fix(deps): bump stale xmldom, fast-uri, and qs override floors

AUDIT.md

@@ -1828,23 +1828,26 @@ WorldScript Studio was assessed as a strong, modern React/TypeScript application
 ## Known Overrides Table (Supply-Chain Hardening)
 
 Source of truth for the override floors is `pnpm-workspace.yaml` (`overrides:`). Advisory
-IDs below were re-verified against the GitHub Advisory Database on 2026-06-13. Floors are
-intentionally conservative (set above the patched version) as preventive supply-chain pins;
-several apply only to dev/test transitive deps and are never shipped to users.
+IDs below were re-verified against the GitHub Advisory Database on 2026-06-13, except the
+`@xmldom/xmldom`, `fast-uri`, and `qs` rows, re-verified 2026-09-02 (Dependabot alert #79
+and two `pnpm audit` sweeps) after all three floors were found to no longer exclude the
+then-currently-resolved vulnerable version. Floors are intentionally conservative (set at or
+above the patched version) as preventive supply-chain pins; several apply only to dev/test
+transitive deps and are never shipped to users.
 
 | Package | Override | Advisory | Justification |
 |---------|----------|----------|---------------|
 | esbuild | >=0.28.1 | GHSA-67mh-4wv8-2f99 | Dev-server CORS let any website send requests to the esbuild dev server and read the response (≤0.24.2; fixed 0.25.0). Build-tool only, never shipped. Pinned in the 2026-06 security merge. |
 | serialize-javascript | >=7.0.3 | GHSA-76p7-773f-r4q5 / CVE-2024-11831 | Regex XSS in serialized output (<6.0.2). |
 | tmp | ^0.2.6 | GHSA-52f5-9888-hmc6 / CVE-2025-54798 | Arbitrary temp file/dir write via symlink `dir` parameter (≤0.2.3; fixed 0.2.4). |
-| @xmldom/xmldom | >=0.8.13 | GHSA-5fg8-2547-mr8q / CVE-2022-39353 | Misinterpretation of malicious XML input; floor sits above the 0.8.x fixes. |
+| @xmldom/xmldom | >=0.9.12 | GHSA-6gmq-8vp8-gcm6 / CVE-2026-83610 (supersedes GHSA-5fg8-2547-mr8q / CVE-2022-39353) | XML fragment injection via invalid `EntityReference.nodeName` during `requireWellFormed` serialization (≥0.9.0 ≤0.9.11; fixed 0.9.12). The prior `>=0.8.13` floor no longer excluded this — Dependabot alert #79, 2026-09-02. Ships via `mammoth` (`.docx` export), a production dependency. |
 | protobufjs | >=7.5.6 | GHSA-h755-8qp9-cq85 / CVE-2023-36665 | Prototype pollution (6.10.0–7.2.3; fixed 7.2.4). |
 | axios | >=1.15.2 | GHSA-jr5f-v2jv-69x6 / CVE-2025-27152 | SSRF + credential leak via absolute URL. |
 | basic-ftp | >=5.3.1 | GHSA-5rq4-664w-9x2c / CVE-2026-27699 | Path traversal in `downloadToDir()` (<5.2.0). Dev/test transitive. |
-| fast-uri | >=3.1.2 | GHSA-q3j6-qgpj-74h6 / CVE-2026-6321 | Path traversal via percent-encoded dot segments (≤3.1.0). |
+| fast-uri | >=3.1.6 | GHSA-5jgf-p345-68v8 / GHSA-f65p-4m7j-42xc / GHSA-fph4-wmhf-6fwf / GHSA-jqff-g426-hqxp (supersedes GHSA-q3j6-qgpj-74h6 / CVE-2026-6321) | Host confusion / SSRF via percent-encoding and IPv6 normalization (resolved 3.1.5 vulnerable; fixed 3.1.6). The prior `>=3.1.2` floor no longer excluded this — found via a routine `pnpm audit` sweep, 2026-09-02. Dev-only transitive (`@stryker-mutator/core`, `workbox-build`), never shipped. |
 | ws | >=8.20.1 | GHSA-3h5v-q93c-6h6q / CVE-2024-37890 | DoS when handling a request with many HTTP headers (fixed 8.17.1). |
 | brace-expansion | >=5.0.6 | GHSA-v6h2-p8h4-qcjw / CVE-2025-5889 | ReDoS in `expand()` (fixed 1.1.12 / 2.0.2 / 3.0.1 / 4.0.1). |
-| qs | >=6.15.2 | GHSA-hrpp-h998-j3pp / CVE-2022-24999 | Prototype pollution / DoS via crafted query strings (fixed in the ≥6.2.4 line). |
+| qs | >=6.16.0 | GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx (supersedes GHSA-hrpp-h998-j3pp / CVE-2022-24999) | Array-limit bypass via bracket-key comma parsing, and a DoS via attacker-controlled `isBuffer` (resolved 6.15.2 vulnerable; fixed 6.16.0). Dev-only transitive (`@lhci/cli`, `@stryker-mutator/core`, `http-server`), never shipped. `6.16.0` was published 2026-08-29, inside this repo's 7-day `minimumReleaseAge` quarantine at the time of this fix — admitted via a version-scoped `minimumReleaseAgeExclude: qs@6.16.0` entry (same mechanism/precedent as `nanoid@3.3.18`, PR #362), **not** a reduction of the 10080-minute quarantine itself. Compensating verification before admission: registry identity/integrity confirmed via `npm view`; no new install/preinstall/postinstall/prepare lifecycle scripts versus 6.15.2 (identical script set); the one dependency delta (`es-define-property@^1.0.1` added, `side-channel` bumped to `^1.1.1`) is maintained by the same author (`ljharb`) as `qs` itself and was already present elsewhere in the resolved tree. Remove the exclusion once 6.16.0 naturally ages past 2026-09-05T23:50:15Z UTC and a frozen install still resolves it — future qs releases remain governed by the normal quarantine. |
 | chrome-launcher | ^1.2.1 | preventive pin — no direct advisory | Lighthouse-CI dev transitive; conservative floor, dev-only. |
 | ip-address | >=10.1.1 | preventive pin — no direct advisory | Dev/test transitive hardening; no advisory matches this floor. |
 | uuid | >=11.1.1 | preventive pin — no direct advisory | Conservative version floor; no security advisory applies (the prior "collision" note was inaccurate). |

