fix: bump qs to ^6.16.0 for CVE-2026-82417

[Jeevansuresh1]

Summary

• Bump qs resolution to ^6.16.0 to remediate CVE-2026-82417 (DoS via improper validation in stringify).

Affected streams

Both release-2.1 and release-2.2 are affected and will need backports.

Test plan

• yarn install

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 525e09f1-c2c5-47ac-91e9-2d6fae2bf821

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.74%. Comparing base (33effdf) to head (3d97776).

@@            Coverage Diff             @@
##             main     #681      +/-   ##
==========================================
+ Coverage   95.71%   95.74%   +0.02%     
==========================================
  Files         241      241              
  Lines       14587    14587              
  Branches     4005     4006       +1     
==========================================
+ Hits        13962    13966       +4     
+ Misses        611      581      -30     
- Partials       14       40      +26     

Flag	Coverage Δ
plugins	95.74% <ø> (+0.02%)	⬆️
see 16 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 33effdf...3d97776. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[patchback]

Backport to release-2.2: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply fa3fdce on top of patchback/backports/release-2.2/fa3fdce107083674ef75792c5c80acc7f6c7ea23/pr-681

Backporting merged PR #681 into main

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   git remote add upstream https://github.com/ansible/ansible-backstage-plugins.git
   

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   git fetch upstream
   git checkout -b patchback/backports/release-2.2/fa3fdce107083674ef75792c5c80acc7f6c7ea23/pr-681 upstream/release-2.2
   

4. Now, cherry-pick PR fix: bump qs to ^6.16.0 for CVE-2026-82417 #681 contents into that branch:

   git cherry-pick -x fa3fdce107083674ef75792c5c80acc7f6c7ea23
   

   If it'll yell at you with something like fatal: Commit fa3fdce107083674ef75792c5c80acc7f6c7ea23 is a merge but no -m option was given., add -m 1 as follows instead:

   git cherry-pick -m1 -x fa3fdce107083674ef75792c5c80acc7f6c7ea23
   

5. At this point, you'll encounter some merge conflicts. You must
   resolve them in order to preserve the patch from PR fix: bump qs to ^6.16.0 for CVE-2026-82417 #681 as close to the
   original as possible.
6. Once conflicts are resolved and git added, run:

   git cherry-pick --continue
   

7. Push this branch to your fork on GitHub:

   git push origin patchback/backports/release-2.2/fa3fdce107083674ef75792c5c80acc7f6c7ea23/pr-681
   

8. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to release-2.1: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply fa3fdce on top of patchback/backports/release-2.1/fa3fdce107083674ef75792c5c80acc7f6c7ea23/pr-681

Backporting merged PR #681 into main

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   git remote add upstream https://github.com/ansible/ansible-backstage-plugins.git
   

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   git fetch upstream
   git checkout -b patchback/backports/release-2.1/fa3fdce107083674ef75792c5c80acc7f6c7ea23/pr-681 upstream/release-2.1
   

4. Now, cherry-pick PR fix: bump qs to ^6.16.0 for CVE-2026-82417 #681 contents into that branch:

   git cherry-pick -x fa3fdce107083674ef75792c5c80acc7f6c7ea23
   

   If it'll yell at you with something like fatal: Commit fa3fdce107083674ef75792c5c80acc7f6c7ea23 is a merge but no -m option was given., add -m 1 as follows instead:

   git cherry-pick -m1 -x fa3fdce107083674ef75792c5c80acc7f6c7ea23
   

5. At this point, you'll encounter some merge conflicts. You must
   resolve them in order to preserve the patch from PR fix: bump qs to ^6.16.0 for CVE-2026-82417 #681 as close to the
   original as possible.
6. Once conflicts are resolved and git added, run:

   git cherry-pick --continue
   

7. Push this branch to your fork on GitHub:

   git push origin patchback/backports/release-2.1/fa3fdce107083674ef75792c5c80acc7f6c7ea23/pr-681
   

8. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.