qs 6.8.3 → 6.9.0

package/.editorconfig

@@ -8,7 +8,6 @@ charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 max_line_length = 160
-quote_type = single
 
 [test/*]
 max_line_length = off

package/.eslintignore

@@ -0,0 +1 @@
+dist

package/.eslintrc

@@ -3,14 +3,10 @@
 
     "extends": "@ljharb",
 
-    "ignorePatterns": [
-        "dist/",
-    ],
-
     "rules": {
         "complexity": 0,
         "consistent-return": 1,
-        "func-name-matching": 0,
+		"func-name-matching": 0,
         "id-length": [2, { "min": 1, "max": 25, "properties": "never" }],
         "indent": [2, 4],
         "max-lines-per-function": [2, { "max": 150 }],
@@ -20,17 +16,6 @@
         "no-continue": 1,
         "no-magic-numbers": 0,
         "no-restricted-syntax": [2, "BreakStatement", "DebuggerStatement", "ForInStatement", "LabeledStatement", "WithStatement"],
-    },
-
-    "overrides": [
-        {
-            "files": "test/**",
-            "rules": {
-                "function-paren-newline": 0,
-                "max-lines-per-function": 0,
-                "max-statements": 0,
-                "no-extend-native": 0,
-            },
-        },
-    ],
+        "operator-linebreak": [2, "before"],
+    }
 }

package/CHANGELOG.md

@@ -1,32 +1,10 @@
-## **6.8.3**
-- [Fix] `parse`: ignore `__proto__` keys (#428)
-- [Robustness] `stringify`: avoid relying on a global `undefined` (#427)
-- [Fix] `stringify`: avoid encoding arrayformat comma when `encodeValuesOnly = true` (#424)
-- [readme] remove travis badge; add github actions/codecov badges; update URLs
-- [Tests] clean up stringify tests slightly
-- [Docs] add note and links for coercing primitive values (#408)
-- [meta] fix README.md (#399)
-- [actions] backport actions from main
-- [Dev Deps] backport updates from main
-- [Refactor] `stringify`: reduce branching
-- [meta] do not publish workflow files
-
-## **6.8.2**
-- [Fix] proper comma parsing of URL-encoded commas (#361)
-- [Fix] parses comma delimited array while having percent-encoded comma treated as normal text (#336)
-
-## **6.8.1**
-- [Fix] `parse`: Fix parsing array from object with `comma` true (#359)
-- [Fix] `parse`: throw a TypeError instead of an Error for bad charset (#349)
-- [Fix] `parse`: with comma true, handle field that holds an array of arrays (#335)
-- [fix] `parse`: with comma true, do not split non-string values (#334)
-- [meta] add tidelift marketing copy
-- [meta] add `funding` field
-- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `tape`, `safe-publish-latest`, `evalmd`, `has-symbols`, `iconv-lite`, `mkdirp`, `object-inspect`
+## **6.9.0**
+- [New] `parse`/`stringify`: Pass extra key/value argument to `decoder` (#333)
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `evalmd`
 - [Tests] `parse`: add passing `arrayFormat` tests
-- [Tests] use shared travis-ci configs
+- [Tests] add `posttest` using `npx aud` to run `npm audit` without a lockfile
+- [Tests] up to `node` `v12.10`, `v11.15`, `v10.16`, `v8.16`
 - [Tests] `Buffer.from` in node v5.0-v5.9 and v4.0-v4.4 requires a TypedArray
-- [actions] add automatic rebasing / merge commit blocking
 
 ## **6.8.0**
 - [New] add `depth=false` to preserve the original key; [Fix] `depth=0` should preserve the original key (#326)

package/README.md

@@ -1,13 +1,12 @@
 # qs <sup>[![Version Badge][2]][1]</sup>
 
-[![github actions][actions-image]][actions-url]
-[![coverage][codecov-image]][codecov-url]
-[![dependency status][deps-svg]][deps-url]
-[![dev dependency status][dev-deps-svg]][dev-deps-url]
+[![Build Status][3]][4]
+[![dependency status][5]][6]
+[![dev dependency status][7]][8]
 [![License][license-image]][license-url]
 [![Downloads][downloads-image]][downloads-url]
 
-[![npm badge][npm-badge-png]][package-url]
+[![npm badge][11]][1]
 
 A querystring parsing and stringifying library with some added security.
 
@@ -281,17 +280,6 @@ assert.deepEqual(arraysOfObjects, { a: ['b', 'c'] })
 ```
 (_this cannot convert nested objects, such as `a={b:1},{c:d}`_)
 
-### Parsing primitive/scalar values (numbers, booleans, null, etc)
-
-By default, all values are parsed as strings. This behavior will not change and is explained in [issue #91](https://github.com/ljharb/qs/issues/91).
-
-```javascript
-var primitiveValues = qs.parse('a=15&b=true&c=null');
-assert.deepEqual(primitiveValues, { a: '15', b: 'true', c: 'null' });
-```
-
-If you wish to auto-convert values which look like numbers, booleans, and other values into their primitive counterparts, you can use the [query-types Express JS middleware](https://github.com/xpepermint/query-types) which will auto-convert all request query parameters.
-
 ### Stringifying
 
 [](#preventEval)
@@ -357,7 +345,7 @@ var encoded = qs.stringify({ a: { b: 'c' } }, { encoder: function (str, defaultE
 The type argument is also provided to the decoder:
 
 ```javascript
-var decoded = qs.parse('x=z', { decoder: function (str, defaultDecoder, charset, type) {
+var decoded = qs.parse('x=z', { decoder: function (str, defaultEncoder, charset, type) {
     if (type === 'key') {
         return // Decoded key
     } else if (type === 'value') {
@@ -593,24 +581,18 @@ assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC1738' }), 'a=b+c');
 
 Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report.
 
