fix: resolve qs Dependabot alert #55

[thymikee]

Summary

Update the transitive qs dependency from 6.15.1 to 6.15.2 to resolve Dependabot alert #55 (GHSA-q8mj-m7cp-5q26 / CVE-2026-8723).

The dependency is reached through @stryker-mutator/core and typed-rest-client. This removes the vulnerable version from the repository lockfile without changing runtime source code.

Validation

• Frozen pnpm install passed and resolved qs@6.15.2.
• Supply-chain policy, formatting, lint, typecheck, layering, Fallow, build, and unit validation passed.

Docs and skills were not changed because this is a lockfile-only dependency security fix.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-30 09:07 UTC

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	1.88 MB	1.88 MB	0 B
JS gzip	605.4 kB	605.4 kB	0 B
npm tarball	724.0 kB	724.0 kB	0 B
npm unpacked	2.53 MB	2.53 MB	0 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	29.2 ms	28.9 ms	-0.3 ms
CLI --help	59.4 ms	58.2 ms	-1.2 ms

Top changed chunks: no changes in the largest emitted chunks.

[thymikee]

Clean review at 53853ce. The lockfile completely replaces vulnerable transitive dev-only qs@6.15.1 with fixed 6.15.2, updates the typed-rest-client snapshot reference and integrity data, and leaves no old resolution behind. A manifest change is not needed for this lock-resolved transitive dependency; shipped runtime source and dependencies are unchanged. All exact-head static, package, integration, coverage, CodeQL, and platform smoke checks are green. No findings; substantively ready despite the draft flag.