将 qs 从 5.x 升级到 6.x

- [Fix] `parse`: `interpretNumericEntities`: decode code points above U+FFFF as surrogate pairs (#640)
- [Fix] `parse`: respect `plainObjects` for `[]` with `parseArrays: false` (#639)
- [Fix] `utils`: `merge`: count the elements of a sparse array against `arrayLimit`, not its holes
- [Fix] `parse`: guard bracket-wrapped prototype keys at depth 0 (#638)
- [Refactor] `parse`: extract wrapping-bracket stripping helper
- [readme] document that `depth: 0` and `depth: false` keep keys flat
- [Tests] `parse`: pin depth-0 bracket stripping and prototype keys kept by `allowPrototypes`/`plainObjects`

- [New] `stringify`: add `WHATWG` format (#623)
- [Fix] `stringify`: do not sort the caller's `filter` array in place (#637)
- [Fix] `parse`: copy an own `__proto__` key as data (#636)
- [Fix] `parse`: decode percent-encoded dots case-insensitively (#635)
- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
- [Fix] `parse`: preserve comma arrays when interpreting numeric entities (#630)
- [Fix] `parse`: allow scalar fields with a zero array limit (#627)
- [Fix] `parse`: do not count an existing comma array toward `arrayLimit` when `duplicates` discards or replaces it
- [Fix] `utils`: `encode`: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
- [eslint] fix indentation
- [readme] document the encoder's `format` argument
- [meta] add changelog acknowledgement
- [meta] fix changelog indents
- [Dev Deps] update `eslint`, `evalmd`, `npmignore`
- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding
- [Tests] `stringify`: pin `sort` order for nested keys selected by an array `filter`
- [Tests] `parse`: cover `interpretNumericEntities` across value shapes, keys, and the charset sentinel
- [Tests] `parse`: cover more input that builds no array at a zero or negative `arrayLimit`
- [Tests] `parse`: cover `comma` with a zero or negative `arrayLimit`, and combining a full comma array
- [Tests] `parse`: pin the behavior of a zero or negative `arrayLimit`
- [Tests] `utils`/`stringify`: pin `~`, `*`, and parens encoding in RFC3986 and RFC1738

- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
- [meta] use double quotes for better OS support
- [Dev Deps] update `evalmd`, `npmignore`
- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding

- [Fix] `parse`: do not mutate an object input
- [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
- [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
- [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
- [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
- [Fix] `stringify`: ignore inherited array format names (#622)
- [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
- [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
- [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
- [Fix] `parse`: only treat `[]` as array syntax when it ends the key
- [Perf] `decode`: skip decoders when there is no percent sign (#583)
- [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
- [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts (credit @Yeaseen)
- [Docs] document that `qs` and flat parsers disagree about parameter names
- [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
- [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
- [meta] fix changelog indents
- [actions] set least-privilege `cache-mode`
- [Tests] `utils`: `decode`: add missing cases
- [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
- [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
- [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`

- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
- [Fix] stringify: serialize Date values when a filter is provided
- [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
- [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
- [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
- [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
- [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
- [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
- [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
- [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
- [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
- [Dev Deps] update `@ljharb/eslint-config`, `eslint`
- [Dev Deps] update `eslint`, `evalmd`

- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
- [meta] use double quotes for better OS support
- [Dev Deps] update `@ljharb/eslint-config`, `evalmd`, `npmignore`, `tape`
- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding

- [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
- [Fix] `utils`: respect encoding of surrogate pairs across chunks (#559)
- [Robustness] `parse`: throw the `arrayLimit` error before splitting oversized comma values
- [Robustness] `utils.merge` / `utils.assign`: avoid invoking `__proto__` setter when copying own properties
- [Robustness] `utils`: enforce `arrayLimit` consistently across `merge`'s array paths
- [Perf] `utils`: make `compact` O(n) via a side-channel visited-set instead of `Array.indexOf`
- [Deps] update `side-channel`
- [Dev Deps] update `eslint`, `mock-property`, `tape`
- [Tests] `parse`: characterize current lenient handling of unbalanced bracket keys (#558)

- [Fix] `stringify`: skip null/undefined entries in `arrayFormat: 'comma'` + `encodeValuesOnly` instead of crashing in `encoder`
- [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
- [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
- [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
- [Fix] `parse`: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
- [readme] fix grammar (#550)
- [Dev Deps] update `@ljharb/eslint-config`
- [Tests] add regression tests for keys containing percent-encoded bracket text

