dependabot[bot] opened a new pull request, #1128: URL: https://github.com/apache/myfaces/pull/1128
Bumps [qs](https://github.com/ljharb/qs) from 6.15.3 to 6.17.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md";>qs's changelog</a>.</em></p> <blockquote> <h2><strong>6.17.1</strong></h2> <ul> <li>[Fix] <code>parse</code>: <code>interpretNumericEntities</code>: decode code points above U+FFFF as surrogate pairs (<a href="https://redirect.github.com/ljharb/qs/issues/640";>#640</a>)</li> <li>[Fix] <code>parse</code>: respect <code>plainObjects</code> for <code>[]</code> with <code>parseArrays: false</code> (<a href="https://redirect.github.com/ljharb/qs/issues/639";>#639</a>)</li> <li>[Fix] <code>utils</code>: <code>merge</code>: count the elements of a sparse array against <code>arrayLimit</code>, not its holes</li> <li>[Fix] <code>parse</code>: guard bracket-wrapped prototype keys at depth 0 (<a href="https://redirect.github.com/ljharb/qs/issues/638";>#638</a>)</li> <li>[Refactor] <code>parse</code>: extract wrapping-bracket stripping helper</li> <li>[readme] document that <code>depth: 0</code> and <code>depth: false</code> keep keys flat</li> <li>[Tests] <code>parse</code>: pin depth-0 bracket stripping and prototype keys kept by <code>allowPrototypes</code>/<code>plainObjects</code></li> </ul> <h2><strong>6.17.0</strong></h2> <ul> <li>[New] <code>stringify</code>: add <code>WHATWG</code> format (<a href="https://redirect.github.com/ljharb/qs/issues/623";>#623</a>)</li> <li>[Fix] <code>stringify</code>: do not sort the caller's <code>filter</code> array in place (<a href="https://redirect.github.com/ljharb/qs/issues/637";>#637</a>)</li> <li>[Fix] <code>parse</code>: copy an own <code>__proto__</code> key as data (<a href="https://redirect.github.com/ljharb/qs/issues/636";>#636</a>)</li> <li>[Fix] <code>parse</code>: decode percent-encoded dots case-insensitively (<a href="https://redirect.github.com/ljharb/qs/issues/635";>#635</a>)</li> <li>[Fix] <code>stringify</code>: encode keys when <code>allowEmptyArrays</code> is set (<a href="https://redirect.github.com/ljharb/qs/issues/561";>#561</a>)</li> <li>[Fix] <code>parse</code>: preserve comma arrays when interpreting numeric entities (<a href="https://redirect.github.com/ljharb/qs/issues/630";>#630</a>)</li> <li>[Fix] <code>parse</code>: allow scalar fields with a zero array limit (<a href="https://redirect.github.com/ljharb/qs/issues/627";>#627</a>)</li> <li>[Fix] <code>parse</code>: do not count an existing comma array toward <code>arrayLimit</code> when <code>duplicates</code> discards or replaces it</li> <li>[Fix] <code>utils</code>: <code>encode</code>: encode lone surrogates as U+FFFD instead of consuming the next code unit (<a href="https://redirect.github.com/ljharb/qs/issues/624";>#624</a>)</li> <li>[eslint] fix indentation</li> <li>[readme] document the encoder's <code>format</code> argument</li> <li>[meta] add changelog acknowledgement</li> <li>[meta] fix changelog indents</li> <li>[Dev Deps] update <code>eslint</code>, <code>evalmd</code>, <code>npmignore</code></li> <li>[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code> output for keys that need no encoding</li> <li>[Tests] <code>stringify</code>: pin <code>sort</code> order for nested keys selected by an array <code>filter</code></li> <li>[Tests] <code>parse</code>: cover <code>interpretNumericEntities</code> across value shapes, keys, and the charset sentinel</li> <li>[Tests] <code>parse</code>: cover more input that builds no array at a zero or negative <code>arrayLimit</code></li> <li>[Tests] <code>parse</code>: cover <code>comma</code> with a zero or negative <code>arrayLimit</code>, and combining a full comma array</li> <li>[Tests] <code>parse</code>: pin the behavior of a zero or negative <code>arrayLimit</code></li> <li>[Tests] <code>utils</code>/<code>stringify</code>: pin <code>~</code>, <code>*</code>, and parens encoding in RFC3986 and RFC1738</li> </ul> <h2><strong>6.16.2</strong></h2> <ul> <li>[Fix] <code>stringify</code>: encode keys when <code>allowEmptyArrays</code> is