query-string 9.3.1 → 9.5.1

package/base.js

@@ -24,15 +24,12 @@ function encoderForArrayFormat(options) {
 				}
 
 				if (value === null) {
-					return [
-						...result, [encode(key, options), '[', index, ']'].join(''),
-					];
+					result.push([encode(key, options), '[', index, ']'].join(''));
+					return result;
 				}
 
-				return [
-					...result,
-					[encode(key, options), '[', encode(index, options), ']=', encode(value, options)].join(''),
-				];
+				result.push([encode(key, options), '[', encode(index, options), ']=', encode(value, options)].join(''));
+				return result;
 			};
 		}
 
@@ -47,16 +44,12 @@ function encoderForArrayFormat(options) {
 				}
 
 				if (value === null) {
-					return [
-						...result,
-						[encode(key, options), '[]'].join(''),
-					];
+					result.push([encode(key, options), '[]'].join(''));
+					return result;
 				}
 
-				return [
-					...result,
-					[encode(key, options), '[]=', encode(value, options)].join(''),
-				];
+				result.push([encode(key, options), '[]=', encode(value, options)].join(''));
+				return result;
 			};
 		}
 
@@ -71,16 +64,12 @@ function encoderForArrayFormat(options) {
 				}
 
 				if (value === null) {
-					return [
-						...result,
-						[encode(key, options), ':list='].join(''),
-					];
+					result.push([encode(key, options), ':list='].join(''));
+					return result;
 				}
 
-				return [
-					...result,
-					[encode(key, options), ':list=', encode(value, options)].join(''),
-				];
+				result.push([encode(key, options), ':list=', encode(value, options)].join(''));
+				return result;
 			};
 		}
 
@@ -104,10 +93,12 @@ function encoderForArrayFormat(options) {
 				value = value === null ? '' : value;
 
 				if (result.length === 0) {
-					return [[encode(key, options), keyValueSeparator, encode(value, options)].join('')];
+					result.push([encode(key, options), keyValueSeparator, encode(value, options)].join(''));
+					return result;
 				}
 
-				return [[result, encode(value, options)].join(options.arrayFormatSeparator)];
+				result.push(encode(value, options));
+				return result;
 			};
 		}
 
@@ -122,16 +113,12 @@ function encoderForArrayFormat(options) {
 				}
 
 				if (value === null) {
-					return [
-						...result,
-						encode(key, options),
-					];
+					result.push(encode(key, options));
+					return result;
 				}
 
-				return [
-					...result,
-					[encode(key, options), '=', encode(value, options)].join(''),
-				];
+				result.push([encode(key, options), '=', encode(value, options)].join(''));
+				return result;
 			};
 		}
 	}
@@ -175,7 +162,12 @@ function parserForArrayFormat(options) {
 					return;
 				}
 
-				accumulator[key] = [...accumulator[key], value];
+				if (!Array.isArray(accumulator[key])) {
+					accumulator[key] = [accumulator[key], value];
+					return;
+				}
+
+				accumulator[key].push(value);
 			};
 		}
 
@@ -194,7 +186,12 @@ function parserForArrayFormat(options) {
 					return;
 				}
 
-				accumulator[key] = [...accumulator[key], value];
+				if (!Array.isArray(accumulator[key])) {
+					accumulator[key] = [accumulator[key], value];
+					return;
+				}
+
+				accumulator[key].push(value);
 			};
 		}
 
@@ -226,7 +223,13 @@ function parserForArrayFormat(options) {
 					return;
 				}
 
-				accumulator[key] = [...accumulator[key], ...arrayValue];
+				if (!Array.isArray(accumulator[key])) {
+					accumulator[key] = [accumulator[key]];
+				}
+
+				for (const item of arrayValue) {
+					accumulator[key].push(item);
+				}
 			};
 		}
 
@@ -237,7 +240,12 @@ function parserForArrayFormat(options) {
 					return;
 				}
 
-				accumulator[key] = [...[accumulator[key]].flat(), value];
+				if (Array.isArray(accumulator[key])) {
+					accumulator[key].push(value);
+					return;
+				}
+
+				accumulator[key] = [accumulator[key], value];
 			};
 		}
 	}
@@ -298,6 +306,12 @@ function getHash(url) {
 	return hash;
 }
 
+function getUrlWithoutQuery(url) {
+	// Avoid `split('?')` so query-heavy URLs don't allocate large arrays.
+	const queryStart = url.indexOf('?');
+	return queryStart === -1 ? url : url.slice(0, queryStart);
+}
+
 function parseValue(value, options, type) {
 	if (type === 'string' && typeof value === 'string') {
 		return value;
@@ -381,11 +395,27 @@ export function parse(query, options) {
 		return returnValue;
 	}
 