- [Fix] `parse`: `parameterLimit: Infinity` with `throwOnLimitExceeded: true` silently drops all parameters
- [Deps] update `@ljharb/eslint-config`
- [Dev Deps] update `@ljharb/eslint-config`, `iconv-lite`
- [Tests] increase coverage

- [New] `parse`: add `strictMerge` option to wrap object/primitive conflicts in an array (#425, #122)
- [Fix] `duplicates` option should not apply to bracket notation keys (#514)

- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
- [meta] use double quotes for better OS support
- [Deps] update `side-channel`
- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `mock-property`, `npmignore`, `tape`
- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding

- [Fix] `parse`: mark overflow objects for indexed notation exceeding `arrayLimit` (#546)
- [Fix] `arrayLimit` means max count, not max index, in `combine`/`merge`/`parseArrayValue`
- [Fix] `parse`: throw on `arrayLimit` exceeded with indexed notation when `throwOnLimitExceeded` is true (#529)
- [Fix] `parse`: enforce `arrayLimit` on `comma`-parsed values
- [Fix] `parse`: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
- [Robustness] avoid `.push`, use `void`
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [meta] fix changelog typo (`arrayLength` → `arrayLimit`)
- [actions] fix rebase workflow permissions

- [Fix] ensure `arrayLimit` applies to `[]` notation as well
- [Fix] `parse`: when a custom decoder returns `null` for a key, ignore that key
- [Refactor] `parse`: extract key segment splitting helper
- [meta] add threat model
- [actions] add workflow permissions
- [Tests] `stringify`: increase coverage
- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `npmignore`, `es-value-fixtures`, `for-each`, `object-inspect`

- [New] `parse`: add `throwOnParameterLimitExceeded` option (#517)
- [Refactor] `parse`: use `utils.combine` more
- [patch] `parse`: add explicit `throwOnLimitExceeded` default
- [actions] use shared action; re-add finishers
- [meta] Fix changelog formatting bug
- [Deps] update `side-channel`
- [Dev Deps] update `es-value-fixtures`, `has-bigints`, `has-proto`, `has-symbols`
- [Tests] increase coverage

- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
- [meta] use double quotes for better OS support
- [Deps] update `side-channel`
- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `for-each`, `has-symbols`, `mock-property`, `npmignore`, `object-inspect`, `tape`
- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding

[Fix] fix regressions from robustness refactor
[actions] update reusable workflows

- [Robustness] avoid `.push`, use `void`
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [actions] fix rebase workflow permissions

- [Fix] `stringify`: avoid a crash when a `filter` key is `null`
- [Fix] `utils.merge`: functions should not be stringified into keys
- [Fix] `parse`: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset
- [Fix] `stringify`: ensure a non-string `filter` does not crash
- [Refactor] use `__proto__` syntax instead of `Object.create` for null objects
- [Refactor] misc cleanup
- [Tests] `utils.merge`: add some coverage
- [Tests] fix a test case
- [actions] split out node 10-20, and 20+
- [Dev Deps] update `es-value-fixtures`, `mock-property`, `object-inspect`, `tape`

- [New] `parse`: add `strictDepth` option (#511)
- [Tests] use `npm audit` instead of `aud`

- [Fix] `stringify`: encode keys when `allowEmptyArrays` is set (#561)
- [meta] use `npm audit` instead of `aud`
- [Deps] update `side-channel`
- [Dev Deps] update `@ljharb/eslint-config`, `es-value-fixtures`, `eslint`, `evalmd`, `for-each`, `has-symbols`, `mock-property`, `npmignore`, `object-inspect`, `tape`
- [Tests] `stringify`: pin `allowEmptyArrays` output for keys that need no encoding

- [Fix] fix regressions from robustness refactor
- [actions] update reusable workflows

- [Robustness] avoid `.push`, use `void`
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [actions] fix rebase workflow permissions

- [Fix] `parse`: properly account for `strictNullHandling` when `allowEmptyArrays`
- [meta] fix changelog indentation

- [Fix] `parse`: parse encoded square brackets (#506)
- [readme] add CII best practices badge

在 qs 5.2.1 与 6.17.1 之间，Vigia 发现 0 个已删除的导出、0 个已修改的签名，以及 0 个已删除或修改的类或接口成员。

qs 6.17.1 中有 0 个导出或成员新被标记为弃用。