chore(deps): security bumps

[ntucker]

Pins patched versions for known npm/GHSA advisories. This is a security-only bump — not a broad minor/patch Renovate sweep.

Supersedes #4079 (qs 6.15.3 → 6.16.0). Standalone example Dependabot PRs (todo-app / github-app / nextjs) are left alone; those apps are not yarn workspaces.

Motivation

yarn npm audit --recursive reported several real GHSA/CVE findings in the workspace lockfile. Existing resolutions already cover tar, serialize-javascript, dompurify, socks, uuid, and sigstore. This PR adds the remaining actionable patches that do not require a published-package major.

Solution

Only one new root resolution: qs (>=6.16.0). Express / body-parser request qs@~6.15.1, so Yarn will not take 6.16.0 from the lockfile alone.

Everything else is an in-range lockfile pin (parent ranges already allow the patched release). No published runtime dependency majors. No changeset.

Package	Before	After	How	Advisories
qs	6.15.3	6.16.0	resolution	GHSA-x5fp-wj9c-mxmx / CVE-2026-82562, GHSA-4mjr-xmp4-gh2g / CVE-2026-82417
browserslist	4.28.2	4.28.9	lockfile	GHSA-c83g-rgw3-j3cx, GHSA-73wf-gq98-2v4g (high)
baseline-browser-mapping	2.10.27	2.11.21	lockfile	GHSA-w5vr-8v7q-w6rv
@humanfs/node	0.16.6	0.16.8	lockfile	GHSA-p498-v437-472g
js-yaml	3.15.1 / 4.3.1	3.15.2 / 4.3.2	lockfile	GHSA-2883-xcg3-v3hh (high)
nanoid	3.3.17	3.3.18	lockfile	GHSA-2v37-7h3g-55p8 (high)

Browserslist 4.28.9 also refreshed its usual data deps (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db). @humanfs/node 0.16.8 pulled @humanfs/core 0.19.2.

Intentionally not bumped

Package	Why
decode-uri-component 0.2.2 (via query-string@7 / React Navigation)	Only patched release is ESM-only 0.5.0; forcing it would break CJS query-string@7.
image-size 1.0.2 (via Metro 0.84)	GHSA-w3rx-r6r6-pgpr / GHSA-5p2g-fcmc-qvqq: no official patched version (<=2.0.2, latest is 2.0.2). A community fork would force 2.x onto Metro 1.x.
pacote 15.2.0 (via rollup-plugin-filesize)	Fix is >=21.5.1 (major). Already have 21.5.1 elsewhere in the tree; forcing it on the v15 consumer is a breaking jump.
eslint / glob / inflight / node-domexception / read-package-json / sourcemap-codec / whatwg-encoding	Audit deprecation notices, not actionable GHSA patches.

Audit summary (workspace, after)

Actionable GHSA items above are cleared. Remaining yarn npm audit hits are the skipped packages plus deprecation warnings.

Standalone examples (todo-app, github-app, nextjs) keep their own npm lockfiles; Dependabot already has browserslist / fast-uri / postcss-selector-parser / svgo PRs for those.

Testing

• Smoke: qs@6.16.0, js-yaml@4.3.2, nanoid@3.3.18, browserslist@4.28.9 load successfully
• Prior HEAD on this branch already ran the ReactDOM / ReactNative / Node slice for packages/react (same resolved versions)

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: a58e967

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs-site	Ignored	Preview	Sep 10, 2026 6:45pm UTC

[github-actions]

Size Change: 0 B

Total Size: 81 kB

ℹ️ View Unchanged

Filename	Size
examples/test-bundlesize/dist/App.js	1.46 kB
examples/test-bundlesize/dist/polyfill.js	307 B
examples/test-bundlesize/dist/rdcClient.js	10.9 kB
examples/test-bundlesize/dist/rdcEndpoint.js	8.07 kB
examples/test-bundlesize/dist/react.js	59.6 kB
examples/test-bundlesize/dist/webpack-runtime.js	784 B

_{compressed-size-action}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.84%. Comparing base (c28a0b4) to head (a58e967).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4083   +/-   ##
=======================================
  Coverage   97.84%   97.84%           
=======================================
  Files         156      156           
  Lines        3057     3057           
  Branches      612      612           
=======================================
  Hits         2991     2991           
  Misses         18       18           
  Partials       48       48           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ntucker]

Staff review — LGTM / FOLLOW_UP-only (no CHANGE_THIS_PR)

Security-scoped, not a Renovate sweep. One justified new resolution (qs >=6.16.0 for Express/body-parser’s ~6.15.1), everything else in-range lockfile pins. Matches existing resolution style (tar, serialize-javascript, …). Skips for decode-uri-component / image-size / pacote are the right call (ESM-only, unpatched, or major). No changeset is correct. Bundle size 0.

FOLLOW_UP (after merge, not this PR): close Renovate #4079 (qs security) as superseded. Standalone example npm lockfiles stay on Dependabot — fine out of this PR.

Hold merge until Bugbot + CI are green. Squash when ready.