-## qs for enterprise
-
-Available as part of the Tidelift Subscription
-
-The maintainers of qs and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. [Learn more.](https://tidelift.com/subscription/pkg/npm-qs?utm_source=npm-qs&utm_medium=referral&utm_campaign=enterprise&utm_term=repo)
-
-[package-url]: https://npmjs.org/package/qs
-[npm-version-svg]: https://versionbadg.es/ljharb/qs.svg
-[deps-svg]: https://david-dm.org/ljharb/qs.svg
-[deps-url]: https://david-dm.org/ljharb/qs
-[dev-deps-svg]: https://david-dm.org/ljharb/qs/dev-status.svg
-[dev-deps-url]: https://david-dm.org/ljharb/qs#info=devDependencies
-[npm-badge-png]: https://nodei.co/npm/qs.png?downloads=true&stars=true
-[license-image]: https://img.shields.io/npm/l/qs.svg
+[1]: https://npmjs.org/package/qs
+[2]: http://versionbadg.es/ljharb/qs.svg
+[3]: https://api.travis-ci.org/ljharb/qs.svg
+[4]: https://travis-ci.org/ljharb/qs
+[5]: https://david-dm.org/ljharb/qs.svg
+[6]: https://david-dm.org/ljharb/qs
+[7]: https://david-dm.org/ljharb/qs/dev-status.svg
+[8]: https://david-dm.org/ljharb/qs?type=dev
+[9]: https://ci.testling.com/ljharb/qs.png
+[10]: https://ci.testling.com/ljharb/qs
+[11]: https://nodei.co/npm/qs.png?downloads=true&stars=true
+[license-image]: http://img.shields.io/npm/l/qs.svg
 [license-url]: LICENSE
-[downloads-image]: https://img.shields.io/npm/dm/qs.svg
-[downloads-url]: https://npm-stat.com/charts.html?package=qs
-[codecov-image]: https://codecov.io/gh/ljharb/qs/branch/main/graphs/badge.svg
-[codecov-url]: https://app.codecov.io/gh/ljharb/qs/
-[actions-image]: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/qs
-[actions-url]: https://github.com/ljharb/qs/actions
+[downloads-image]: http://img.shields.io/npm/dm/qs.svg
+[downloads-url]: http://npm-stat.com/charts.html?package=qs

package/dist/qs.js

@@ -45,7 +45,6 @@ module.exports = {
 var utils = require('./utils');
 
 var has = Object.prototype.hasOwnProperty;
-var isArray = Array.isArray;
 
 var defaults = {
     allowDots: false,
@@ -71,25 +70,6 @@ var interpretNumericEntities = function (str) {
     });
 };
 
-var parseArrayValue = function (val, options) {
-    if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
-        return val.split(',');
-    }
-
-    return val;
-};
-
-var maybeMap = function maybeMap(val, fn) {
-    if (isArray(val)) {
-        var mapped = [];
-        for (var i = 0; i < val.length; i += 1) {
-            mapped.push(fn(val[i]));
-        }
-        return mapped;
-    }
-    return fn(val);
-};
-
 // This is what browsers will submit when the ✓ character occurs in an
 // application/x-www-form-urlencoded body and the encoding of the page containing
 // the form is iso-8859-1, or when the submitted form has an accept-charset
@@ -134,24 +114,19 @@ var parseValues = function parseQueryStringValues(str, options) {
 
         var key, val;
         if (pos === -1) {
-            key = options.decoder(part, defaults.decoder, charset);
+            key = options.decoder(part, defaults.decoder, charset, 'key');
             val = options.strictNullHandling ? null : '';
         } else {
-            key = options.decoder(part.slice(0, pos), defaults.decoder, charset);
-            val = maybeMap(
-                parseArrayValue(part.slice(pos + 1), options),
-                function (encodedVal) {
-                    return options.decoder(encodedVal, defaults.decoder, charset);
-                }
-            );
+            key = options.decoder(part.slice(0, pos), defaults.decoder, charset, 'key');
+            val = options.decoder(part.slice(pos + 1), defaults.decoder, charset, 'value');
         }
 
         if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
             val = interpretNumericEntities(val);
         }
 
-        if (part.indexOf('[]=') > -1) {
-            val = isArray(val) ? [val] : val;
+        if (val && options.comma && val.indexOf(',') > -1) {
+            val = val.split(',');
         }
 
         if (has.call(obj, key)) {
@@ -164,8 +139,8 @@ var parseValues = function parseQueryStringValues(str, options) {
     return obj;
 };
 
