chore: upgrade qs to ^6.16.0 to address CVE-2026-82417, CVE-2026-82562

[claude]

Fixes SOU-2127
Fixes SOU-2128

Summary

qs resolved to 6.15.2, which is affected by two advisories. The repo already carries a qs resolution, but its floor of ^6.14.2 still admitted the vulnerable version. This raises the floor to ^6.16.0.

Advisories addressed

CVE	GHSA	Summary
CVE-2026-82417	GHSA-4mjr-xmp4-gh2g	qs.stringify throws a TypeError on objects with a non-callable constructor.isBuffer
CVE-2026-82562	GHSA-w7fw-mjwx-w883	DoS via arrayLimit bypass for a[]= keys when parsing with comma: true and throwOnLimitExceeded: true

Both are fixed in 6.16.0.

Verification

• yarn why qs reports every requester (@gitbeaker/core, @gitbeaker/requester-utils, body-parser@1.20.6, body-parser@2.3.0, express@4.22.2, express@5.2.1, typed-rest-client) resolving to qs@npm:6.16.0. No affected version remains in the graph.
• yarn install --immutable succeeds.
• yarn build:deps succeeds.
• yarn test passes (2153 tests across queryLanguage, shared, backend, and web).

🤖 Generated with Claude Code

---

Note

Low Risk
Transitive dependency pin with no application code changes; typical low-risk security patch bump.

Overview
Raises the Yarn resolutions floor for qs from ^6.14.2 to ^6.16.0, so the lockfile no longer resolves 6.15.2 and instead pins qs@6.16.0 across transitive consumers (e.g. Express/body-parser, GitBeaker).

This is a dependency-only change to address CVE-2026-82417 (stringify / constructor.isBuffer) and CVE-2026-82562 (DoS via arrayLimit bypass with comma: true). The lockfile also picks up qs’s updated side-channel / side-channel-list entries.

^{Reviewed by Cursor Bugbot for commit 15c49d2. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Raises the existing qs resolution floor from ^6.14.2 (which resolved to vulnerable 6.15.2) to ^6.16.0, fixing SOU-2127 and SOU-2128. The upgrade addresses the qs.stringify TypeError and arrayLimit denial-of-service bypass without application-code changes.

• Updates the lockfile and transitive side-channel dependencies so every requester resolves to qs@6.16.0.
• Verified with an immutable install, dependency build, and 2,153 passing tests.

^{Written for commit 15c49d2. Summary will update on new commits.}

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.