* deps: qs@^6.14.0

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

* update history

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

* Apply suggestions from code review

---------

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>
Co-authored-by: Phillip Barta <barta.phillip@gmail.com>

* fix: correct off-by-one error in parameterCount

The `parameterCount` function was counting `&` characters but returning
that count directly. Since the number of parameters equals the number
of `&` characters plus one, this caused an off-by-one error.

For example, with `a[0]=1&a[1]=2&...&a[199]=200` (200 parameters):
- Before: returned 199 (number of `&` chars)
- After: returns 200 (actual parameter count)

This bug became visible with qs@6.14.2 which changed `arrayLimit` to
restrict array length instead of max index. With the buggy count,
large arrays would be converted to objects instead of arrays.

- Fix `parameterCount` to return the actual count of parameters

Fixes #715

* deps(qs): bump to ~6.14.2

* refactor: use 2.x do/while loop for parameterCount

The previous while loop counted '&' separators, so the return value
was (parameter count - 1). That happened to work because old qs
treated `arrayLimit` as a max-index rather than max-length. The
limit check itself was always correct, only the return value was
off relative to the function's name.

Rather than patch with `+1`, port the 2.x version where `count`
directly represents parameter count. The do/while runs once
unconditionally for the first parameter (before any '&'), then
increments per '&' found.

do/while is safe because the caller at line 74 guards empty bodies
(`body.length ? queryparse(body) : {}`). If that guard were removed,
this would incorrectly return 1 for empty input.

Simple parser is unaffected, it only checks for `undefined` and
discards the count. Only the extended parser consumed the value,
as input to qs's `arrayLimit`.

* docs: update HISTORY.md

---------

Co-authored-by: Jon Church <me@jonchurch.com>

* fix: improve limit option validation

* chore: replace arrow functions in tests

* ci: add Node.js 26 to ci matrix

Ref: GHSA-v422-hmwv-36x6

Co-authored-by: krzysdz <krzysdz@users.noreply.github.com>