From cd85f8b6a44a0661ea1888498860b6eef5b4b272 Mon Sep 17 00:00:00 2001
From: Andrew Foote <afoote@mitre.org>
Date: Thu, 29 Oct 2026 10:26:36 -0400
Subject: [PATCH] fix: update qs to remediate CVE-2026-110816

---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 65a3a35..cb0ff61 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4876,9 +4876,9 @@
             }
         },
         "node_modules/qs": {
-            "version": "6.16.0",
-            "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-            "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+            "version": "6.16.2",
+            "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.2.tgz",
+            "integrity": "sha512-VYdnB5S7/0IeXzBacUtwNAaM6d7Y/PgYnNC7bJCI6meqA/OgnsQbZMtVW8Dt2D1PHgbHGtYmhSoEIgvt7xZ2ZA==",
             "license": "BSD-3-Clause",
             "dependencies": {
                 "es-define-property": "^1.0.1",
diff --git a/package.json b/package.json
index 1a4b7b2..b672fe2 100644
--- a/package.json
+++ b/package.json
@@ -39,6 +39,6 @@
         "lodash": "4.18.1",
         "path-to-regexp": "0.1.13",
         "picomatch": "2.3.2",
-        "qs": "6.16.0"
+        "qs": "6.16.2"
     }
 }