fix(deps): override qs to 6.16.0 for audited advisories

changes/ci-surface-planning.md

@@ -1,8 +1,4 @@
 ### Changed
 
-- CI now runs the full release-candidate matrix for release tags instead of
-  every push to `main`. Main pushes plan from the pushed diff, so untouched
-  surfaces (for example the Android candidate) skip their jobs, and the release
-  workflow waits for the tag's own CI run before promoting its artifacts.
-- Backend tests run once with the race detector and coverage together instead
-  of as two separate suites.
+- CI now runs the full release-candidate matrix for release tags instead of every push to `main`. Main pushes plan from the pushed diff, so untouched surfaces (for example the Android candidate) skip their jobs, and the release workflow waits for the tag's own CI run before promoting its artifacts.
+- Backend tests run once with the race detector and coverage together instead of as two separate suites.

package.json

@@ -51,6 +51,7 @@
     "js-yaml": "4.3.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
+    "qs": "6.16.0",
     "sharp": "0.35.0",
     "tar": "7.5.22",
     "undici": "7.29.0",