-var parseObject = function (chain, val, options, valuesParsed) {
-    var leaf = valuesParsed ? val : parseArrayValue(val, options);
+var parseObject = function (chain, val, options) {
+    var leaf = val;
 
     for (var i = chain.length - 1; i >= 0; --i) {
         var obj;
@@ -188,7 +163,7 @@ var parseObject = function (chain, val, options, valuesParsed) {
             ) {
                 obj = [];
                 obj[index] = leaf;
-            } else if (cleanRoot !== '__proto__') {
+            } else {
                 obj[cleanRoot] = leaf;
             }
         }
@@ -199,7 +174,7 @@ var parseObject = function (chain, val, options, valuesParsed) {
     return leaf;
 };
 
-var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
+var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
     if (!givenKey) {
         return;
     }
@@ -250,7 +225,7 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesPars
         keys.push('[' + key.slice(segment.index) + ']');
     }
 
-    return parseObject(keys, val, options, valuesParsed);
+    return parseObject(keys, val, options);
 };
 
 var normalizeParseOptions = function normalizeParseOptions(opts) {
@@ -263,7 +238,7 @@ var normalizeParseOptions = function normalizeParseOptions(opts) {
     }
 
     if (typeof opts.charset !== 'undefined' && opts.charset !== 'utf-8' && opts.charset !== 'iso-8859-1') {
-        throw new TypeError('The charset option must be either utf-8, iso-8859-1, or undefined');
+        throw new Error('The charset option must be either utf-8, iso-8859-1, or undefined');
     }
     var charset = typeof opts.charset === 'undefined' ? defaults.charset : opts.charset;
 
@@ -302,7 +277,7 @@ module.exports = function (str, opts) {
     var keys = Object.keys(tempObj);
     for (var i = 0; i < keys.length; ++i) {
         var key = keys[i];
-        var newObj = parseKeys(key, tempObj[key], options, typeof str === 'string');
+        var newObj = parseKeys(key, tempObj[key], options);
         obj = utils.merge(obj, newObj, options);
     }
 
@@ -330,7 +305,6 @@ var arrayPrefixGenerators = {
 };
 
 var isArray = Array.isArray;
-var split = String.prototype.split;
 var push = Array.prototype.push;
 var pushToArray = function (arr, valueOrArray) {
     push.apply(arr, isArray(valueOrArray) ? valueOrArray : [valueOrArray]);
@@ -393,7 +367,7 @@ var stringify = function stringify(
 
     if (obj === null) {
         if (strictNullHandling) {
-            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset) : prefix;
+            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, 'key') : prefix;
         }
 
         obj = '';
@@ -401,16 +375,8 @@ var stringify = function stringify(
 
     if (isNonNullishPrimitive(obj) || utils.isBuffer(obj)) {
         if (encoder) {
-            var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset);
-            if (generateArrayPrefix === 'comma' && encodeValuesOnly) {
-                var valuesArray = split.call(String(obj), ',');
-                var valuesJoined = '';
-                for (var i = 0; i < valuesArray.length; ++i) {
-                    valuesJoined += (i === 0 ? '' : ',') + formatter(encoder(valuesArray[i], defaults.encoder, charset));
-                }
-                return [formatter(keyValue) + '=' + valuesJoined];
-            }
-            return [formatter(keyValue) + '=' + formatter(encoder(obj, defaults.encoder, charset))];
+            var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset, 'key');
+            return [formatter(keyValue) + '=' + formatter(encoder(obj, defaults.encoder, charset, 'value'))];
         }
         return [formatter(prefix) + '=' + formatter(String(obj))];
     }
@@ -429,33 +395,46 @@ var stringify = function stringify(
         objKeys = sort ? keys.sort(sort) : keys;
     }
 
-    for (var j = 0; j < objKeys.length; ++j) {
-        var key = objKeys[j];
-        var value = typeof key === 'object' && typeof key.value !== 'undefined' ? key.value : obj[key];
+    for (var i = 0; i < objKeys.length; ++i) {
+        var key = objKeys[i];
 
-        if (skipNulls && value === null) {
+        if (skipNulls && obj[key] === null) {
             continue;
         }
 
-        var keyPrefix = isArray(obj)
-            ? typeof generateArrayPrefix === 'function' ? generateArrayPrefix(prefix, key) : prefix
-            : prefix + (allowDots ? '.' + key : '[' + key + ']');
-
-        pushToArray(values, stringify(
-            value,
-            keyPrefix,
-            generateArrayPrefix,
-            strictNullHandling,
-            skipNulls,
-            encoder,
-            filter,
-            sort,
-            allowDots,
-            serializeDate,
-            formatter,
-            encodeValuesOnly,
-            charset
-        ));
+        if (isArray(obj)) {
+            pushToArray(values, stringify(
+                obj[key],
+                typeof generateArrayPrefix === 'function' ? generateArrayPrefix(prefix, key) : prefix,
+                generateArrayPrefix,
+                strictNullHandling,
+                skipNulls,
+                encoder,
+                filter,
+                sort,
+                allowDots,
+                serializeDate,
+                formatter,
+                encodeValuesOnly,
+                charset
+            ));
+        } else {
+            pushToArray(values, stringify(
+                obj[key],
+                prefix + (allowDots ? '.' + key : '[' + key + ']'),
+                generateArrayPrefix,
+                strictNullHandling,
+                skipNulls,
+                encoder,
+                filter,
+                sort,
+                allowDots,
+                serializeDate,
+                formatter,
+                encodeValuesOnly,
+                charset
+            ));
+        }
     }
 
     return values;
@@ -466,7 +445,7 @@ var normalizeStringifyOptions = function normalizeStringifyOptions(opts) {
         return defaults;
     }
 
