fix(whatsapp): override qs to 6.16.0

[Rook-CodeVolt]

What does this PR do?

Adds a temporary exact qs override for the WhatsApp bridge so Express 4.22.2 and body-parser 1.20.6 resolve qs@6.16.0 instead of 6.15.3.

The existing parents both declare qs ~6.15.1, so their ordinary ranges cannot select 6.16.0. This is the smallest bounded change while expressjs/express#7440 remains open; the override should be removed after released Express 4 and body-parser 1.x versions accept qs ~6.16.0.

Related Issue

No public issue. This addresses the dependency security alert reported by Dependabot update run 33760785949.

Type of Change

• 🔒 Security fix

Changes Made

• Add exact "qs": "6.16.0" to scripts/whatsapp-bridge/package.json overrides.
• Regenerate only scripts/whatsapp-bridge/package-lock.json with lifecycle scripts disabled.
• Resolve one hoisted qs@6.16.0 node with registry integrity sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==.

How to Test

1. cd scripts/whatsapp-bridge && npm ci --ignore-scripts --registry=https://registry.npmjs.org
2. npm ls qs express body-parser && npm query '#qs' --json | jq 'length'
3. npm audit --omit=dev --registry=https://registry.npmjs.org && node --check bridge.js
4. From the repository root: uv sync --extra dev --extra messaging
5. uv run --no-sync python -m pytest -q tests/gateway/test_whatsapp_bridge_dir_resolution.py tests/gateway/test_whatsapp_stale_bridge.py tests/gateway/test_whatsapp_connect.py

Verified locally on macOS arm64 with Node 26.7.0/npm 11.19.0: clean install and audit found 0 vulnerabilities; dependency tree contained one qs@6.16.0; bridge-focused tests passed (14 passed, 3 skipped).

A broader WhatsApp test selection also passed (154 passed, 3 skipped), with one pre-existing AsyncMock runtime warning after completion.

Checklist

Code

• I've read the repository development guidance
• My commit message follows Conventional Commits
• I searched for existing PRs in this fork; no open qs PR was found
• My PR contains only this dependency reconciliation
• Full pytest tests/ -q suite (draft: focused bridge and broader WhatsApp selections run locally; CI pending)
• Regression gate is the previously failing npm audit --omit=dev, now clean
• Tested on macOS arm64

Documentation & Housekeeping

• Documentation N/A: no user-facing behavior, setup, API, schema, architecture, or config key changes
• cli-config.yaml.example N/A
• CONTRIBUTING.md / AGENTS.md N/A
• Cross-platform impact considered: lockfile and npm override are platform-neutral; CI remains required
• Tool descriptions/schemas N/A

Review notes

• Keep this PR draft until independent review and exact-head CI pass.
• Do not merge based only on the local audit; re-check the Dependabot update outcome on default branch after an authorized merge.
• Main was 5568abf96342fc3be09dd06f563fa23177a8f960 immediately before the commit.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 08922f0 — fix(whatsapp): override qs to 6.16.0}

⚠️ Action required

package-lock.json · View job

Locked npm dependency versions changed.

scripts/whatsapp-bridge/package-lock.json

Package	Before	After
qs	6.15.3	6.16.0

How to fix:

Add the ci-reviewed label after verifying the version changes are expected.

---

⚠️ Warnings

OSV vulnerability scan · View job

26 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in website/package-lock.json
• CVE-2026-82417 in website/package-lock.json
• CVE-2026-75931 in package-lock.json
• CVE-2026-75931 in website/package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-73088 in package-lock.json
• CVE-2026-73088 in website/package-lock.json
• GHSA-8423-8fgw-73vq in uv.lock
• CVE-2026-70608 in package-lock.json
• CVE-2026-73089 in package-lock.json
• CVE-2026-73089 in website/package-lock.json
• CVE-2026-75975 in package-lock.json
• CVE-2026-75975 in website/package-lock.json
• CVE-2026-75899 in package-lock.json
• CVE-2026-75899 in website/package-lock.json
• CVE-2026-84371 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-76172 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 31m34s vs 26m13s (+20.4%). 8 job(s) slower, 4 faster,

• Python tests / Run tests: +323.0s
• Check no committed infographics / check-no-committed-infographics: -27.0s
• Python lints / ruff enforcement (blocking): -24.0s
• OS-specific tests / macOS-only tests: +11.0s
• Check contributors / check-attribution: +5.0s