Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

• Fix prototype pollution in merge (<<).

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• ab85ae2 3.15.1 released
• 30a5e76 dist rebuild
• 22a8071 Backport quadratic complexity fix for !!omap
• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• Additional commits viewable in compare view

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

• ci: backport npm-publish workflow from master by @​UlisesGascon in expressjs/body-parser#769
• 1.20.8 by @​UlisesGascon in expressjs/body-parser#770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

• docs: include security fix in 1.20.6 changes by @​UlisesGascon in expressjs/body-parser#747
• deps: qs@~6.16.0 by @​krzysdz in expressjs/body-parser#761
• 1.20.7 by @​UlisesGascon in expressjs/body-parser#767

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• fix: improve limit option validation by @​Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

• refactor(json): simplify strict mode error string construction by @​jonchurch in expressjs/body-parser#692
• fix: correct off-by-one error in parameterCount by @​abhu85 in expressjs/body-parser#716
• deps(qs): bump qs to 6.15.1 by @​jonchurch in expressjs/body-parser#722
• Release: 1.20.5 by @​jonchurch in expressjs/body-parser#721

New Contributors

• @​abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

... (truncated)

Sourced from body-parser's changelog.

1.20.8

• Same code base as 1.20.7. This was created to test the new release process.

1.20.7

• deps: qs@~6.16.0

1.20.6

• Security fix for GHSA-v422-hmwv-36x6
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit

1.20.5

• refactor(json): simplify strict mode error string construction
• fix: extended urlencoded parsing of arrays with >100 elements (#716)
• deps: qs@~6.15.1

1.20.4

• deps: qs@~6.14.0
• deps: use tilde notation for dependencies
• deps: http-errors@~2.0.1
• deps: raw-body@~2.5.3

1.20.3

• deps: qs@6.13.0
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: raw-body@2.5.2

• 5c08c20 1.20.8 (#770)
• 0cea4f4 ci: backport npm-publish workflow from master (#769)
• 0f0f0d7 1.20.7 (#767)
• 355eb04 deps: qs@~6.16.0 (#761)
• 8be369a docs: include security fix in 1.20.6 changes
• 5cc4fb8 1.20.6 (#746)
• 3492672 fix: improve limit option validation (#741)
• 0defdbe release(patch): 1.20.5
• cd0e7a0 deps(qs): bump qs to 6.15.1
• 6f24d7e fix: correct off-by-one error in parameterCount (#716)
• Additional commits viewable in compare view

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Sourced from browserslist's releases.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

4.28.1

• Removed Baseline warning since we have it own warning.

4.27.0

• Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

• Fixed throwOnMissing with extends query (by @​alexander-akait).

... (truncated)

Sourced from browserslist's changelog.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

• b4809dd Release 4.29.3 version
• 9d844f8 Update Firefox ESR
• 0033f34 Update dependencies
• 906d329 Release 4.29.2 version
• ff8c83f Update dependencies
• 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
• f760921 Do not add versions without usage data to cover queries
• 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
• 1e5356f Note that Android version queries return only the latest version
• 5b7e941 Add missed changes to ChangeLog
• Additional commits viewable in compare view

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Sourced from colord's releases.

v2.10 (RGB color mixing)

• mix, tints, shades and tones (mix plugin) now accept an optional interpolation color space. LAB stays the default; pass "rgb" to interpolate RGB channels instead — the way browsers and design tools (such as Figma) composite translucent layers.

import { colord, extend } from "colord";
import mixPlugin from "colord/plugins/mix";
extend([mixPlugin]);
colord("#ff0000").mix("#ffffff", 0.5, "rgb").toHex(); // "#ff8080"
colord("#f0f3f1").mix("#007d40", 0.14, "rgb").toHex(); // "#cee2d8" — same as compositing rgba(0, 125, 64, 0.14) over #f0f3f1
colord("#ff0000").tints(3, "rgb").map((c) => c.toHex()); // ["#ff0000", "#ff8080", "#ffffff"]

Sourced from colord's changelog.

2.10.0

• Improve mix plugin by adding an optional "rgb" interpolation mode to mix, tints, tones and shades

2.9.7

• Make HEX parsing and serialization more than 2x faster

2.9.6

• Fix: Rotate the unrounded hue so rotate and harmonies preserve the original color
• Fix: Normalize HWB whiteness + blackness over 100% to gray ❤️ @​spokodev

2.9.5

• Fix: Use adjusted chroma for the CIEDE2000 rotation term ❤️ @​maximilliangrand
• Fix: Keep the hue within [0, 360) in every color model ❤️ @​sarathfrancis90

Both fixes change returned numbers for a small set of colors; toHex() output is unchanged. Snapshots holding h: 360, "hsl(360, …)" or a delta() value may need updating.

