From a5f283e0032b01b3ce04604e646ccce5c1a83536 Mon Sep 17 00:00:00 2001
From: Michael Barnwell <michael.barnwell@sentryinteractive.com>
Date: Thu, 3 Sep 2026 10:36:30 +0100
Subject: [PATCH] fix(deps): bump qs, fast-uri, nanoid and js-yaml to resolve
 Dependabot alerts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves 5 of the 7 open Dependabot alerts by updating transitive
dependencies in package-lock.json:

- qs 6.15.2 -> 6.16.0 via a new npm override (express/body-parser pin
  ~6.15.1, so the fix is outside their range) — GHSA-x5fp-wj9c-mxmx
- fast-uri 3.1.5 -> 3.1.7 — GHSA-fph4-wmhf-6fwf, GHSA-5jgf-p345-68v8
  (3.1.7 also fixes GHSA-qw65-cvwx-89v3, GHSA-58mr-gqgx-xq4g,
  GHSA-f65p-4m7j-42xc, GHSA-jqff-g426-hqxp)
- nanoid 3.3.16 -> 3.3.18 — GHSA-2v37-7h3g-55p8
- js-yaml 4.3.0 -> 4.3.2 — GHSA-5p4m-2wfm-xmqj

The two image-size alerts (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr)
have no patched release; image-size is unmaintained and Docusaurus is
tracking a replacement in facebook/docusaurus#12231.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 package-lock.json | 27 ++++++++++++++-------------
 package.json      |  3 ++-
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 6b5e15ac..49e50066 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9855,9 +9855,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "funding": [
         {
           "type": "github",
@@ -11502,9 +11502,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "funding": [
         {
           "type": "github",
@@ -14499,9 +14499,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
       "funding": [
         {
           "type": "github",
@@ -16781,12 +16781,13 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.16.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
diff --git a/package.json b/package.json
index 411e10e4..8c56cb1f 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,8 @@
     "serialize-javascript": "7.0.5",
     "sockjs": {
       "uuid": "^11.1.1"
-    }
+    },
+    "qs": "6.16.0"
   },
   "browserslist": {
     "production": [