chore(deps): Bump qs to ^6.16.0 to resolve security alerts

[antonis]

📢 Type of change

• Bugfix
• New feature
• Enhancement
• Refactoring

📜 Description

Bumps the existing qs resolution in the root package.json from ^6.15.2 to ^6.16.0, deduping the transitive copy (pulled via express/body-parser) to a patched version (6.16.0).

💡 Motivation and Context

Resolves two moderate-severity Dependabot alerts affecting qs < 6.16.0:

• Dependabot alert 636 — array-limit bypass via bracket-key comma parsing
• Dependabot alert 637 — Denial of Service via attacker-controlled isBuffer

qs is a dev/build/test-only transitive dependency — it is not a dependency of packages/core and is not shipped in the published @sentry/react-native package, so there is no exposure for SDK consumers.

💚 How did you test it?

• yarn install — resolves cleanly; qs dedupes to 6.16.0.

📝 Checklist

• I added tests to verify changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed. (n/a — dev tooling only)
• I updated the wizard if needed. (n/a)
• All tests passing.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec. (n/a — no API change)
• No breaking changes.

🔮 Next steps

• Separate PRs cover the fast-uri and @xmldom/xmldom Dependabot alerts.

🤖 Generated with Claude Code

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• chore(deps): Bump qs to ^6.16.0 to resolve security alerts by antonis in #6663

• chore(deps): update Android SDK to v8.55.0 by github-actions in #6658
• fix: Prevent Metro serializer crash on non-standard serializer output by antonis in #6652
• chore(deps): Bump browserslist to ^4.28.7 to resolve security alerts by antonis in #6653
• fix: Avoid NSNull RCTConvert warning when clearing scope context by antonis in #6651
• chore(deps): update React Native to v0.87.1 by github-actions in #6607
• chore: Add supply-chain provenance guidance to agent skills by antonis in #6644
• fix(tracing): Keep launch-screen TTID/TTFD anchored to navigation on delayed first navigation by antonis in #6626
• chore: Extend agents.toml and .agents/skills (Extend Warden setup #6637) by antonis in #6643
• chore(sample): Bump React Native sample to 0.87.0 by antonis in #6617
• fix(core): Resolve Metro from project root for source map generation by antonis in #6625
• docs(sdk-versions): Add 8.14.3 row to SDK-VERSIONS.md by antonis in #6649
• chore(deps): update Maestro to v2.10.0 by github-actions in #6641
• chore(deps): update JavaScript SDK to v10.73.0 by github-actions in #6642
• test(ios): Speed up sentry-xcode-scripts tests by antonis in #6633
• fix: Update recommended vscode extensions by antonis in #6640
• chore(deps): bump actions/setup-java from 5.7.0 to 6.0.0 by dependabot in #6636
• chore(deps): bump the codeql-action group with 3 updates by dependabot in #6635
• chore(deps): update JavaScript SDK to v10.72.0 by github-actions in #6634
• chore(e2e): Bump E2E tests to React Native 0.87.0 by antonis in #6616
• chore(deps): update CLI to v3.7.0 by github-actions in #6632
• feat(tracing): Copy app start vitals onto standalone children by buenaflor in #6631
• chore(deps): update Cocoa SDK to v9.26.1 by github-actions in #6623
• fix(ios): Force-load the Sentry static archive to keep ObjC category methods by antonis in #6615

Plus 3 more

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Pull request is not ready for merge, please add the "ready-to-merge" label to the pull request

Generated by 🚫 dangerJS against 6a26350