set (<a href="https://redirect.github.com/ljharb/qs/issues/561";>#561</a>)</li> <li>[meta] use double quotes for better OS support</li> <li>[Dev Deps] update <code>evalmd</code>, <code>npmignore</code></li> <li>[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code> output for keys that need no encoding</li> </ul> <h2><strong>6.16.1</strong></h2> <ul> <li>[Fix] <code>parse</code>: do not mutate an object input</li> <li>[Fix] <code>stringify</code>: stop re-encoding structural separator dots when <code>encodeDotInKeys</code> is set (<a href="https://redirect.github.com/ljharb/qs/issues/564";>#564</a>)</li> <li>[Fix] <code>stringify</code>: <code>arrayFormat: 'comma'</code>: pass the full encoder arguments with <code>encodeValuesOnly</code></li> <li>[Fix] <code>utils</code>: encode <code>+</code> as <code>%2B</code> in iso-8859-1 mode so values round-trip (<a href="https://redirect.github.com/ljharb/qs/issues/565";>#565</a>)</li> <li>[Fix] parse: only convert top-level dots to brackets when allowDots is on (<a href="https://redirect.github.com/ljharb/qs/issues/621";>#621</a>)</li> <li>[Fix] <code>stringify</code>: ignore inherited array format names (<a href="https://redirect.github.com/ljharb/qs/issues/622";>#622</a>)</li> <li>[Fix] <code>stringify</code>: <code>arrayFormat: 'comma'</code>: do not throw on elements with no callable <code>toString</code></li> <li>[Fix] <code>utils</code>: <code>merge</code>: seed an overflow container's index from its own keys, not just the source</li> <li>[Fix] <code>utils</code>: <code>merge</code>: keep a <code>strictMerge</code> conflict container's index and <code>arrayLimit</code> correct</li> <li>[Fix] <code>parse</code>: only treat <code>[]</code> as array syntax when it ends the key</li> <li>[Perf] <code>decode</code>: skip decoders when there is no percent sign (<a href="https://redirect.github.com/ljharb/qs/issues/583";>#583</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/qs/commit/43baea4655cb9b543fb1c5cc0db95cde42852140";><code>43baea4</code></a> v6.17.1</li> <li><a href="https://github.com/ljharb/qs/commit/54623b64dcef77a436b834b0413cf4cbb6bc6927";><code>54623b6</code></a> [Fix] <code>parse</code>: <code>interpretNumericEntities</code>: decode code points above U+FFFF as...</li> <li><a href="https://github.com/ljharb/qs/commit/7924b65958d41cd91dbaf688f61e7029673eb33f";><code>7924b65</code></a> [Fix] <code>parse</code>: respect <code>plainObjects</code> for <code>[]</code> with <code>parseArrays: false</code></li> <li><a href="https://github.com/ljharb/qs/commit/7d4b440de3c028e8497544d0474d5264d9d2bad9";><code>7d4b440</code></a> [readme] document that <code>depth: 0</code> and <code>depth: false</code> keep keys flat</li> <li><a href="https://github.com/ljharb/qs/commit/101492a5c4d9cb72f6510ecc15483759ec8e45fa";><code>101492a</code></a> [Fix] <code>utils</code>: <code>merge</code>: count the elements of a sparse array against `arrayLi...</li> <li><a href="https://github.com/ljharb/qs/commit/42eccf0f6292c502fb4bc175191f0812d5476769";><code>42eccf0</code></a> [Fix] <code>parse</code>: guard bracket-wrapped prototype keys at depth 0</li> <li><a href="https://github.com/ljharb/qs/commit/ae0b5c7481fcc6483c4d8ff875e290b2387f87b6";><code>ae0b5c7</code></a> [Refactor] <code>parse</code>: extract wrapping-bracket stripping helper</li> <li><a href="https://github.com/ljharb/qs/commit/6459f9fc5e5036cfdb6e120fcb94df8e48f584df";><code>6459f9f</code></a> [Tests] <code>parse</code>: pin depth-0 bracket stripping and prototype keys kept by `al...</li> <li><a href="https://github.com/ljharb/qs/commit/cb6855c1eb72eb0a3ef549b3cf9fce904e6263ec";><code>cb6855c</code></a> Merge backport release tags v6.12.6–v6.16.2 into main</li> <li><a href="https://github.com/ljharb/qs/commit/136912a619c2d81c090ca196ea02b6c193580d1d";><code>136912a</code></a> v6.16.2</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/qs/compare/v6.15.3...v6.17.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/myfaces/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