-    if (opts.encoder !== null && typeof opts.encoder !== 'undefined' && typeof opts.encoder !== 'function') {
+    if (opts.encoder !== null && opts.encoder !== undefined && typeof opts.encoder !== 'function') {
         throw new TypeError('Encoder has to be a function.');
     }
 
@@ -641,7 +620,7 @@ var merge = function merge(target, source, options) {
             target.push(source);
         } else if (target && typeof target === 'object') {
             if ((options && (options.plainObjects || options.allowPrototypes)) || !has.call(Object.prototype, source)) {
-                target[source] = true; // eslint-disable-line no-param-reassign
+                target[source] = true;
             }
         } else {
             return [target, source];
@@ -664,12 +643,12 @@ var merge = function merge(target, source, options) {
             if (has.call(target, i)) {
                 var targetItem = target[i];
                 if (targetItem && typeof targetItem === 'object' && item && typeof item === 'object') {
-                    target[i] = merge(targetItem, item, options); // eslint-disable-line no-param-reassign
+                    target[i] = merge(targetItem, item, options);
                 } else {
                     target.push(item);
                 }
             } else {
-                target[i] = item; // eslint-disable-line no-param-reassign
+                target[i] = item;
             }
         });
         return target;
@@ -679,9 +658,9 @@ var merge = function merge(target, source, options) {
         var value = source[key];
 
         if (has.call(acc, key)) {
-            acc[key] = merge(acc[key], value, options); // eslint-disable-line no-param-reassign
+            acc[key] = merge(acc[key], value, options);
         } else {
-            acc[key] = value; // eslint-disable-line no-param-reassign
+            acc[key] = value;
         }
         return acc;
     }, mergeTarget);
@@ -689,7 +668,7 @@ var merge = function merge(target, source, options) {
 
 var assign = function assignSingleSource(target, source) {
     return Object.keys(source).reduce(function (acc, key) {
-        acc[key] = source[key]; // eslint-disable-line no-param-reassign
+        acc[key] = source[key];
         return acc;
     }, target);
 };
@@ -762,7 +741,6 @@ var encode = function encode(str, defaultEncoder, charset) {
 
         i += 1;
         c = 0x10000 + (((c & 0x3FF) << 10) | (string.charCodeAt(i) & 0x3FF));
-        /* eslint operator-linebreak: [2, "before"] */
         out += hexTable[0xF0 | (c >> 18)]
             + hexTable[0x80 | ((c >> 12) & 0x3F)]
             + hexTable[0x80 | ((c >> 6) & 0x3F)]

package/lib/parse.js

@@ -3,7 +3,6 @@
 var utils = require('./utils');
 
 var has = Object.prototype.hasOwnProperty;
-var isArray = Array.isArray;
 
 var defaults = {
     allowDots: false,
@@ -29,25 +28,6 @@ var interpretNumericEntities = function (str) {
     });
 };
 
-var parseArrayValue = function (val, options) {
-    if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
-        return val.split(',');
-    }
-
-    return val;
-};
-
-var maybeMap = function maybeMap(val, fn) {
-    if (isArray(val)) {
-        var mapped = [];
-        for (var i = 0; i < val.length; i += 1) {
-            mapped.push(fn(val[i]));
-        }
-        return mapped;
-    }
-    return fn(val);
-};
-
 // This is what browsers will submit when the ✓ character occurs in an
 // application/x-www-form-urlencoded body and the encoding of the page containing
 // the form is iso-8859-1, or when the submitted form has an accept-charset
@@ -92,24 +72,19 @@ var parseValues = function parseQueryStringValues(str, options) {
 
         var key, val;
         if (pos === -1) {
-            key = options.decoder(part, defaults.decoder, charset);
+            key = options.decoder(part, defaults.decoder, charset, 'key');
             val = options.strictNullHandling ? null : '';
         } else {
-            key = options.decoder(part.slice(0, pos), defaults.decoder, charset);
-            val = maybeMap(
-                parseArrayValue(part.slice(pos + 1), options),
-                function (encodedVal) {
-                    return options.decoder(encodedVal, defaults.decoder, charset);
-                }
-            );
+            key = options.decoder(part.slice(0, pos), defaults.decoder, charset, 'key');
+            val = options.decoder(part.slice(pos + 1), defaults.decoder, charset, 'value');
         }
 
         if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
             val = interpretNumericEntities(val);
         }
 
-        if (part.indexOf('[]=') > -1) {
-            val = isArray(val) ? [val] : val;
+        if (val && options.comma && val.indexOf(',') > -1) {
+            val = val.split(',');
         }
 
         if (has.call(obj, key)) {
@@ -122,8 +97,8 @@ var parseValues = function parseQueryStringValues(str, options) {
     return obj;
 };
 
