chore(deps): force qs >=6.16.0 via pnpm override

[teallarson]

Resolves PLT-3415 and Dependabot alerts #258 / #259.

What

instantsearch.js (via react-instantsearch) pulls in qs 6.15.2, which is affected by two medium advisories:

• CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx) — array-limit bypass via bracket-key comma parsing
• CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) — DoS via attacker-controlled isBuffer

Both are fixed in 6.16.0. Added a pnpm override pinning qs to >=6.16.0 <7, following the same pattern as the other overrides in pnpm-workspace.yaml. The cap keeps it inside instantsearch.js's declared ^6.5.1 range.

qs 6.16.0 published 2026-08-29, so it's clear of the repo's 7-day minimumReleaseAge guard.

Verification

• pnpm install resolves qs@6.16.0 — no 6.15.2 left in the lockfile
• pnpm build succeeds
• pnpm test — 875 tests across 69 files pass

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only security pin with no app code changes; minor risk if qs 6.16.0 breaks instantsearch.js query parsing, mitigated by existing tests/build verification.

Overview
Adds a pnpm workspace override so transitive qs (from instantsearch.js / react-instantsearch) resolves to >=6.16.0 <7 instead of 6.15.2, addressing CVE-2026-82562 and CVE-2026-82417.

The lockfile is refreshed accordingly (qs@6.16.0 and related side-channel bumps); no application source changes.

^{Reviewed by Cursor Bugbot for commit 2547f79. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 9, 2026 6:06pm UTC