[dependabot]

Bumps qs from 6.15.2 to 6.17.1.

Changelog

Sourced from qs's changelog.

6.17.1

• [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#640)
• [Fix] parse: respect plainObjects for [] with parseArrays: false (#639)
• [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
• [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#638)
• [Refactor] parse: extract wrapping-bracket stripping helper
• [readme] document that depth: 0 and depth: false keep keys flat
• [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

6.17.0

• [New] stringify: add WHATWG format (#623)
• [Fix] stringify: do not sort the caller's filter array in place (#637)
• [Fix] parse: copy an own __proto__ key as data (#636)
• [Fix] parse: decode percent-encoded dots case-insensitively (#635)
• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [Fix] parse: preserve comma arrays when interpreting numeric entities (#630)
• [Fix] parse: allow scalar fields with a zero array limit (#627)
• [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
• [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
• [eslint] fix indentation
• [readme] document the encoder's format argument
• [meta] add changelog acknowledgement
• [meta] fix changelog indents
• [Dev Deps] update eslint, evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
• [Tests] stringify: pin sort order for nested keys selected by an array filter
• [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
• [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
• [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
• [Tests] parse: pin the behavior of a zero or negative arrayLimit
• [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

6.16.2

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)

... (truncated)

Commits

• 43baea4 v6.17.1
• 54623b6 [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as...
• 7924b65 [Fix] parse: respect plainObjects for [] with parseArrays: false
• 7d4b440 [readme] document that depth: 0 and depth: false keep keys flat
• 101492a [Fix] utils: merge: count the elements of a sparse array against `arrayLi...
• 42eccf0 [Fix] parse: guard bracket-wrapped prototype keys at depth 0
• ae0b5c7 [Refactor] parse: extract wrapping-bracket stripping helper
• 6459f9f [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by `al...
• cb6855c Merge backport release tags v6.12.6–v6.16.2 into main
• 136912a v6.16.2
• Additional commits viewable in compare view

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[Brandon Waterloo [MSFT] (bwateratmsft)]

🤖
All three updated package versions have now been verified against the public npm registry. The earlier unresolved qs result was caused by JSON parsing of case-distinct metadata keys, not a missing publication timestamp; this corrects the earlier eligibility date.

Package	Version	Published (UTC)	Reaches 168 hours (UTC)	Age requirement
qs	6.17.1	2026-10-28T23:41:47.540Z	2026-11-04T23:41:47.540Z	Too new
side-channel	1.1.1	2026-06-08T20:34:47.001Z	2026-06-15T20:34:47.001Z	Met
side-channel-list	1.0.1	2026-04-08T16:55:13.603Z	2026-04-15T16:55:13.603Z	Met

Sources: qs, side-channel, side-channel-list.

The two transitive updates already meet the seven-full-day minimum. qs@6.17.1 is the only age blocker. The whole update becomes age-eligible on November 4, 2026 at 23:41:47.540 UTC (6:41:47.540 PM EST), provided its contents remain unchanged. Changes remain requested until the age requirement is met; this is not an approval.

[Brandon Waterloo [MSFT] (bwateratmsft)]

🤖 Approved after verifying that every target package version is at least 168 hours old.