From 90a52e8625602962c6005ffe2a8d670aaac782a3 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 16:13:27 +0000
Subject: [PATCH 1/2] chore(deps): update dependency qs to v6.9.7 [security]

---
 package-lock.json | 8 --------
 package.json      | 2 +-
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8416bda2..490e037c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -40102,14 +40102,6 @@
         "teleport": ">=0.2.0"
       }
     },
-    "node_modules/qs": {
-      "version": "6.7.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
-      "integrity": "sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ==",
-      "engines": {
-        "node": ">=0.6"
-      }
-    },
     "node_modules/query-string": {
       "version": "6.14.1",
       "resolved": "https://registry.npmjs.org/query-string/-/query-string-6.14.1.tgz",
diff --git a/package.json b/package.json
index 9effcff2..9950a5ce 100644
--- a/package.json
+++ b/package.json
@@ -136,7 +136,7 @@
     "diff": "5.2.2",
     "socket.io-parser": "4.0.5",
     "request": {
-      "qs": "6.5.5"
+      "qs": "6.9.7"
     }
   }
 }

From 3d279db33d63d4731febedf3b284ae14d422bf58 Mon Sep 17 00:00:00 2001
From: Jimmy Andrade <contato@jimmyandrade.com>
Date: Thu, 16 Jul 2026 13:13:47 -0300
Subject: [PATCH 2/2] fix(deps): override express qs to 6.9.7

Force the vulnerable express/body-parser qs copy without downgrading newer qs transitive dependencies.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 package-lock.json | 12 ++++++++++++
 package.json      |  6 ++++++
 2 files changed, 18 insertions(+)

diff --git a/package-lock.json b/package-lock.json
index 490e037c..f08c885a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -40102,6 +40102,18 @@
         "teleport": ">=0.2.0"
       }
     },
+    "node_modules/qs": {
+      "version": "6.9.7",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.9.7.tgz",
+      "integrity": "sha512-IhMFgUmuNpyRfxA90umL7ByLlgRXu6tIfKPpF5TmcfRLlLCckfP/g3IQmju6jjpu+Hh8rA+2p6A27ZSPOOHdKw==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/query-string": {
       "version": "6.14.1",
       "resolved": "https://registry.npmjs.org/query-string/-/query-string-6.14.1.tgz",
diff --git a/package.json b/package.json
index 9950a5ce..64f431eb 100644
--- a/package.json
+++ b/package.json
@@ -136,6 +136,12 @@
     "diff": "5.2.2",
     "socket.io-parser": "4.0.5",
     "request": {
+      "qs": "6.5.5"
+    },
+    "body-parser": {
+      "qs": "6.9.7"
+    },
+    "express": {
       "qs": "6.9.7"
     }
   }