将 qs 从 5.x 升级到 6.x

- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
 - [Fix] stringify: serialize Date values when a filter is provided
 - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
 - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
 - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
 - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
 - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
 - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
 - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
 - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
 - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
 - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
 - [Dev Deps] update `eslint`, `evalmd`

- [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
- [Fix] `utils`: respect encoding of surrogate pairs across chunks (#559)
- [Robustness] `parse`: throw the `arrayLimit` error before splitting oversized comma values
- [Robustness] `utils.merge` / `utils.assign`: avoid invoking `__proto__` setter when copying own properties
- [Robustness] `utils`: enforce `arrayLimit` consistently across `merge`'s array paths
- [Perf] `utils`: make `compact` O(n) via a side-channel visited-set instead of `Array.indexOf`
- [Deps] update `side-channel`
- [Dev Deps] update `eslint`, `mock-property`, `tape`
- [Tests] `parse`: characterize current lenient handling of unbalanced bracket keys (#558)

- [Fix] `stringify`: skip null/undefined entries in `arrayFormat: 'comma'` + `encodeValuesOnly` instead of crashing in `encoder`
- [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
- [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
- [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
- [Fix] `parse`: handle nested bracket groups and add regression tests (#530)
- [readme] fix grammar (#550)
- [Dev Deps] update `@ljharb/eslint-config`
- [Tests] add regression tests for keys containing percent-encoded bracket text

- [Fix] `parse`: `parameterLimit: Infinity` with `throwOnLimitExceeded: true` silently drops all parameters
- [Deps] update `@ljharb/eslint-config`
- [Dev Deps] update `@ljharb/eslint-config`, `iconv-lite`
- [Tests] increase coverage

- [New] `parse`: add `strictMerge` option to wrap object/primitive conflicts in an array (#425, #122)
- [Fix] `duplicates` option should not apply to bracket notation keys (#514)

- [Fix] `parse`: mark overflow objects for indexed notation exceeding `arrayLimit` (#546)
- [Fix] `arrayLimit` means max count, not max index, in `combine`/`merge`/`parseArrayValue`
- [Fix] `parse`: throw on `arrayLimit` exceeded with indexed notation when `throwOnLimitExceeded` is true (#529)
- [Fix] `parse`: enforce `arrayLimit` on `comma`-parsed values
- [Fix] `parse`: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
- [Robustness] avoid `.push`, use `void`
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [meta] fix changelog typo (`arrayLength` → `arrayLimit`)
- [actions] fix rebase workflow permissions

- [Fix] ensure `arrayLimit` applies to `[]` notation as well
- [Fix] `parse`: when a custom decoder returns `null` for a key, ignore that key
- [Refactor] `parse`: extract key segment splitting helper
- [meta] add threat model
- [actions] add workflow permissions
- [Tests] `stringify`: increase coverage
- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `npmignore`, `es-value-fixtures`, `for-each`, `object-inspect`

- [New] `parse`: add `throwOnParameterLimitExceeded` option (#517)
- [Refactor] `parse`: use `utils.combine` more
- [patch] `parse`: add explicit `throwOnLimitExceeded` default
- [actions] use shared action; re-add finishers
- [meta] Fix changelog formatting bug
- [Deps] update `side-channel`
- [Dev Deps] update `es-value-fixtures`, `has-bigints`, `has-proto`, `has-symbols`
- [Tests] increase coverage

[Fix] fix regressions from robustness refactor
[actions] update reusable workflows

- [Robustness] avoid `.push`, use `void`
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [actions] fix rebase workflow permissions

- [Fix] `stringify`: avoid a crash when a `filter` key is `null`
- [Fix] `utils.merge`: functions should not be stringified into keys
- [Fix] `parse`: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset
- [Fix] `stringify`: ensure a non-string `filter` does not crash
- [Refactor] use `__proto__` syntax instead of `Object.create` for null objects
- [Refactor] misc cleanup
- [Tests] `utils.merge`: add some coverage
- [Tests] fix a test case
- [actions] split out node 10-20, and 20+
- [Dev Deps] update `es-value-fixtures`, `mock-property`, `object-inspect`, `tape`

- [New] `parse`: add `strictDepth` option (#511)
- [Tests] use `npm audit` instead of `aud`

- [Fix] fix regressions from robustness refactor
- [actions] update reusable workflows

- [Robustness] avoid `.push`, use `void`
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [actions] fix rebase workflow permissions

- [Fix] `parse`: properly account for `strictNullHandling` when `allowEmptyArrays`
- [meta] fix changelog indentation

- [Fix] `parse`: parse encoded square brackets (#506)
- [readme] add CII best practices badge

- [Fix] `parse`: Disable `decodeDotInKeys` by default to restore previous behavior (#501)
- [Performance] `utils`: Optimize performance under large data volumes, reduce memory usage, and speed up processing (#502)
- [Refactor] `utils`: use `+=`
- [Tests] increase coverage

