fix(deps): pin qs >=6.16.0 (Dependabot #784, #785)

[kherembourg]

Closes the two remaining open Dependabot alerts. They appeared while CI was running on #291, so they were not part of that batch.

#	Advisory	Severity
785	GHSA-x5fp-wj9c-mxmx — array-limit bypass through bracket-key comma parsing	medium
784	GHSA-4mjr-xmp4-gh2g — denial of service through attacker-controlled isBuffer	medium

qs is transitive. The single chain is @react-native-community/cli-server-api@20.1.0 > body-parser@1.20.6 > qs, so it reaches the Metro dev server only, never a published packages/*.

Change

Same pattern as #291 — the yarn resolutions in the root package.json and the npm overrides in the test project, then both lockfiles regenerated.

Manifest	Was	Now	Patched at
yarn.lock	6.15.2	6.16.0	6.16.0
test-projects/rn-purchasely-test/package-lock.json	6.15.3	6.16.0	6.16.0

The test project is included on purpose. It has no alert of its own yet, but it holds 6.15.3, which sits inside both advisory ranges (2.2.5 - 6.15.3). Fixing it in the same PR stops Dependabot raising a duplicate pair against that lockfile in the coming days. Happy to drop that half if you would rather keep the PR to the two named alerts.

Verification

The resolution crosses the ~6.15.1 tilde that body-parser requests, so the load path was checked rather than assumed:

• qs@6.16.0 stays CommonJS — main: lib/index.js, no "type": "module". This is the opposite of the decode-uri-component case in fix(deps): handle the 16 open Dependabot alerts #291, where every patched version was ESM only and the bump was therefore impossible.
• require('qs').parse('a[b]=1&c=2') → {"a":{"b":"1"},"c":"2"}
• require('body-parser') loads, and bodyParser.urlencoded({extended: true}) still builds its middleware.

Also green: 249 Jest tests, yarn lint 0 errors, yarn typecheck clean, npm ci --ignore-scripts in the test project, lockfileVersion still 3. A per-alert loop confirms the resolved version in each lockfile is at or above the patched version.

The yarn.lock diff touches qs plus its dependency tree (side-channel, side-channel-list). Nothing else moved.

Alert state after this merges

Dependabot recomputes on the default branch, so #784 and #785 close on merge rather than now. That takes the repo to zero open Dependabot alerts: 15 fixed by #291, #777 dismissed as not_used, and these last two fixed here.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR raises the transitive qs dependency to the patched 6.16.0 release in both the root Yarn workspace and React Native test project.

• Adds matching Yarn resolutions and npm overrides constraints.
• Regenerates both lockfiles with qs 6.16.0 and its updated dependency metadata.
• Removes the vulnerable 6.15.x resolutions without changing published package runtime code.

Confidence Score: 5/5

The PR appears safe to merge, with both dependency manifests and lockfiles consistently resolving qs to the patched release.

The changes are limited to compatible dependency overrides and regenerated lockfile metadata, with no accepted build, runtime, or security regression.

Important Files Changed

Filename	Overview
package.json	Adds a root Yarn resolution requiring qs 6.16.0 or newer; the regenerated Yarn lockfile is consistent with it.
yarn.lock	Resolves qs to 6.16.0 and includes its updated es-define-property and side-channel dependency tree.
test-projects/rn-purchasely-test/package.json	Adds the equivalent npm override for the standalone React Native test project.
test-projects/rn-purchasely-test/package-lock.json	Updates the test project’s sole qs installation from 6.15.3 to 6.16.0 with consistent integrity and dependency metadata.

_{Reviews (1): Last reviewed commit: "fix(deps): pin qs >=6.16.0 (GHSA-x5fp-wj..." | Re-trigger Greptile}