[dependabot]

Bumps qs from 6.15.2 to 6.17.1.

Changelog

Sourced from qs's changelog.

6.17.1

• [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as surrogate pairs (#640)
• [Fix] parse: respect plainObjects for [] with parseArrays: false (#639)
• [Fix] utils: merge: count the elements of a sparse array against arrayLimit, not its holes
• [Fix] parse: guard bracket-wrapped prototype keys at depth 0 (#638)
• [Refactor] parse: extract wrapping-bracket stripping helper
• [readme] document that depth: 0 and depth: false keep keys flat
• [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by allowPrototypes/plainObjects

6.17.0

• [New] stringify: add WHATWG format (#623)
• [Fix] stringify: do not sort the caller's filter array in place (#637)
• [Fix] parse: copy an own __proto__ key as data (#636)
• [Fix] parse: decode percent-encoded dots case-insensitively (#635)
• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [Fix] parse: preserve comma arrays when interpreting numeric entities (#630)
• [Fix] parse: allow scalar fields with a zero array limit (#627)
• [Fix] parse: do not count an existing comma array toward arrayLimit when duplicates discards or replaces it
• [Fix] utils: encode: encode lone surrogates as U+FFFD instead of consuming the next code unit (#624)
• [eslint] fix indentation
• [readme] document the encoder's format argument
• [meta] add changelog acknowledgement
• [meta] fix changelog indents
• [Dev Deps] update eslint, evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding
• [Tests] stringify: pin sort order for nested keys selected by an array filter
• [Tests] parse: cover interpretNumericEntities across value shapes, keys, and the charset sentinel
• [Tests] parse: cover more input that builds no array at a zero or negative arrayLimit
• [Tests] parse: cover comma with a zero or negative arrayLimit, and combining a full comma array
• [Tests] parse: pin the behavior of a zero or negative arrayLimit
• [Tests] utils/stringify: pin ~, *, and parens encoding in RFC3986 and RFC1738

6.16.2

• [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
• [meta] use double quotes for better OS support
• [Dev Deps] update evalmd, npmignore
• [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)

... (truncated)

Commits

• 43baea4 v6.17.1
• 54623b6 [Fix] parse: interpretNumericEntities: decode code points above U+FFFF as...
• 7924b65 [Fix] parse: respect plainObjects for [] with parseArrays: false
• 7d4b440 [readme] document that depth: 0 and depth: false keep keys flat
• 101492a [Fix] utils: merge: count the elements of a sparse array against `arrayLi...
• 42eccf0 [Fix] parse: guard bracket-wrapped prototype keys at depth 0
• ae0b5c7 [Refactor] parse: extract wrapping-bracket stripping helper
• 6459f9f [Tests] parse: pin depth-0 bracket stripping and prototype keys kept by `al...
• cb6855c Merge backport release tags v6.12.6–v6.16.2 into main
• 136912a v6.16.2
• Additional commits viewable in compare view

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase

[Changyong Gong (chagong)]

Decision: NOT_MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-gradle
Pull request: microsoft/vscode-gradle#1978 - chore(deps-dev): bump qs from 6.15.2 to 6.17.1 in /extension
Update: qs 6.15.2 -> 6.17.1 (minor); side-channel 1.1.0 -> 1.1.1 and side-channel-list 1.0.0 -> 1.0.1 (patch); indirect development dependencies.
Safety assessment: Dependabot-only history; low-risk, lockfile-only Standard Dependency Gate. qs provides query serialization through typed-rest-client for @vscode/vsce packaging; no direct qs declaration to remove. Complete diff, release notes, engines and registry integrity reviewed; no unresolved review threads or requested changes.
Final state: OPEN; head bd86dba; MERGEABLE/BLOCKED; REVIEW_REQUIRED. Live develop tip 08599a4 included (behind_by=0). CI: 16 SUCCESS, 1 NEUTRAL, 3 FAILURE, 0 pending. Failed: microsoft.vscode-gradle.CI; microsoft.vscode-gradle.CI (Build VSCode-Gradle-CI); microsoft.vscode-gradle.CI (Build Validate dependencies from CFS) - each INDETERMINATE.
Actions taken: Requested and verified Dependabot (@dependabot) rebase: b8ba68a -> bd86dba; restarted the audit and polled all new-head checks to completion. GitHub build/lint, packaging, platform and E2E checks passed. Retrieved every failed Azure check's annotations; full logs and timeline for build 32432999 returned HTTP 401. Baseline CI also fails, but at testVsCode rather than this head's build/CFS steps, so causality remains unproven. No rerun, source remediation, commit, push, approval or merge; no local test suite run. Recorded the observed gh api pagination limitation in the workspace manager configuration.
Reason: Three failed Azure checks lack verifiable causality. Code-owner/last-push approval remains required; classic branch-protection discovery returns HTTP 403, leaving required-check policy incompletely verifiable.
Next action: A maintainer with Azure access must inspect build 32432999, classify and resolve its failed jobs, obtain successful current-head checks and required approval, and verify branch protection before retrying management.

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase