fix(security): remediate qs vulnerability

[GioDavid]

Summary

Updates transitive qs from 6.15.2 to 6.16.0. That release fixes the two advisories that still apply to the installed version:

• CVE-2026-82562 / GHSA-x5fp-wj9c-mxmx (CWE-770, medium): arrayLimit / throwOnLimitExceeded bypass for bracket-key comma parsing when comma: true. Affected >= 6.14.2, <= 6.15.3. Patched in 6.16.0.
• CVE-2026-82417 / GHSA-4mjr-xmp4-gh2g (CWE-248, CWE-703, medium): qs.stringify throws TypeError when constructor.isBuffer is not callable. Affected >= 2.2.5, < 6.16.0. Patched in 6.16.0.

Earlier qs advisories (CVE-2026-8723, CVE-2026-2391, CVE-2025-15284) are already fixed in 6.15.2.

qs is not a runtime dependency of the published library. It is present in the example app's React Native CLI dev server and in the test toolchain. The vulnerable option combinations are not the ones these parents use by default, so this is a dependency-inventory fix rather than a demonstrated exploit in this repository.

Dependency path

Transitive, one installed version, both paths now resolve to 6.16.0:

example
  → @react-native-community/cli@20.1.3
    → @react-native-community/cli-server-api@20.1.3
      → body-parser@2.3.0 (qs ^6.15.2)
        → qs@6.16.0

react-native-spotlight-tour
  → react-native-testing-mocks@1.7.0
    → rewiremock@3.14.6
      → node-libs-browser@2.2.1
        → url@0.11.4 (qs ^6.12.3)
          → qs@6.16.0

• Immediate parents: body-parser (example dev server) and url (test polyfill).
• Higher-level parents: @react-native-community/cli and node-libs-browser.
• Role: example development tooling and test-only browser polyfill. Not shipped in the library runtime.

Package-only investigation

Both requested ranges already allow 6.16.0 (^6.15.2 and ^6.12.3). yarn up -R qs updates only yarn.lock. side-channel stays at 1.1.1; its descriptor now also matches ^1.1.1. es-define-property was already in the lockfile and is a new direct dependency of qs@6.16.0.

Parent investigation

No supported parent update changes the qs constraint:

• body-parser@2.3.0 and url@0.11.4 are the latest releases. Both already accept 6.16.0.
• node-libs-browser@2.2.1, rewiremock@3.14.6, and react-native-testing-mocks@1.7.0 are the latest releases.
• @react-native-community/cli@20.2.0 still depends on body-parser@^2.2.2, which is already resolved to 2.3.0. It does not change the qs range, so it was not applied.

Final remediation

yarn.lock only: qs 6.15.2 → 6.16.0.

Why

A lockfile update reaches the patched release inside the ranges the parents already declare. A parent upgrade cannot remove qs or tighten it further, and the CLI minor would be an unrelated toolchain change.

Validation

• yarn install
• yarn why qs shows 6.16.0 on both paths
• yarn test (22 tests passed)
• yarn lint
• yarn npm audit no longer reports qs

Scope

This PR only remediates qs. Other audit findings, including brace-expansion, minimatch, and tmp, are unchanged.

Test plan

• Confirm yarn why qs resolves 6.16.0 for both body-parser and url
• yarn test
• yarn lint
• yarn npm audit does not report qs

Made with Cursor

[GioDavid]

solved using dependabots