fix: upgrade qs to 6.10.3, 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, 6.2.4 (CVE-2022-24999)

[anupamme]

Summary

Upgrade qs from 6.5.2 to 6.10.3, 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, 6.2.4 to fix CVE-2022-24999.

Vulnerability

Field	Value
ID	CVE-2022-24999
Severity	HIGH
Scanner	trivy
Rule	CVE-2022-24999
File	package-lock.json
Assessment	Likely exploitable

Description: express: "qs" prototype poisoning causes the hang of the node process

Evidence

Scanner confirmation: trivy rule CVE-2022-24999 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• package.json
• package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[jonathan-r-thorpe]

Bee bop bee bop, hello Mr. Robot. Thank you for your PR. The library in question is nested in request which was replaced in a PR just merged so this vulnerability no longer exists. 🤖 👍

[anupamme]

Thanks for the quick check; glad the request/qs chain is already gone. Closing this out on my end too. 🤖👍