Fix qs vulnerabilities blocking beta.4 release

.github/osv-release.toml

@@ -1,13 +1,3 @@
 [[IgnoredVulns]]
 id = "GHSA-j965-2qgj-vjmq"
 reason = "aws-sdk v2 has no fixed version reported by OSV. It is retained only as a transitive package while release artifacts are built with scripts disabled, SBOM, and provenance attestations."
-
-[[IgnoredVulns]]
-id = "GHSA-4mjr-xmp4-gh2g"
-ignoreUntil = 2026-09-07
-reason = "qs 6.16.0 is the first fixed version but remains inside the enforced seven-day minimum release-age window. Revisit immediately after the hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-x5fp-wj9c-mxmx"
-ignoreUntil = 2026-09-07
-reason = "qs 6.16.0 is the first fixed version but remains inside the enforced seven-day minimum release-age window. Revisit immediately after the hold expires."

CHANGELOG.md

@@ -11,6 +11,8 @@
 
 ### Fixed
 
+- Update the transitive query-string parser to `qs 6.16.0`, fixing
+  GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx without extending expired exceptions.
 - Normalize replayed tool arguments and bound connection retry behavior.
 - Fence targeted turn and shell cancellation without escalating a stale target
   into an unrelated global abort.

src/mendcode/package.json

@@ -164,7 +164,7 @@
     "mysql2": "3.23.1",
     "postcss-selector-parser": "7.1.3",
     "protobufjs": "7.6.3",
-    "qs": "6.15.2",
+    "qs": "6.16.0",
     "seroval": "1.5.3",
     "shell-quote": "1.9.0",
     "sigstore": "4.1.1",

src/mendcode/pnpm-workspace.yaml

@@ -106,7 +106,7 @@ overrides:
   "mysql2": "3.23.1"
   "postcss-selector-parser": "7.1.3"
   "protobufjs": "7.6.3"
-  "qs": "6.15.2"
+  "qs": "6.16.0"
   "seroval": "1.5.3"
   "shell-quote": "1.9.0"
   "sigstore": "4.1.1"