build(deps): Bump qs from 6.15.2 to 6.16.0

[rsdmike]

Bumps qs from 6.15.2 to 6.16.0.

Advisory: GHSA-x5fp-wj9c-mxmx (medium), GHSA-4mjr-xmp4-gh2g (medium)
Dependency: transitive via express (webpack-dev-server, @modelcontextprotocol/sdk) and @cypress/request; pinned with an npm overrides entry
Build/test: pass on fix/deps-qs-6.16.0

[Copilot]

🟢 Approval recommended

The change cleanly bumps the targeted vulnerable transitive dependency via overrides and the lockfile reflects a single resolved qs@6.16.0 without introducing conflicting versions.

Pull request overview

Updates the transitive qs dependency to address the referenced security advisories by pinning it via npm overrides and refreshing the lockfile to the resolved version.

Changes:

• Add an overrides entry in package.json to force qs to ^6.16.0.
• Update package-lock.json to resolve qs to 6.16.0 (and update its dependency edges accordingly).

File summaries

File	Description
package.json	Adds an overrides.qs entry to pin the vulnerable transitive dependency to the patched range.
package-lock.json	Updates the resolved qs package to 6.16.0 and reflects updated transitive dependencies.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.