2.9.4

• Fix: Reject malformed color strings in linear time ❤️ @​GAP-dev

• See full diff in compare view

Sourced from dompurify's releases.

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

... (truncated)

• b9b9d80 release: 3.4.16 (#1636)
• 1d7460c release: 3.4.15 (#1609)
• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• Additional commits viewable in compare view

This version adds prepare script that runs during installation. Review the package contents before updating.

Sourced from form-data's changelog.

v3.0.5 - 2026-06-12

Commits

• [Fix] escape CR, LF, and " in field names and filenames 8777e67
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape 27c61a5
• [Deps] update hasown 6a8a1c6

v3.0.4 - 2025-07-16

Fixed

• [Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

• [eslint] update linting config f5e7eb0
• [meta] add auto-changelog d2eb290
• [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 e8c574c
• [Fix] Switch to using crypto random for boundary values c6ced61
• [Refactor] use hasown 1a78b5d
• [Fix] validate boundary type in setBoundary() method 70bbaa0
• [Tests] add tests to check the behavior of getBoundary with non-strings b22a64e
• [meta] actually ensure the readme backup isn’t published 0150851
• [meta] remove local commit hooks fc42bb9
• [Dev Deps] remove unused deps a14d09e
• [meta] fix scripts to use prepublishOnly 11d9f73
• [meta] fix readme capitalization fc38b48

v3.0.3 - 2025-02-14

Merged

• [Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

Fixed

• [Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

Commits

• [Refactor] use Object.prototype.hasOwnProperty.call 7fecefe
• [Dev Deps] update @types/node, browserify, coveralls, cross-spawn, eslint, formidable, in-publish, pkgfiles, pre-commit, puppeteer, request, tape, typescript 8261fcb
• Only apps should have lockfiles b82f590
• [Dev Deps] pin request which via tough-cookie ^2.4 depends on psl e5df7f2
• [Deps] update mime-types 5a5bafe

v3.0.2 - 2024-10-10

Merged

... (truncated)

• be3f3cf v3.0.5
• 6a8a1c6 [Deps] update hasown
• 27c61a5 [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape
• 8777e67 [Fix] escape CR, LF, and " in field names and filenames
• 9c82fcd v3.0.4
• e8c574c [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
• c6ced61 [Fix] Switch to using crypto random for boundary values
• 0150851 [meta] actually ensure the readme backup isn’t published
• fc38b48 [meta] fix readme capitalization
• d2eb290 [meta] add auto-changelog
• Additional commits viewable in compare view

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

This version modifies prepublish script that runs during installation. Review the package contents before updating.

• 4ae6af9 17.13.8
• b3ed6fb Merge pull request #3153 from hapijs/fix/messages-proto-flat-v17
• 1d2001c chore: backport #3151
• ed9d7cd 17.13.7
• f2729f7 Merge pull request #3145 from hapijs/backport/isodate-timeshift-v17
• c43fc96 chore: add regression test for #3143
• 115e7b5 fix(isoDate): pad a bare-hour timeshift with a colon, not just zeros
• 850be1e 17.13.6
• 9faeecc Merge pull request #3139 from hapijs/chore/backport-messages-proto
• 8d0b808 fix: prevent messages proto injection
• Additional commits viewable in compare view

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

2.30.1

Note - this was not a new release, but rather just updating GitHub's latest release to indicate the existing version 2.30.1 from Dec 27, 2023.

... (truncated)

Sourced from moment's changelog.

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

2.30.1

... (truncated)

• 15b45d4 [pkg] Build 2.31.0 (#6452)
• 631cd81 [pkg] Update changelog for upcoming release (#6394)
• 6caff9e Merge commit from fork
• 710703b [feature] Add internal date-default hook for Moment Timezone (#6451)
• 863ed94 [bugfix] Add stack traces to conditional deprecation warnings (#6450)
• 2c7abe1 [bugfix] Apply postformat to locale relative time methods (#6448)
• 9c45ac3 [bugfix] Include metadata in all-locales bundle (#6447)
• f6eefc5 [bugfix] Validate timezone offset range (#6446)
• 136b441 [bugfix] Avoid Object.assign in duration.humanize (#6443)
• 0d10504 [bugfix] Fix locale('proto') corrupting the global locale (#6442)
• Additional commits viewable in compare view

This version was pushed to npm by GitHub Actions, a new releaser for moment since your current version.

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

• [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
• [Deps] update @ljharb/eslint-config
• [Dev Deps] update @ljharb/eslint-config, iconv-lite
• [Tests] increase coverage

6.15.0

• [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
• [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

• [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
• [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
• [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

... (truncated)

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

• [New] parse: support here-documents (<<) [#31](https://github.com/ljharb/shell-quote/issues/31)

Commits

• [New] parse: support tab-stripping here-documents (<<-) ...

  Description has been truncated