qs - npm Package Compare versions

Comparing version 6.9.4 to 6.9.5

CHANGELOG.md

@@ -0,1 +1,12 @@
+## **6.9.5**
+- [Fix] `stringify`: do not encode parens for RFC1738
+- [Fix] `stringify`: fix arrayFormat comma with empty array/objects (#350)
+- [Refactor] `format`: remove `util.assign` call
+- [meta] add "Allow Edits" workflow; update rebase workflow
+- [actions] switch Automatic Rebase workflow to `pull_request_target` event
+- [Tests] `stringify`: add tests for #378
+- [Tests] migrate tests to Github Actions
+- [Tests] run `nyc` on all tests; use `tape` runner
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `browserify`, `mkdirp`, `object-inspect`, `tape`; add `aud`
+
 ## **6.9.4**
@@ -2,0 +13,0 @@ - [Fix] `stringify`: when `arrayFormat` is `comma`, respect `serializeDate` (#364)

lib/formats.js

@@ -6,4 +6,2 @@ 'use strict';
 
-var util = require('./utils');
-
 var Format = {
@@ -14,15 +12,14 @@ RFC1738: 'RFC1738',
 
-module.exports = util.assign(
-    {
-        'default': Format.RFC3986,
-        formatters: {
-            RFC1738: function (value) {
-                return replace.call(value, percentTwenties, '+');
-            },
-            RFC3986: function (value) {
-                return String(value);
-            }
+module.exports = {
+    'default': Format.RFC3986,
+    formatters: {
+        RFC1738: function (value) {
+            return replace.call(value, percentTwenties, '+');
+        },
+        RFC3986: function (value) {
+            return String(value);
         }
     },
-    Format
-);
+    RFC1738: Format.RFC1738,
+    RFC3986: Format.RFC3986
+};

lib/parse.js

@@ -143,3 +143,3 @@ 'use strict';
 
-        leaf = obj; // eslint-disable-line no-param-reassign
+        leaf = obj;
     }
@@ -146,0 +146,0 @@

lib/stringify.js

@@ -68,2 +68,3 @@ 'use strict';
     serializeDate,
+    format,
     formatter,
@@ -84,3 +85,3 @@ encodeValuesOnly,
             return value;
-        }).join(',');
+        });
     }
@@ -90,3 +91,3 @@
         if (strictNullHandling) {
-            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, 'key') : prefix;
+            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, 'key', format) : prefix;
         }
@@ -99,4 +100,4 @@
         if (encoder) {
-            var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset, 'key');
-            return [formatter(keyValue) + '=' + formatter(encoder(obj, defaults.encoder, charset, 'value'))];
+            var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset, 'key', format);
+            return [formatter(keyValue) + '=' + formatter(encoder(obj, defaults.encoder, charset, 'value', format))];
         }
@@ -113,3 +114,6 @@ return [formatter(prefix) + '=' + formatter(String(obj))];
     var objKeys;
-    if (isArray(filter)) {
+    if (generateArrayPrefix === 'comma' && isArray(obj)) {
+        // we need to join elements in
+        objKeys = [{ value: obj.length > 0 ? obj.join(',') || null : undefined }];
+    } else if (isArray(filter)) {
         objKeys = filter;
@@ -123,3 +127,3 @@ } else {
         var key = objKeys[i];
-        var value = obj[key];
+        var value = typeof key === 'object' && key.value !== undefined ? key.value : obj[key];
 
@@ -145,2 +149,3 @@ if (skipNulls && value === null) {
             serializeDate,
+            format,
             formatter,
@@ -193,2 +198,3 @@ encodeValuesOnly,
         filter: filter,
+        format: format,
         formatter: formatter,
@@ -259,2 +265,3 @@ serializeDate: typeof opts.serializeDate === 'function' ? opts.serializeDate : defaults.serializeDate,
             options.serializeDate,
+            options.format,
             options.formatter,
@@ -261,0 +268,0 @@ options.encodeValuesOnly,

lib/utils.js

 'use strict';
 
+var formats = require('./formats');
+
 var has = Object.prototype.hasOwnProperty;
@@ -123,3 +125,3 @@ var isArray = Array.isArray;
 
-var encode = function encode(str, defaultEncoder, charset) {
+var encode = function encode(str, defaultEncoder, charset, kind, format) {
     // This code was originally written by Brian White (mscdex) for the io.js core querystring library.
@@ -156,2 +158,3 @@ // It has been adapted here for stricter adherence to RFC 3986
             || (c >= 0x61 && c <= 0x7A) // A-Z
+            || (format === formats.RFC1738 && (c === 0x28 || c === 0x29)) // ( )
         ) {
@@ -158,0 +161,0 @@ out += string.charAt(i);