-var parseObject = function (chain, val, options, valuesParsed) {
-    var leaf = valuesParsed ? val : parseArrayValue(val, options);
+var parseObject = function (chain, val, options) {
+    var leaf = val;
 
     for (var i = chain.length - 1; i >= 0; --i) {
         var obj;
@@ -146,7 +121,7 @@ var parseObject = function (chain, val, options, valuesParsed) {
             ) {
                 obj = [];
                 obj[index] = leaf;
-            } else if (cleanRoot !== '__proto__') {
+            } else {
                 obj[cleanRoot] = leaf;
             }
         }
@@ -157,7 +132,7 @@ var parseObject = function (chain, val, options, valuesParsed) {
     return leaf;
 };
 
-var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
+var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
     if (!givenKey) {
         return;
     }
@@ -208,7 +183,7 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesPars
         keys.push('[' + key.slice(segment.index) + ']');
     }
 
-    return parseObject(keys, val, options, valuesParsed);
+    return parseObject(keys, val, options);
 };
 
 var normalizeParseOptions = function normalizeParseOptions(opts) {
@@ -221,7 +196,7 @@ var normalizeParseOptions = function normalizeParseOptions(opts) {
     }
 
     if (typeof opts.charset !== 'undefined' && opts.charset !== 'utf-8' && opts.charset !== 'iso-8859-1') {
-        throw new TypeError('The charset option must be either utf-8, iso-8859-1, or undefined');
+        throw new Error('The charset option must be either utf-8, iso-8859-1, or undefined');
     }
     var charset = typeof opts.charset === 'undefined' ? defaults.charset : opts.charset;
 
@@ -260,7 +235,7 @@ module.exports = function (str, opts) {
     var keys = Object.keys(tempObj);
     for (var i = 0; i < keys.length; ++i) {
         var key = keys[i];
-        var newObj = parseKeys(key, tempObj[key], options, typeof str === 'string');
+        var newObj = parseKeys(key, tempObj[key], options);
         obj = utils.merge(obj, newObj, options);
     }
 

package/lib/stringify.js

@@ -18,7 +18,6 @@ var arrayPrefixGenerators = {
 };
 
 var isArray = Array.isArray;
-var split = String.prototype.split;
 var push = Array.prototype.push;
 var pushToArray = function (arr, valueOrArray) {
     push.apply(arr, isArray(valueOrArray) ? valueOrArray : [valueOrArray]);
@@ -81,7 +80,7 @@ var stringify = function stringify(
 
     if (obj === null) {
         if (strictNullHandling) {
-            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset) : prefix;
+            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, 'key') : prefix;
         }
 
         obj = '';
@@ -89,16 +88,8 @@ var stringify = function stringify(
 
     if (isNonNullishPrimitive(obj) || utils.isBuffer(obj)) {
         if (encoder) {
-            var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset);
-            if (generateArrayPrefix === 'comma' && encodeValuesOnly) {
-                var valuesArray = split.call(String(obj), ',');
-                var valuesJoined = '';
-                for (var i = 0; i < valuesArray.length; ++i) {
-                    valuesJoined += (i === 0 ? '' : ',') + formatter(encoder(valuesArray[i], defaults.encoder, charset));
-                }
-                return [formatter(keyValue) + '=' + valuesJoined];
-            }
-            return [formatter(keyValue) + '=' + formatter(encoder(obj, defaults.encoder, charset))];
+            var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset, 'key');
+            return [formatter(keyValue) + '=' + formatter(encoder(obj, defaults.encoder, charset, 'value'))];
         }
         return [formatter(prefix) + '=' + formatter(String(obj))];
     }
@@ -117,33 +108,46 @@ var stringify = function stringify(
         objKeys = sort ? keys.sort(sort) : keys;
     }
 
-    for (var j = 0; j < objKeys.length; ++j) {
-        var key = objKeys[j];
-        var value = typeof key === 'object' && typeof key.value !== 'undefined' ? key.value : obj[key];
+    for (var i = 0; i < objKeys.length; ++i) {
+        var key = objKeys[i];
 
-        if (skipNulls && value === null) {
+        if (skipNulls && obj[key] === null) {
             continue;
         }
 
-        var keyPrefix = isArray(obj)
-            ? typeof generateArrayPrefix === 'function' ? generateArrayPrefix(prefix, key) : prefix
-            : prefix + (allowDots ? '.' + key : '[' + key + ']');
-
-        pushToArray(values, stringify(
-            value,
-            keyPrefix,
-            generateArrayPrefix,
-            strictNullHandling,
-            skipNulls,
-            encoder,
-            filter,
-            sort,
-            allowDots,
-            serializeDate,
-            formatter,
-            encodeValuesOnly,
-            charset
-        ));
+        if (isArray(obj)) {
+            pushToArray(values, stringify(
+                obj[key],
+                typeof generateArrayPrefix === 'function' ? generateArrayPrefix(prefix, key) : prefix,
+                generateArrayPrefix,
+                strictNullHandling,
+                skipNulls,
+                encoder,
+                filter,
+                sort,
+                allowDots,
+                serializeDate,
+                formatter,
+                encodeValuesOnly,
+                charset
+            ));
+        } else {
+            pushToArray(values, stringify(
+                obj[key],
+                prefix + (allowDots ? '.' + key : '[' + key + ']'),
+                generateArrayPrefix,
+                strictNullHandling,
+                skipNulls,
+                encoder,
+                filter,
+                sort,
+                allowDots,
+                serializeDate,
+                formatter,
+                encodeValuesOnly,
+                charset
+            ));
+        }
     }
 
     return values;
@@ -154,7 +158,7 @@ var normalizeStringifyOptions = function normalizeStringifyOptions(opts) {
         return defaults;
     }
 
-    if (opts.encoder !== null && typeof opts.encoder !== 'undefined' && typeof opts.encoder !== 'function') {
+    if (opts.encoder !== null && opts.encoder !== undefined && typeof opts.encoder !== 'function') {
         throw new TypeError('Encoder has to be a function.');
     }
 

package/lib/utils.js

@@ -52,7 +52,7 @@ var merge = function merge(target, source, options) {
             target.push(source);
         } else if (target && typeof target === 'object') {
             if ((options && (options.plainObjects || options.allowPrototypes)) || !has.call(Object.prototype, source)) {
-                target[source] = true; // eslint-disable-line no-param-reassign
+                target[source] = true;
             }
         } else {
             return [target, source];
@@ -75,12 +75,12 @@ var merge = function merge(target, source, options) {
             if (has.call(target, i)) {
                 var targetItem = target[i];
                 if (targetItem && typeof targetItem === 'object' && item && typeof item === 'object') {
-                    target[i] = merge(targetItem, item, options); // eslint-disable-line no-param-reassign
+                    target[i] = merge(targetItem, item, options);
                 } else {
                     target.push(item);
                 }
             } else {
-                target[i] = item; // eslint-disable-line no-param-reassign
+                target[i] = item;
             }
         });
         return target;
@@ -90,9 +90,9 @@ var merge = function merge(target, source, options) {
         var value = source[key];
 
         if (has.call(acc, key)) {
-            acc[key] = merge(acc[key], value, options); // eslint-disable-line no-param-reassign
+            acc[key] = merge(acc[key], value, options);
         } else {
-            acc[key] = value; // eslint-disable-line no-param-reassign
+            acc[key] = value;
         }
         return acc;
     }, mergeTarget);
@@ -100,7 +100,7 @@ var merge = function merge(target, source, options) {
 
 var assign = function assignSingleSource(target, source) {
     return Object.keys(source).reduce(function (acc, key) {
-        acc[key] = source[key]; // eslint-disable-line no-param-reassign
+        acc[key] = source[key];
         return acc;
     }, target);
 };
@@ -173,7 +173,6 @@ var encode = function encode(str, defaultEncoder, charset) {
 
         i += 1;
         c = 0x10000 + (((c & 0x3FF) << 10) | (string.charCodeAt(i) & 0x3FF));
-        /* eslint operator-linebreak: [2, "before"] */
         out += hexTable[0xF0 | (c >> 18)]
             + hexTable[0x80 | ((c >> 12) & 0x3F)]
             + hexTable[0x80 | ((c >> 6) & 0x3F)]

package/package.json

@@ -2,14 +2,11 @@
     "name": "qs",
     "description": "A querystring parser that supports nesting and arrays, with a depth limit",
     "homepage": "https://github.com/ljharb/qs",
-    "version": "6.8.3",
+    "version": "6.9.0",
     "repository": {
         "type": "git",
         "url": "https://github.com/ljharb/qs.git"
     },
-    "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-    },
     "main": "lib/index.js",
     "contributors": [
         {
@@ -29,34 +26,33 @@
     "engines": {
         "node": ">=0.6"
     },
+    "dependencies": {},
     "devDependencies": {
-        "@ljharb/eslint-config": "^20.1.0",
-        "browserify": "^16.5.2",
+        "@ljharb/eslint-config": "^14.1.0",
+        "browserify": "^16.5.0",
         "covert": "^1.1.1",
         "eclint": "^2.8.1",
-        "eslint": "^8.6.0",
+        "eslint": "^6.4.0",
         "evalmd": "^0.0.19",
         "for-each": "^0.3.3",
-        "has-symbols": "^1.0.2",
-        "iconv-lite": "^0.5.1",
-        "in-publish": "^2.0.1",
-        "mkdirp": "^0.5.4",
-        "object-inspect": "^1.12.0",
+        "has-symbols": "^1.0.0",
+        "iconv-lite": "^0.4.24",
+        "mkdirp": "^0.5.1",
+        "object-inspect": "^1.6.0",
         "qs-iconv": "^1.0.4",
-        "safe-publish-latest": "^2.0.0",
+        "safe-publish-latest": "^1.1.3",
         "safer-buffer": "^2.1.2",
-        "tape": "^5.4.0"
+        "tape": "^4.11.0"
     },
     "scripts": {
-        "prepublishOnly": "safe-publish-latest && npm run dist",
-        "prepublish": "not-in-publish || npm run prepublishOnly",
+        "prepublish": "safe-publish-latest && npm run dist",
         "pretest": "npm run --silent readme && npm run --silent lint",
         "test": "npm run --silent coverage",
         "tests-only": "node test",
-        "posttest": "npx aud --production",
+        "posttest": "npx aud",
         "readme": "evalmd README.md",
-        "postlint": "eclint check * lib/* test/* !dist/* '!coverage/**' '.nyc_output/**'",
-        "lint": "eslint .",
+        "postlint": "eclint check * lib/* test/*",
+        "lint": "eslint lib/*.js test/*.js",
         "coverage": "covert test",
         "dist": "mkdirp dist && browserify --standalone Qs lib/index.js > dist/qs.js"
     },

