… true` silently drops all parameters

…Handling`

Previously the null branch returned the raw `encoder(prefix, ...)` output
(or raw `prefix`) without running it through `formatter`.
With `format: 'RFC1738'` this caused keys containing spaces to serialize as
`%20` in strict-null mode while the normal primitive path produced `+`,
yielding inconsistent output for the same key.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: DeepView Autofix <276251120+deepview-autofix@users.noreply.github.com>
Co-Authored-By: Nikita Skovoroda <chalkerx@gmail.com>
Co-Authored-By: Jordan Harband <ljharb@gmail.com>
Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>

The `utf8=...` charset sentinel was followed by a hardcoded `&`, ignoring `options.delimiter`.
With any non-`&` delimiter the output mixed delimiters (e.g. `utf8=%E2%9C%93&a=1;b=2`), breaking self round-tripping.
Emit the configured delimiter instead, and add a regression test.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: DeepView Autofix <276251120+deepview-autofix@users.noreply.github.com>
Co-Authored-By: Nikita Skovoroda <chalkerx@gmail.com>
Signed-off-by: Nikita Skovoroda <chalkerx@gmail.com>

…ket text

Locks in the round-trip and direct-parse behavior for keys containing literal %5B, %5D, %255B, and %255D text.

…f crashing in `encoder`

When `filter` is an array, its elements become `objKeys` directly and the top-level loop passes each entry as the recursive `prefix` argument without coercion.
A `null` or `undefined` entry reached `utils.encode` as the `str` argument and `str.length` threw `TypeError`.

The crash requires two conditions to align: the filter array must contain `null`/`undefined`, and the object being stringified must have a literal `'null'`/`'undefined'` property
(otherwise `obj[key]` is `undefined` and the typeof-undefined early-return at stringify.js:137 fires before the encoder is called)

Both are reachable from an attacker controlled input in applications that stringify user-submitted JSON with user-selected fields.

Fix this up by skipping `null`/`undefined` filter entries at the top-level loop.
This somewhat matches `JSON.stringify` replacer-array semantics, which silently ignore non-string/non-number entries.
`Object.keys` never yields `null`/`undefined`, so the guard only affects user-supplied filter arrays.
The inner recursive loop already coerces `key` via `String()` when building `keyPrefix`, so it never passes a raw `null` to the encoder.

…a'` + `encodeValuesOnly` instead of crashing in `encoder`

When `arrayFormat: 'comma'` and `encodeValuesOnly: true` were both set, the comma branch passed array entries directly to the encoder via `utils.maybeMap` before the per-element null handling in the main loop.
A `null` or `undefined` entry reached `utils.encode` as the `str` argument and `str.length` threw `TypeError`.

Neither `skipNulls` nor `strictNullHandling` prevented the crash — both are checked downstream of the encode call on line 145, inside the per-`objKeys` loop, but the comma path collapses the entire array into a single `objKeys` entry before the loop runs.

The fix wraps the encoder in a closure that passes `null`/`undefined` through unchanged, so they reach the `join(',')` step as-is.
This matches the non-`encodeValuesOnly` comma path, which already joins before encoding and produces `a=%2Cb` for `{ a: [null, 'b'] }`; under `encodeValuesOnly` the comma stays unencoded as a separator, yielding `a=,b`.
Single-null arrays still collapse to `null` via the existing `obj.join(',') || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.

Same class of issue as the filter-array path fixed in 0c180a4, introduced in 04eac8d (2021-04-19) when the comma + `encodeValuesOnly` branch was first added.