✨ port qs 6.16.0 behavior

[techouse]

Description

Port four behavior changes from upstream Node qs v6.15.3 to v6.16.0:

• Encode literal dots in top-level primitive keys when encodeDotInKeys is enabled.
• Add opt-in EncodeOptions.depth (unbounded by default) to limit encoding depth.
• Serialize DateTime values after function filters, including comma-format lists.
• Enforce strict list limits on comma groups under []= before value decoding.

The README, changelog, and executable example cover the updated behavior and option semantics. The comparison package now uses upstream qs v6.16.0.

Issue: No repository issue is linked. Upstream reference: qs v6.15.3…v6.16.0.

Type of change

• Bug fix (non-breaking behavior fixes)
• New feature (EncodeOptions.depth)
• This change requires a documentation update

How Has This Been Tested?

• rtk bash test/comparison/compare_outputs.sh — Node, Dart VM, and dart2js outputs matched.
• rtk dart pub global run coverage:test_with_coverage — all 774 tests passed; local line coverage is 97.9% (1,414/1,444), excluding the 22-line human-readable EncodeOptions.toString() diagnostic representation from coverage.
• rtk dart test test/unit/decode_test.dart test/unit/models/encode_options_test.dart test/unit/format_test.dart --reporter compact — focused regressions passed.
• rtk dart analyze test/unit/decode_test.dart test/unit/models/encode_options_test.dart test/unit/format_test.dart — no issues found.
• rtk dart analyze lib/src/models/encode_options.dart — no issues found after adding the coverage directive.

Focused cases include dotted primitive keys, encode-depth boundaries, filtered DateTime serialization, strict comma-list limits after custom decoding, zero-width RegExp delimiters at query boundaries, and the documented Format.toString() names.

Checklist

• Code follows the project style guidelines.
• Self-review completed.
• Comments are included where needed; the coverage directive explains the excluded diagnostic method.
• Corresponding README, changelog, and example changes are included.
• Analysis reports no new warnings.
• Tests cover the added and corrected behavior.
• New and existing unit tests pass locally.
• No downstream dependent changes are required.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 55f9ad53-033d-46a2-8646-ab0dbb43db87

📥 Commits

Reviewing files that changed from the base of the PR and between a8174db and 5b66295.

📒 Files selected for processing (2)

• test/unit/decode_test.dart
• test/unit/format_test.dart

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

This change adds an optional encoding depth limit and updates encoding and decoding behaviour for dotted top-level keys, filtered dates, and comma-separated groups. Documentation, examples, and tests cover these changes and related decoding cases.

Changes

Query serialisation and parsing

Layer / File(s)	Summary
Decode comma-group limits lib/src/extensions/decode.dart, test/unit/decode_test.dart, README.md, example/example.dart	Strict comma-group limits now apply to comma-split values on list-growth paths. Tests cover limit boundaries, nested bracket-push groups, and decoder invocation. Documentation and examples also clarify list representation and related decode behaviour.
Encoding depth option and traversal lib/src/models/encode_options.dart, lib/src/models/encode_config.dart, lib/src/qs.dart, lib/src/extensions/encode.dart, test/unit/encode_test.dart, test/unit/encode_edge_cases_test.dart, test/unit/models/*, README.md, example/example.dart, test/comparison/package.json, CHANGELOG.md	EncodeOptions.depth defaults to double.infinity and is passed into the root encoding configuration. The encoder throws RangeError when traversal exceeds a finite limit and avoids the linear-chain fast path for finite limits. Tests and examples cover depth boundaries. The comparison package updates its pnpm and qs versions.
Filtered dates and dotted-key encoding lib/src/qs.dart, lib/src/extensions/encode.dart, test/unit/encode_test.dart, README.md, example/example.dart	When encodeDotInKeys is enabled, top-level keys with dots are passed with dots replaced by %2E. Date serialisation follows filter callbacks, including for dates returned by filters and comma-format lists.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant EncodeOptions
  participant QS.encode
  participant _$Encode._encode
  EncodeOptions->>QS.encode: supplies depth
  QS.encode->>_$Encode._encode: passes the root configuration with depth
  _$Encode._encode-->>QS.encode: returns encoded output or throws RangeError

Loading

Merge Risk: ⚪ Minimal · up to 5b662

No actionable merge-blocking behavior is identified in the reviewed changes. The changes document and test their new encoding and decoding boundaries.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 5b662

The changes stay within the query library. Strict decoding rejects more oversized comma groups, and the new encoding depth limit is opt-in. No introduced security issue was established, but the behavior of applications using the library is not visible here.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The independently assessable exposure is the existing library API. Applications may pass untrusted query strings to it, but their identities, privileges, and downstream sinks are not represented in the available source.

Trust Boundaries and Controls

• observed — For strict comma parsing, the changed check rejects oversized groups before invoking a value decoder, while post-decoding promotion checks iterable values against the same configured limit. Non-strict oversized groups remain accepted as documented by the tests.

Hardening Proposals

• proposed — Applications using encoding depth as a resource safeguard should choose and validate a finite bound and retain separate size limits: the default is unbounded, and a nesting bound alone does not bound output width.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The pull request title ':sparkles: port qs 6.16.0 behavior' is directly related to the main objective. The PR ports four specific behaviour changes from upstream Node qs v6.15.3 to v6.16.0. However, t…
Description check	✅ Passed	The pull request description is comprehensive and well-structured. It includes: a clear summary of the four behaviour changes ported from qs v6.16.0; type of change selections with appropriate checkbo…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the depth and hops,
Through nested maps, it counts the drops.
Dotted keys and dates pass through,
Comma groups meet their limits too.
The changelog gets a carrot crown.}

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

🟢 Coverage 100.00% diff coverage · +0.13% coverage variation

Metric	Results
Coverage variation	✅ +0.13% coverage variation (-1.00%)
Diff coverage	✅ 100.00% diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (3aa211a)	1452	1420	97.80%
Head commit (740a6a9)	1444 (-8)	1414 (-6)	97.92% (+0.13%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#65)	15	15	100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.92%. Comparing base (3aa211a) to head (740a6a9).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #65      +/-   ##
==========================================
+ Coverage   97.79%   97.92%   +0.12%     
==========================================
  Files          20       20              
  Lines        1452     1444       -8     
==========================================
- Hits         1420     1414       -6     
+ Misses         32       30       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.