package/test/.eslintrc

@@ -0,0 +1,18 @@
+{
+    "rules": {
+        "array-bracket-newline": 0,
+        "array-element-newline": 0,
+        "consistent-return": 2,
+        "function-paren-newline": 0,
+        "max-lines": 0,
+        "max-lines-per-function": 0,
+        "max-nested-callbacks": [2, 3],
+        "max-statements": 0,
+        "no-buffer-constructor": 0,
+        "no-extend-native": 0,
+        "no-magic-numbers": 0,
+        "no-throw-literal": 0,
+        "object-curly-newline": 0,
+        "sort-keys": 0,
+    }
+}

package/test/parse.js

@@ -400,43 +400,6 @@ test('parse()', function (t) {
         st.end();
     });
 
-    t.test('parses values with comma as array divider', function (st) {
-        st.deepEqual(qs.parse({ foo: 'bar,tee' }, { comma: false }), { foo: 'bar,tee' });
-        st.deepEqual(qs.parse({ foo: 'bar,tee' }, { comma: true }), { foo: ['bar', 'tee'] });
-        st.end();
-    });
-
-    t.test('use number decoder, parses string that has one number with comma option enabled', function (st) {
-        var decoder = function (str, defaultDecoder, charset, type) {
-            if (!isNaN(Number(str))) {
-                return parseFloat(str);
-            }
-            return defaultDecoder(str, defaultDecoder, charset, type);
-        };
-
-        st.deepEqual(qs.parse('foo=1', { comma: true, decoder: decoder }), { foo: 1 });
-        st.deepEqual(qs.parse('foo=0', { comma: true, decoder: decoder }), { foo: 0 });
-
-        st.end();
-    });
-
-    t.test('parses brackets holds array of arrays when having two parts of strings with comma as array divider', function (st) {
-        st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=4,5,6', { comma: true }), { foo: [['1', '2', '3'], ['4', '5', '6']] });
-        st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=', { comma: true }), { foo: [['1', '2', '3'], ''] });
-        st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=,', { comma: true }), { foo: [['1', '2', '3'], ['', '']] });
-        st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=a', { comma: true }), { foo: [['1', '2', '3'], 'a'] });
-
-        st.end();
-    });
-
-    t.test('parses comma delimited array while having percent-encoded comma treated as normal text', function (st) {
-        st.deepEqual(qs.parse('foo=a%2Cb', { comma: true }), { foo: 'a,b' });
-        st.deepEqual(qs.parse('foo=a%2C%20b,d', { comma: true }), { foo: ['a, b', 'd'] });
-        st.deepEqual(qs.parse('foo=a%2C%20b,c%2C%20d', { comma: true }), { foo: ['a, b', 'c, d'] });
-
-        st.end();
-    });
-
     t.test('parses an object in dot notation', function (st) {
         var input = {
             'user.name': { 'pop[bob]': 3 },
@@ -613,73 +576,13 @@ test('parse()', function (t) {
 
         st.deepEqual(
             qs.parse('a[b]=c&a=toString', { plainObjects: true }),
-            { __proto__: null, a: { __proto__: null, b: 'c', toString: true } },
+            { a: { b: 'c', toString: true } },
             'can overwrite prototype with plainObjects true'
         );
 
         st.end();
     });
 
-    t.test('dunder proto is ignored', function (st) {
-        var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
-        var result = qs.parse(payload, { allowPrototypes: true });
-
-        st.deepEqual(
-            result,
-            {
-                categories: {
-                    length: '42'
-                }
-            },
-            'silent [[Prototype]] payload'
-        );
-
-        var plainResult = qs.parse(payload, { allowPrototypes: true, plainObjects: true });
-
-        st.deepEqual(
-            plainResult,
-            {
-                __proto__: null,
-                categories: {
-                    __proto__: null,
-                    length: '42'
-                }
-            },
-            'silent [[Prototype]] payload: plain objects'
-        );
-
-        var query = qs.parse('categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject', { allowPrototypes: true });
-
-        st.notOk(Array.isArray(query.categories), 'is not an array');
-        st.notOk(query.categories instanceof Array, 'is not instanceof an array');
-        st.deepEqual(query.categories, { some: { json: 'toInject' } });
-        st.equal(JSON.stringify(query.categories), '{"some":{"json":"toInject"}}', 'stringifies as a non-array');
-
-        st.deepEqual(
-            qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true }),
-            {
-                foo: {
-                    bar: 'stuffs'
-                }
-            },
-            'hidden values'
-        );
-
-        st.deepEqual(
-            qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true, plainObjects: true }),
-            {
-                __proto__: null,
-                foo: {
-                    __proto__: null,
-                    bar: 'stuffs'
-                }
-            },
-            'hidden values: plain objects'
-        );
-
-        st.end();
-    });
-
     t.test('can return null objects', { skip: !Object.create }, function (st) {
         var expected = Object.create(null);
         expected.a = Object.create(null);
@@ -813,5 +716,20 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('allows for decoding keys and values differently', function (st) {
+        var decoder = function (str, defaultDecoder, charset, type) {
+            if (type === 'key') {
+                return defaultDecoder(str, defaultDecoder, charset, type).toLowerCase();
+            }
+            if (type === 'value') {
+                return defaultDecoder(str, defaultDecoder, charset, type).toUpperCase();
+            }
+            throw 'this should never happen! type: ' + type;
+        };
+
+        st.deepEqual(qs.parse('KeY=vAlUe', { decoder: decoder }), { key: 'VALUE' });
+        st.end();
+    });
+
     t.end();
 });

