refactor
 - [actions] update reusable workflows

package/node_modules/qs/README.md

@@ -85,7 +85,9 @@ assert.deepEqual(qs.parse('foo[bar][baz]=foobarbaz'), {
 });
 ```
 
-Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently. Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1; see [#558](https://github.com/ljharb/qs/issues/558).
+Since v6.14.1 and v6.15.2, `parse` interprets nested bracket groups more consistently.
+Query strings with unbalanced `[`/`]` can produce different results than in 6.15.1;
+see [#558](https://github.com/ljharb/qs/issues/558).
 
 Because of that bracket grammar,
 **qs** does not agree with `URLSearchParams`,
@@ -132,6 +134,15 @@ var deep = qs.parse('a[b][c][d][e][f][g][h][i]=j', { depth: 1 });
 assert.deepEqual(deep, { a: { b: { '[c][d][e][f][g][h][i]': 'j' } } });
 ```
 
+Setting `depth` to `0` or `false` turns off nesting,
+so keys are never split into nested objects or arrays,
+whether or not their brackets are percent-encoded:
+
+```javascript
+assert.deepEqual(qs.parse('a[b][c]=d', { depth: 0 }), { 'a[b][c]': 'd' });
+assert.deepEqual(qs.parse('a%5Bb%5D=c', { depth: false }), { 'a[b]': 'c' });
+```
+
 You can configure **qs** to throw an error when parsing nested input beyond this depth using the `strictDepth` option (defaulted to false):
 
 ```javascript
@@ -143,16 +154,22 @@ try {
 }
 ```
 
-The depth limit helps mitigate abuse when **qs** is used to parse user input, and it is recommended to keep it a reasonably small number. The strictDepth option adds a layer of protection by throwing an error when the limit is exceeded, allowing you to catch and handle such cases.
+The depth limit helps mitigate abuse when **qs** is used to parse user input,
+and it is recommended to keep it a reasonably small number.
+The strictDepth option adds a layer of protection by throwing an error when the limit is exceeded,
+allowing you to catch and handle such cases.
 
-For similar reasons, by default **qs** will only parse up to 1000 parameters. This can be overridden by passing a `parameterLimit` option:
+For similar reasons, by default **qs** will only parse up to 1000 parameters.
+This can be overridden by passing a `parameterLimit` option:
 
 ```javascript
 var limited = qs.parse('a=b&c=d', { parameterLimit: 1 });
 assert.deepEqual(limited, { a: 'b' });
 ```
 
-If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`), set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want an error to be thrown whenever a limit is exceeded (eg, `parameterLimit`, `arrayLimit`),
+set the `throwOnLimitExceeded` option to `true`.
+This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a=1&b=2&c=3&d=4', { parameterLimit: 3, throwOnLimitExceeded: true });
@@ -164,7 +181,10 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `parameterLimit` and ignore the rest without throwing an error.
 
-Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into. In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain. Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
+Note that `parameterLimit` only bounds the number of `&`-delimited parameters; it does not limit how many values a single parameter expands into.
+In particular, when `comma: true` is enabled, a single parameter's value is split on commas into arbitrarily many elements, which `parameterLimit` does not constrain.
+Setting `throwOnLimitExceeded: true` (see `arrayLimit` below) makes **qs** reject a query string with more than `parameterLimit` parameters, one that uses an array index of `arrayLimit` or greater, or one that would produce any array longer than `arrayLimit`, including an array produced by comma splitting.
+`arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values across all parameters can still reach `parameterLimit` times `arrayLimit`, which is 20,000 at the default limits; always bound the input size at the transport layer as well (e.g. an HTTP body-size limit).
 
 To bypass the leading question mark, use `ignoreQueryPrefix`:
 
@@ -324,7 +344,8 @@ var withArrayLimit = qs.parse('a[1]=b', { arrayLimit: 0 });
 assert.deepEqual(withArrayLimit, { a: { '1': 'b' } });
 ```
 
-If you want to throw an error whenever the array limit is exceeded, set the `throwOnLimitExceeded` option to `true`. This option will generate a descriptive error if the query string exceeds a configured limit.
+If you want to throw an error whenever the array limit is exceeded, set the `throwOnLimitExceeded` option to `true`.
+This option will generate a descriptive error if the query string exceeds a configured limit.
 ```javascript
 try {
     qs.parse('a[1]=b', { arrayLimit: 0, throwOnLimitExceeded: true });
@@ -336,7 +357,11 @@ try {
 
 When `throwOnLimitExceeded` is set to `false` (default), **qs** will parse up to the specified `arrayLimit` and if the limit is exceeded, the array will instead be converted to an object with the index as the key.
 
-Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed. With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input). This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`. If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`. `throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
+Note that `arrayLimit` is a *representation* threshold that controls when a numerically-indexed collection switches from an array to an object; it is **not** a hard cap on the total number of elements parsed.
+With the default `throwOnLimitExceeded: false`, exceeding `arrayLimit` never rejects or truncates input; it only changes the container type, and the resulting object still holds every element (so its size stays proportional to the input).
+This conversion is itself a safeguard: it avoids allocating a huge sparse array for input like `a[999999999]`.
+If you need a hard limit that rejects oversized arrays in untrusted query strings, set `throwOnLimitExceeded: true`.
+`throwOnLimitExceeded` still limits each array separately, not the total: with `comma: true`, each comma-separated group under `a[]=` counts as one element of the outer array, and can itself hold up to `arrayLimit` elements.
 
 To prevent array syntax (`a[]`, `a[0]`) from being parsed as arrays, set `parseArrays` to `false`.
 Note that duplicate keys (e.g. `a=b&a=c`) may still produce arrays when `duplicates` is `'combine'` (the default).
@@ -408,7 +433,8 @@ If you wish to auto-convert values which look like numbers, booleans, and other
 qs.stringify(object, [options]);
 ```
 
-When stringifying, **qs** by default URI encodes output. Objects are stringified as you would expect:
+When stringifying, **qs** by default URI encodes output.
+Objects are stringified as you would expect:
 
 ```javascript
 assert.equal(qs.stringify({ a: 'b' }), 'a=b');
@@ -704,7 +730,8 @@ var equalsInsensitive = qs.parse('a&b=');
 assert.deepEqual(equalsInsensitive, { a: '', b: '' });
 ```
 
-To distinguish between `null` values and empty strings use the `strictNullHandling` flag. In the result string the `null`
+To distinguish between `null` values and empty strings use the `strictNullHandling` flag.
+In the result string the `null`
 values have no `=` sign:
 
 ```javascript
@@ -792,7 +819,8 @@ It only affects encoding; how `null`, dates, arrays, and objects are serialized
 assert.equal(qs.stringify({ a: 'b c~*()' }, { format: 'WHATWG' }), 'a=b+c%7E*%28%29');
 ```
 
-_(Note: the `WHATWG` format matches `URLSearchParams` encoding only with the default `utf-8` charset, and only when keys are encoded too, so not with `encodeValuesOnly`. With `charset: 'iso-8859-1'`, every format uses the same `escape`-based encoding, which leaves characters like `@` and `/` unencoded; only the space handling differs)_
+_(Note: the `WHATWG` format matches `URLSearchParams` encoding only with the default `utf-8` charset, and only when keys are encoded too, so not with `encodeValuesOnly`.
+With `charset: 'iso-8859-1'`, every format uses the same `escape`-based encoding, which leaves characters like `@` and `/` unencoded; only the space handling differs)_
 
 ## Security