pnpm-workspace.yaml

@@ -16,6 +16,7 @@ blockExoticSubdeps: true
 minimumReleaseAge: 10080
 minimumReleaseAgeExclude:
   - nanoid@3.3.18
+  - qs@6.16.0
 
 # QNBS-v3: Migrated from package.json "pnpm" field (deprecated in pnpm v10+)
 # Overrides with security justifications:
@@ -24,20 +25,20 @@ minimumReleaseAgeExclude:
 # - serialize-javascript: CVE-2024-XXXX - prototype pollution fix
 # - chrome-launcher: CVE-2024-XXXX - command injection fix
 # - tmp: GHSA-7c78-jf6q-g5cm - type-confusion _assertPath bypass (fixed 0.2.7)
-# - @xmldom/xmldom: CVE-2024-XXXX - XSS fix
+# - @xmldom/xmldom: GHSA-6gmq-8vp8-gcm6 - XML fragment injection via invalid EntityReference.nodeName (fixed 0.9.12)
 # - protobufjs: GHSA-wcpc-wj8m-hjx6 - DoS via unbounded Any expansion in JSON conversion (fixed 8.4.1);
 #     raised to >=8.6.6 for GHSA-j3f2-48v5-ccww / GHSA-jfj6-75fj-8934 (2026-07)
 # - axios: CVE-2024-XXXX - SSRF fix
 # - basic-ftp: CVE-2024-XXXX - path traversal fix
-# - fast-uri: GHSA-7p8r-x3mc-p8w7 - host confusion via backslash authority parsing (fixed 3.1.5)
+# - fast-uri: GHSA-7p8r-x3mc-p8w7 - host confusion via backslash authority parsing (fixed 3.1.5); superseded by GHSA-5jgf-p345-68v8/GHSA-f65p-4m7j-42xc/GHSA-fph4-wmhf-6fwf/GHSA-jqff-g426-hqxp - host confusion / SSRF via percent-encoding and IPv6 normalization (fixed 3.1.6)
 # - ip-address: GHSA-mwp4-54f8-5fhr - leading-zero parsing mismatch enabling SSRF / trust-boundary bypass (fixed 10.3.1)
 # - ws: GHSA-96hv-2xvq-fx4p - memory-exhaustion DoS from tiny fragments (fixed 8.21.0)
 # - form-data: CRLF injection via unescaped boundary (fixed 4.0.6)
 # - brace-expansion: GHSA-rgw5-rvv9-x895 - DoS via unbounded intermediate arrays (fixed 5.0.9)
 # - uuid: GHSA-w5hq-g745-h8pq / CVE-2026-41907 - missing buffer bounds check in v3/v5/v6 API methods,
 #     allows silent partial writes with an insufficient output buffer or wrong offset (fixed 11.1.1 /
 #     12.0.1 / 13.0.1 per major line; lockfile converges on 14.0.1, which the override floor now pins)
-# - qs: GHSA-q8mj-m7cp-5q26 / CVE-2026-8723 - prototype pollution fix
+# - qs: GHSA-hrpp-h998-j3pp / CVE-2022-24999 - prototype pollution fix; superseded by GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx - array-limit bypass / isBuffer DoS (fixed 6.16.0; see minimumReleaseAgeExclude above for the release-age exception this specific version needed)
 # - esbuild: GHSA-67mh-4wv8-2f99 - dev-server CORS allowed any origin to read responses;
 #     GHSA-gv7w-rqvm-qjhr - missing binary integrity verification (Deno module);
 #     GHSA-g7r4-m6w7-qqqr - Windows path traversal in the dev-server file handler (all fixed 0.28.1)
@@ -69,18 +70,18 @@ overrides:
   serialize-javascript: ">=7.0.3"
   chrome-launcher: "^1.2.1"
   tmp: ">=0.2.7"
-  "@xmldom/xmldom": ">=0.8.13"
+  "@xmldom/xmldom": ">=0.9.12"
   protobufjs: ">=8.6.6"
   axios: ">=1.18.0"
   basic-ftp: ">=5.3.1"
-  fast-uri: ">=3.1.5 <4"
+  fast-uri: ">=3.1.6 <4"
   ip-address: "10.3.1"
   ws: ">=8.21.0"
   form-data: ">=4.0.6"
   brace-expansion: ">=5.0.9"
   # QNBS-v3: excludes the two exact unpatched releases (12.0.0, 13.0.0) a bare ">=11.1.1" floor would still permit; the resolved 14.0.1 already satisfies this.
   uuid: ">=11.1.1 <12.0.0 || >=12.0.1 <13.0.0 || >=13.0.1"
-  qs: ">=6.15.2"
+  qs: ">=6.16.0"
   dompurify: ">=3.4.13"
   "@babel/core": ">=7.29.6 <8"
   undici: ">=7.29.0 <8"