package/test/stringify.js

@@ -132,10 +132,10 @@ test('stringify()', function (t) {
     });
 
     t.test('stringifies a nested array value', function (st) {
-        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { encodeValuesOnly: true, arrayFormat: 'indices' }), 'a[b][0]=c&a[b][1]=d');
-        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { encodeValuesOnly: true, arrayFormat: 'brackets' }), 'a[b][]=c&a[b][]=d');
-        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { encodeValuesOnly: true, arrayFormat: 'comma' }), 'a[b]=c,d');
-        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { encodeValuesOnly: true }), 'a[b][0]=c&a[b][1]=d');
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'indices' }), 'a%5Bb%5D%5B0%5D=c&a%5Bb%5D%5B1%5D=d');
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'brackets' }), 'a%5Bb%5D%5B%5D=c&a%5Bb%5D%5B%5D=d');
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'comma' }), 'a%5Bb%5D=c%2Cd'); // a[b]=c,d
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }), 'a%5Bb%5D%5B0%5D=c&a%5Bb%5D%5B1%5D=d');
         st.end();
     });
 
@@ -143,7 +143,7 @@ test('stringify()', function (t) {
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
-                { allowDots: true, encodeValuesOnly: true, arrayFormat: 'indices' }
+                { allowDots: true, encode: false, arrayFormat: 'indices' }
             ),
             'a.b[0]=c&a.b[1]=d',
             'indices: stringifies with dots + indices'
@@ -151,7 +151,7 @@ test('stringify()', function (t) {
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
-                { allowDots: true, encodeValuesOnly: true, arrayFormat: 'brackets' }
+                { allowDots: true, encode: false, arrayFormat: 'brackets' }
             ),
             'a.b[]=c&a.b[]=d',
             'brackets: stringifies with dots + brackets'
@@ -159,7 +159,7 @@ test('stringify()', function (t) {
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
-                { allowDots: true, encodeValuesOnly: true, arrayFormat: 'comma' }
+                { allowDots: true, encode: false, arrayFormat: 'comma' }
             ),
             'a.b=c,d',
             'comma: stringifies with dots + comma'
@@ -167,7 +167,7 @@ test('stringify()', function (t) {
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
-                { allowDots: true, encodeValuesOnly: true }
+                { allowDots: true, encode: false }
             ),
             'a.b[0]=c&a.b[1]=d',
             'default: stringifies with dots + indices'
@@ -215,23 +215,17 @@ test('stringify()', function (t) {
 
     t.test('stringifies an array with mixed objects and primitives', function (st) {
         st.equal(
-            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encodeValuesOnly: true, arrayFormat: 'indices' }),
+            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encode: false, arrayFormat: 'indices' }),
             'a[0][b]=1&a[1]=2&a[2]=3',
             'indices => indices'
         );
         st.equal(
-            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encodeValuesOnly: true, arrayFormat: 'brackets' }),
+            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encode: false, arrayFormat: 'brackets' }),
             'a[][b]=1&a[]=2&a[]=3',
             'brackets => brackets'
         );
         st.equal(
-            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encodeValuesOnly: true, arrayFormat: 'comma' }),
-            '???',
-            'brackets => brackets',
-            { skip: 'TODO: figure out what this should do' }
-        );
-        st.equal(
-            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encodeValuesOnly: true }),
+            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encode: false }),
             'a[0][b]=1&a[1]=2&a[2]=3',
             'default => indices'
         );
@@ -725,5 +719,20 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('allows for encoding keys and values differently', function (st) {
+        var encoder = function (str, defaultEncoder, charset, type) {
+            if (type === 'key') {
+                return defaultEncoder(str, defaultEncoder, charset, type).toLowerCase();
+            }
+            if (type === 'value') {
+                return defaultEncoder(str, defaultEncoder, charset, type).toUpperCase();
+            }
+            throw 'this should never happen! type: ' + type;
+        };
+
+        st.deepEqual(qs.stringify({ KeY: 'vAlUe' }, { encoder: encoder }), 'key=VALUE');
+        st.end();
+    });
+
     t.end();
 });

package/.travis.yml

@@ -1,12 +0,0 @@
-version: ~> 1.0
-language: node_js
-os:
- - linux
-import:
- - ljharb/travis-ci:node/all.yml
- - ljharb/travis-ci:node/pretest.yml
- - ljharb/travis-ci:node/posttest.yml
- - ljharb/travis-ci:node/coverage.yml
-matrix:
-  allow_failures:
-    - env: COVERAGE=true # temporarily allow this to fail