fix: Bump qs from 6.15.3 to 6.16.0

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #3446

Bumps the transitive production dependency qs (via express and body-parser) from 6.15.3 to 6.16.0, which fixes the security advisories GHSA-x5fp-wj9c-mxmx and GHSA-4mjr-xmp4-gh2g.

Approach

Lock file only. npm update qs changes only the node_modules/qs entry in package-lock.json.

Changes

• 6.16.0: stringify: add a depth option to bound recursion depth (default Infinity)
• 6.16.0: stringify: serialize Date values when a filter is provided
• 6.16.0: parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set (GHSA-x5fp-wj9c-mxmx)
• 6.16.0: parse: flatten a collection appended to an overflowed array ([Fix] parse: flatten a collection appended to an overflowed array ljharb/qs#571)
• 6.16.0: utils: isBuffer: do not invoke a non-callable constructor.isBuffer (GHSA-4mjr-xmp4-gh2g)
• 6.16.0: stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• 6.16.0: stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set ([Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set ljharb/qs#562)

Breaking Changes

None

Code Changes Required

None. The upgrade is a drop-in replacement. express 5.2.1 uses its default simple query parser (node:querystring), and the dashboard does not change it. body-parser 2.2.2 (urlencoded({ extended: true })) calls qs.parse without the comma or throwOnLimitExceeded options and does not call qs.stringify, so the changed code paths do not apply to normal input.

Tasks

Summary by CodeRabbit

• Chores
  • Updated an underlying component used to process query strings. This maintenance update does not change user-facing features or behavior. No other user-visible changes are included.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 0a4e8b35-3cda-4f9e-b688-48e04b74d719

📥 Commits

Reviewing files that changed from the base of the PR and between 82be421 and b107837.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The lockfile updates the qs dependency from version 6.15.3 to 6.16.0. It also updates the package URL and integrity hash.

Changes

qs Dependency Update

Layer / File(s)	Summary
Update locked qs dependency package-lock.json	The lockfile records qs version 6.16.0 with its updated package URL and integrity hash.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to b1078

No merge-blocking risk is identified in this dependency-only update.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Engage In Review Feedback	❓ Inconclusive	The supplied review metadata reports zero actionable findings for the current review, so it shows no current feedback requiring engagement. It explicitly does not establish whether earlier review comm…	Provide the complete review discussion history, including earlier feedback comments, discussion engagement, and each comment’s final state. Confirm that every applicable comment was either implemented by a commit or retracted after the cont…

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the required fix: prefix and clearly describes the dependency upgrade. The first word after the prefix is capitalized.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the dependency update, security advisories, affected paths, breaking changes, and code changes. The…
Linked Issues check	✅ Passed	Issue #3446 requires upgrading qs from 6.15.3 to 6.16.0. The reviewed change updates the locked qs version, registry URL, and integrity hash in package-lock.json. The change implements the depen…
Out of Scope Changes check	✅ Passed	The reviewed change is limited to the qs lock entry in package-lock.json. This change directly implements issue #3446 and does not show unrelated source, configuration, or dependency changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	The pull request changes only the qs lockfile entry from 6.15.3 to 6.16.0. The patch adds no executable code or parser configuration. express and body-parser resolve their existing qs ranges t…

Full details: Engage In Review Feedback

Explanation

The supplied review metadata reports zero actionable findings for the current review, so it shows no current feedback requiring engagement. It explicitly does not establish whether earlier review comments exist or whether they were resolved after discussion. The repository contains no local review-comment metadata that can answer this gap.

Resolution

Provide the complete review discussion history, including earlier feedback comments, discussion engagement, and each comment’s final state. Confirm that every applicable comment was either implemented by a commit or retracted after the contributor convinced the reviewer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 9.3.0-alpha.8