[dependabot]

Removes decode-uri-component. It's no longer used after updating ancestor dependency query-string. These dependencies need to be updated together.

Removes decode-uri-component

Updates query-string from 7.1.3 to 10.0.0

Release notes

Sourced from query-string's releases.

v10.0.0

Breaking

• Require Node.js 22 dc9cd5e
• stringify() now throws a TypeError for values it cannot represent, like objects, functions, symbols, and Date 99d9c07
  • Before, {a: {}} became a=%5Bobject%20Object%5D. Use the replacer option to convert such values.
• parse() now collects a repeated key into an array with every arrayFormat 27018f4 a6d6a7f
  • Before, bracket, index, colon-list-separator, bracket-separator, comma, and separator kept only the last value, so foo=1&foo=2 gave {foo: '2'}.
• An explicit types entry now always takes precedence over parseNumbers and parseBooleans, and a value that does not match its type stays a string 04649de f48a249
• The string[] and number[] types now always give an array (except with arrayFormat: 'none', as documented) 04649de 2a6984f
• A percent-encoded byte that is not valid UTF-8 now decodes to U+FFFD, like URLSearchParams, instead of being kept as-is 19331de
• arrayFormat: 'bracket-separator' no longer splits on a percent-encoded separator, like comma and separator (#398) deb9784
  • foo[]=a%2Cb,c now gives ['a,b', 'c'].
• stringifyUrl() now percent-encodes % in fragmentIdentifier 1602ae0
  • The fragment identifier is now a decoded value, like the query values, so it round-trips with parseUrl(). If you passed an already encoded fragment identifier, pass it decoded.
• pick() and exclude() now write the kept parameters back exactly as they were in the URL 1646c64 e087ca9 a7391f2
  • Options like parseNumbers, parseBooleans, types, and decode only change the value the filter receives. Before, pick('https://foo.bar?id=007', ['id'], {parseNumbers: true}) gave id=7.

Improvements

• Remove the decode-uri-component dependency and decode in linear time 19331de
  • The old decoder was quadratic for some malformed input.
• Fix parse() being quadratic for a key that repeats many times with arrayFormat: 'comma' and 'separator' 00a52ff
• TypeScript: The parsed value types now follow the parseNumbers, parseBooleans, and types options, also for parseUrl(), pick(), and exclude() d239f4f 472777f 789fc36
• An option that is explicitly undefined now uses its default value 1646c64

Fixes

• Fix stringify() output that did not parse back to the same value 13bc381 b63dc56 deb9784
  • This affected a separator like - or . inside a value, null items with colon-list-separator, and arrays that became empty after skipping items with bracket-separator.
• Fix stringify() throwing URIError for a string with a lone surrogate b9ff3f8
• Fix the sort option 220906a 678ddff 6c6506d
  • sort: true threw in stringify(), parse() threw when sort was not a boolean or a function, sort: false broke arrayFormat: 'index', and pick() ignored sort: false.
• Fix stringifyUrl() turning an index format array that is already in the URL into [object Object] (#422) 220906a
• Fix stringifyUrl(), pick(), and exclude() corrupting the query and the fragment identifier with encode: false 7268b7a c75c681
• Fix stringifyUrl() changing the parameters that are already in the URL when you give it parse options 93c3e1e
• Fix parseUrl() and stringifyUrl() keeping leading and trailing whitespace 1d91dbf 93c3e1e
• Fix parse() throwing for arrayFormat: 'index' when a plain value comes before the indexed entries 8e9d58d
• Fix parse() using types keys inherited from Object.prototype, like toString (#421) 0682872
• Fix stringify() ignoring the replacer result for skipNull and skipEmptyString 42210ea
• Fix stringify() reading each value twice, which ran getters and Proxy traps two times 5e50210
• Fix stringifyUrl() not accepting an interface for query cd042b8

---

sindresorhus/query-string@v9.5.1...v10.0.0

v9.5.1

• Fix stringifyUrl() dropping a leading # in the fragment identifier and throwing on some absolute URLs 47b5b30

... (truncated)

Commits

• bea7bdc 10.0.0
• 76b3968 Tweaks
• 678ddff Fix parse() throwing for a sort that is not a boolean or a function
• c75c681 Fix pick() and exclude() corrupting the query for an encode that is null
• 19331de Replace decode-uri-component with a linear decoder
• dc9cd5e Require Node.js 22
• 8623e20 Ignore a types value that is not a supported type for an array too
• c4cd28a More tests
• f016142 Simplify the array format encoder and parser
• 93c3e1e Fix stringifyUrl() rewriting the query parameters in the URL and keeping le...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.