fix: nested query keys containing literal bracket pairs

[codefix-patchflow]

What failed

Parsing a query key like:

search[withbracket[]]=foobar

treated the inner [] as the only recognizable bracket segment. That made the parser split the parent key incorrectly and return:

{ "search[withbracket": ["foobar"] }

The intended behavior is to keep withbracket[] as the nested property name under search.

What changed

Replaced the regex-only bracket segment matcher in lib/parse.js with a small scanner that finds balanced bracket segments The scanner preserves normal nested syntax such as a[b][c], while allowing bracket pairs inside a segment, such as search[withbracket[]], to remain part of that segment's key name

• lib/parse.js around line 214 (modified, +39/-6)

Why this works

The previous regex could only match bracket groups that contained no [ or ], so it skipped the outer search[...] segment and matched the inner [] instead The new scanner counts nested brackets until the outer segment closes. This produces the segment [withbracket[]], which the existing object builder already converts into the literal key withbracket[] Prototype-key checks and depth-limit remainder handling still run through the same splitKeyIntoSegments path

Expected result

qs.parse('search[withbracket[]]=foobar') should now produce a nested search object with the property name withbracket[], matching the stringify/parse round trip from the failure report Existing array notation and depth-limit behavior should remain unchanged

Patchflow did not run repository-local commands; the automated review gate checks the patch without assuming the project full runtime environment is available.

🔧 Fixed automatically by Patchflow — $1/fix · no fix, no fee

Automation details

• Job ID: 72ce387f-2b25-4bc2-860e-556ae21aa957
• Repository: CDEN190/qs
• Branch: codefix/72ce387f-search-parameters-with-closing-square-bracket-in
• Base branch: patchflow-red-qs-493
• Reference command: None
• Review gate: automated static review; repository-local commands were not executed.