package.json

@@ -5,3 +5,3 @@ {
     "homepage": "https://github.com/ljharb/qs",
-    "version": "6.9.4",
+    "version": "6.9.5",
     "repository": {
@@ -35,7 +35,7 @@ "type": "git",
     "devDependencies": {
-        "@ljharb/eslint-config": "^16.0.0",
-        "browserify": "^16.5.1",
-        "covert": "^1.1.1",
+        "@ljharb/eslint-config": "^17.3.0",
+        "aud": "^1.1.3",
+        "browserify": "^16.5.2",
         "eclint": "^2.8.1",
-        "eslint": "^6.8.0",
+        "eslint": "^7.17.0",
         "evalmd": "^0.0.19",
@@ -45,8 +45,9 @@ "for-each": "^0.3.3",
         "iconv-lite": "^0.5.1",
-        "mkdirp": "^0.5.4",
-        "object-inspect": "^1.7.0",
+        "mkdirp": "^0.5.5",
+        "nyc": "^10.3.2",
+        "object-inspect": "^1.9.0",
         "qs-iconv": "^1.0.4",
         "safe-publish-latest": "^1.1.4",
         "safer-buffer": "^2.1.2",
-        "tape": "^5.0.0"
+        "tape": "^5.1.1"
     },
@@ -56,9 +57,8 @@ "scripts": {
         "pretest": "npm run --silent readme && npm run --silent lint",
-        "test": "npm run --silent coverage",
-        "tests-only": "node test",
-        "posttest": "npx aud --production",
+        "test": "npm run tests-only",
+        "tests-only": "nyc tape 'test/**/*.js'",
+        "posttest": "aud --production",
         "readme": "evalmd README.md",
         "postlint": "eclint check * lib/* test/*",
         "lint": "eslint lib/*.js test/*.js",
-        "coverage": "covert test",
         "dist": "mkdirp dist && browserify --standalone Qs lib/index.js > dist/qs.js"
@@ -65,0 +65,0 @@ },

test/stringify.js

@@ -339,2 +339,23 @@ 'use strict';
 
+    t.test('stringifies an empty array in different arrayFormat', function (st) {
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false }), 'b[0]=&c=c');
+        // arrayFormat default
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'indices' }), 'b[0]=&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'brackets' }), 'b[]=&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'repeat' }), 'b=&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'comma' }), 'b=&c=c');
+        // with strictNullHandling
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'indices', strictNullHandling: true }), 'b[0]&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'brackets', strictNullHandling: true }), 'b[]&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'repeat', strictNullHandling: true }), 'b&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'comma', strictNullHandling: true }), 'b&c=c');
+        // with skipNulls
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'indices', skipNulls: true }), 'c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'brackets', skipNulls: true }), 'c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'repeat', skipNulls: true }), 'c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'comma', skipNulls: true }), 'c=c');
+
+        st.end();
+    });
+
     t.test('stringifies a null object', { skip: !Object.create }, function (st) {
@@ -614,6 +635,9 @@ var obj = Object.create(null);
 
-    t.test('RFC 1738 spaces serialization', function (st) {
+    t.test('RFC 1738 serialization', function (st) {
         st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.RFC1738 }), 'a=b+c');
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC1738 }), 'a+b=c+d');
         st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC1738 }), 'a+b=a+b');
+
+        st.equal(qs.stringify({ 'foo(ref)': 'bar' }, { format: qs.formats.RFC1738 }), 'foo(ref)=bar');
+
         st.end();
@@ -626,2 +650,3 @@ });
         st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC3986 }), 'a%20b=a%20b');
+
         st.end();
@@ -633,2 +658,3 @@ });
         st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }), 'a%20b=a%20b');
+
         st.end();
@@ -753,3 +779,20 @@ });
 
+    t.test('objects inside arrays', function (st) {
+        var obj = { a: { b: { c: 'd', e: 'f' } } };
+        var withArray = { a: { b: [{ c: 'd', e: 'f' }] } };
+
+        st.equal(qs.stringify(obj, { encode: false }), 'a[b][c]=d&a[b][e]=f', 'no array, no arrayFormat');
+        st.equal(qs.stringify(obj, { encode: false, arrayFormat: 'bracket' }), 'a[b][c]=d&a[b][e]=f', 'no array, bracket');
+        st.equal(qs.stringify(obj, { encode: false, arrayFormat: 'indices' }), 'a[b][c]=d&a[b][e]=f', 'no array, indices');
+        st.equal(qs.stringify(obj, { encode: false, arrayFormat: 'comma' }), 'a[b][c]=d&a[b][e]=f', 'no array, comma');
+
+        st.equal(qs.stringify(withArray, { encode: false }), 'a[b][0][c]=d&a[b][0][e]=f', 'array, no arrayFormat');
+        st.equal(qs.stringify(withArray, { encode: false, arrayFormat: 'bracket' }), 'a[b][0][c]=d&a[b][0][e]=f', 'array, bracket');
+        st.equal(qs.stringify(withArray, { encode: false, arrayFormat: 'indices' }), 'a[b][0][c]=d&a[b][0][e]=f', 'array, indices');
+        st.equal(qs.stringify(obj, { encode: false, arrayFormat: 'comma' }), '???', 'array, comma (pending issue #378)', { skip: true });
+
+        st.end();
+    });
+
     t.end();
 });

Fixed alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Number of low supply chain risk alerts

0

decreased by-100%

Worsened metrics

Total package byte prevSize

138396

decreased by-13.6%

Dev dependency count

16

increased by6.67%

Number of package files

17

decreased by-15%

Lines of code

2136

decreased by-23.52%

No dependency changes