build(deps): bump qs from 6.15.2 to 6.16.0

[sinchubhat]

Resolves CVE-2026-82417 and CVE-2026-82562 by pinning qs to 6.16.0 while keeping Express 4.x unchanged.

PR Checklist

• Unit Tests have been added for new changes
• API tests have been updated if applicable
• All commented code has been removed
• If you've added a dependency, you've ensured license is compatible with Apache 2.0 and clearly outlined the added dependency.

What are you changing?

Anything the reviewer should know when reviewing this PR?

If the there are associated PRs in other repositories, please link them here (i.e. device-management-toolkit/repo#365 )

[Copilot]

🟢 Approval recommended

The change is a focused, low-risk dependency override with corresponding lockfile updates to address the stated CVEs.

Pull request overview

This PR mitigates CVE-2026-82417 and CVE-2026-82562 in the Node.js dependency tree by forcing qs to version 6.16.0 via npm overrides, without changing the project’s Express 4.x dependency.

Changes:

• Add an npm overrides rule in package.json to pin qs to 6.16.0.
• Update package-lock.json to reflect the resolved qs@6.16.0 and its updated transitive dependencies.

File summaries

File	Description
package.json	Adds an npm overrides entry to force qs to 6.16.0.
package-lock.json	Updates the lockfile resolution to qs@6.16.0 and related transitive packages.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.