-	for (const parameter of query.split('&')) {
-		if (parameter === '') {
+	if (/^&+$/.test(query)) {
+		return returnValue;
+	}
+
+	let parameterStart = 0;
+	let firstSeparator = query.indexOf('&');
+	if (firstSeparator === -1) {
+		firstSeparator = query.length;
+	}
+
+	for (let index = firstSeparator; index <= query.length; index++) {
+		if (index < query.length && query[index] !== '&') {
 			continue;
 		}
 
+		if (index === parameterStart) {
+			parameterStart = index + 1;
+			continue;
+		}
+
+		const parameter = query.slice(parameterStart, index);
 		const parameter_ = options.decode ? parameter.replaceAll('+', ' ') : parameter;
 
 		let [key, value] = splitOnFirst(parameter_, '=');
@@ -398,6 +428,8 @@ export function parse(query, options) {
 		// http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters
 		value = value === undefined ? null : (['comma', 'separator', 'bracket-separator'].includes(options.arrayFormat) ? value : decode(value, options));
 		formatter(decode(key, options), value, returnValue);
+
+		parameterStart = index + 1;
 	}
 
 	for (const [key, value] of Object.entries(returnValue)) {
@@ -498,9 +530,9 @@ export function stringify(object, options) {
 				).filter(item => item !== undefined);
 			}
 
-			return processedArray
-				.reduce(formatter(key), [])
-				.join('&');
+			const result = processedArray.reduce(formatter(key), []);
+			const arrayFormatSeparator = ['comma', 'separator', 'bracket-separator'].includes(options.arrayFormat) ? options.arrayFormatSeparator : '&';
+			return result.join(arrayFormatSeparator);
 		}
 
 		return encode(key, options) + '=' + encode(value, options);
@@ -520,7 +552,7 @@ export function parseUrl(url, options) {
 	}
 
 	return {
-		url: url_?.split('?')?.[0] ?? '',
+		url: getUrlWithoutQuery(url_ ?? ''),
 		query: parse(extract(url), options),
 		...(options && options.parseFragmentIdentifier && hash ? {fragmentIdentifier: decode(hash, options)} : {}),
 	};
@@ -534,7 +566,7 @@ export function stringifyUrl(object, options) {
 		...options,
 	};
 
-	const url = removeHash(object.url).split('?')[0] || '';
+	const url = getUrlWithoutQuery(removeHash(object.url)) || '';
 	const queryFromUrl = extract(object.url);
 
 	const query = {
@@ -547,9 +579,14 @@ export function stringifyUrl(object, options) {
 
 	let hash = getHash(object.url);
 	if (typeof object.fragmentIdentifier === 'string') {
-		const urlObjectForFragmentEncode = new URL(url);
-		urlObjectForFragmentEncode.hash = object.fragmentIdentifier;
-		hash = options[encodeFragmentIdentifier] ? urlObjectForFragmentEncode.hash : `#${object.fragmentIdentifier}`;
+		hash = `#${object.fragmentIdentifier}`;
+
+		if (options[encodeFragmentIdentifier]) {
+			// Percent-encode the fragment with a throwaway URL. The fragment percent-encode set does not depend on the scheme, so the caller's URL is deliberately not parsed here; it may not even be parseable.
+			const throwawayUrl = new URL('https://query-string.invalid');
+			throwawayUrl.hash = hash;
+			hash = throwawayUrl.hash;
+		}
 	}
 
 	return `${url}${queryString}${hash}`;
@@ -572,7 +609,10 @@ export function pick(input, filter, options) {
 }
 
 export function exclude(input, filter, options) {
-	const exclusionFilter = Array.isArray(filter) ? key => !filter.includes(key) : (key, value) => !filter(key, value);
+	if (Array.isArray(filter)) {
+		const filterSet = new Set(filter);
+		return pick(input, key => !filterSet.has(key), options);
+	}
 
-	return pick(input, exclusionFilter, options);
+	return pick(input, (key, value) => !filter(key, value), options);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "query-string",
-	"version": "9.3.1",
+	"version": "9.5.1",
 	"description": "Parse and stringify URL query strings",
 	"license": "MIT",
 	"repository": "sindresorhus/query-string",
@@ -46,7 +46,7 @@
 		"filter"
 	],
 	"dependencies": {
-		"decode-uri-component": "^0.4.1",
+		"decode-uri-component": "^0.5.0",
 		"filter-obj": "^5.1.0",
 		"split-on-first": "^3.0.0"
 	},

package/readme.md

@@ -13,6 +13,9 @@ npm install query-string
 
 For browser usage, this package targets the latest version of Chrome, Firefox, and Safari.
 
+> [!TIP]
+> Consider using [`URLSearchParams`](https://developer.mozilla.org/en-US/docs/Web/API/URLSearchParams) for simple use cases. It's a native browser API that handles basic query string operations.
+
 ## Usage
 
 ```js