- [New] `parse`/`stringify`: add `decodeDotInKeys`/`encodeDotKeys` options (#488)
- [New] `parse`: add `duplicates` option
- [New] `parse`/`stringify`: add `allowEmptyArrays` option to allow [] in object values (#487)
- [Refactor] `parse`/`stringify`: move allowDots config logic to its own variable
- [Refactor] `stringify`: move option-handling code into `normalizeStringifyOptions`
- [readme] update readme, add logos (#484)
- [readme] `stringify`: clarify default `arrayFormat` behavior
- [readme] fix line wrapping
- [readme] remove dead badges
- [Deps] update `side-channel`
- [meta] make the dist build 50% smaller
- [meta] add `sideEffects` flag
- [meta] run build in prepack, not prepublish
- [Tests] `parse`: remove useless tests; add coverage
- [Tests] `stringify`: increase coverage
- [Tests] use `mock-property`
- [Tests] `stringify`: improve coverage
- [Dev Deps] update `@ljharb/eslint-config `, `aud`, `has-override-mistake`, `has-property-descriptors`, `mock-property`, `npmignore`, `object-inspect`, `tape`
- [Dev Deps] pin `glob`, since v10.3.8+ requires a broken `jackspeak`
- [Dev Deps] pin `jackspeak` since 2.1.2+ depends on npm aliases, which kill the install process in npm < 6

- [Fix] fix regressions from robustness refactor
- [actions] update reusable workflows

- [Robustness] avoid `.push`, use `void`
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [actions] fix rebase workflow permissions

- [Fix] `parse`: Fix parsing when the global Object prototype is frozen (#473)
- [Tests] add passing test cases with empty keys (#473)

- [Fix] `stringify`: encode comma values more consistently (#463)
- [readme] add usage of `filter` option for injecting custom serialization, i.e. of custom types (#447)
- [meta] remove extraneous code backticks (#457)
- [meta] fix changelog markdown
- [actions] update checkout action
- [actions] restrict action permissions
- [Dev Deps] update `@ljharb/eslint-config`, `aud`, `object-inspect`, `tape`

- [New] [Fix] `stringify`: revert 0e903c0; add `commaRoundTrip` option (#442)
- [readme] fix version badge

- [Fix] fix regressions from robustness refactor
- [actions] update reusable workflows

- [Robustness] avoid `.push`, use `void`
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [actions] fix rebase workflow permissions

- [Fix] `stringify`: with `arrayFormat: comma`, properly include an explicit `[]` on a single-item array (#434)

- [Fix] `stringify`: with `arrayFormat: comma`, include an explicit `[]` on a single-item array (#441)
- [meta] use `npmignore` to autogenerate an npmignore file
- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `aud`, `has-symbol`, `object-inspect`, `tape`

- [Fix] `parse`: ignore `__proto__` keys (#428)
- [Robustness] `stringify`: avoid relying on a global `undefined` (#427)
- [actions] reuse common workflows
- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `object-inspect`, `tape`

- [Fix] `stringify`: actually fix cyclic references (#426)
- [Fix] `stringify`: avoid encoding arrayformat comma when `encodeValuesOnly = true` (#424)
- [readme] remove travis badge; add github actions/codecov badges; update URLs
- [Docs] add note and links for coercing primitive values (#408)
- [actions] update codecov uploader
- [actions] update workflows
- [Tests] clean up stringify tests slightly
- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `aud`, `object-inspect`, `safe-publish-latest`, `tape`

- [Fix] `stringify`: avoid exception on repeated object values (#402)

- [New] `stringify`: throw on cycles, instead of an infinite loop (#395, #394, #393)
- [New] `parse`: add `allowSparse` option for collapsing arrays with missing indices (#312)
- [meta] fix README.md (#399)
- [meta] only run `npm run dist` in publish, not install
- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `aud`, `has-symbols`, `tape`
- [Tests] fix tests on node v0.6
- [Tests] use `ljharb/actions/node/install` instead of `ljharb/actions/node/run`
- [Tests] Revert "[meta] ignore eclint transitive audit warning"

- [Fix] fix regressions from robustness refactor
- [meta] add `npmignore` to autogenerate an npmignore file
- [actions] update reusable workflows

- [Robustness] avoid `.push`, use `void`
- [readme] clarify `parseArrays` and `arrayLimit` documentation (#543)
- [readme] document that `addQueryPrefix` does not add `?` to empty output (#418)
- [readme] replace runkit CI badge with shields.io check-runs badge
- [actions] fix rebase workflow permissions

- [Fix] `parse`: ignore `__proto__` keys (#428)
- [Fix] `stringify`: avoid encoding arrayformat comma when `encodeValuesOnly = true` (#424)
- [Robustness] `stringify`: avoid relying on a global `undefined` (#427)
- [readme] remove travis badge; add github actions/codecov badges; update URLs
- [Docs] add note and links for coercing primitive values (#408)
- [Tests] clean up stringify tests slightly
- [meta] fix README.md (#399)
- Revert "[meta] ignore eclint transitive audit warning"
- [actions] backport actions from main
- [Dev Deps] backport updates from main

- [Fix] restore `dist` dir; mistakenly removed in d4f6c32

在 qs 5.2.1 与 6.16.0 之间，Vigia 发现 0 个已删除的导出、0 个已修改的签名，以及 0 个已删除或修改的类或接口成员。

qs 6.16.0 中有 0 个导出或成员新被标记为弃用。