fix: dependency security vulnerabilities (DELO-6518, DELO-6519)

[ikrascloudinary]

Summary

Vulnerabilities resolved

• qs: 6.15.3 → 6.16.0 (minimum required: 6.16.0, from DELO-6518 — Uncaught Exception)
• qs: 6.15.3 → 6.16.0 (minimum required: 6.16.0, from DELO-6519 — Allocation of Resources Without Limits or Throttling)

qs is transitive via express@4.22.2 → qs@~6.15.1. Express 4's latest release
(4.22.2) still pins ~6.15.1, so no parent bump reaches a safe version without
moving to Express 5 (breaking). Resolved with a resolutions entry instead.

This is the only repo in the current DELO Snyk queue where the vulnerable package
is reachable at runtime — qs parses query strings and urlencoded bodies on a live
HTTP service, and both advisories are DoS-shaped.

Dependencies updated

• @opentelemetry/exporter-prometheus: ^0.220.0 → ^0.222.0
• @opentelemetry/instrumentation: ^0.220.0 → ^0.222.0
• @opentelemetry/instrumentation-express: ^0.68.0 → ^0.70.0
• @opentelemetry/instrumentation-http: ^0.220.0 → ^0.222.0
• @opentelemetry/resources: ^2.9.0 → ^2.11.0
• @opentelemetry/sdk-node: ^0.220.0 → ^0.222.0
• @opentelemetry/sdk-trace-base: ^2.9.0 → ^2.11.0
• mocha: ^11.7.6 → ^11.8.0
• nock: ^14.0.15 → ^14.0.17

The OpenTelemetry experimental (0.222.0) and stable (2.11.0) lines move as a
set. No Resource-API change was needed — this repo is already on the 2.x
resourceFromAttributes() form.

Left deliberately untouched (breaking, out of scope for a security-only PR):
express 4→5, chai 4→6, chai-http 4→5, config 3→5, dotenv 16→17,
got 14→16, rollbar 2→3, sinon 19→22, sinon-chai 3→4, mocha 11→12,
and cloudinary (pinned at 2.9.0 by a patch-package patch).

Resolutions

• qs: ^6.16.0 — added, for DELO-6518 / DELO-6519. Required because
  express@4 and body-parser declare ~6.15.1.
• protobufjs: ^7.6.5 — kept. It now resolves to 7.6.6 naturally, but the
  pin is retained as the documented minimum safe version for future installs.

Package version

• 1.3.15 → 1.3.16

Test results

• yarn install clean; patch-package applied cloudinary@2.9.0 successfully.
• npm test — 13 passing, no hard crashes or module-resolution errors.
• OpenTelemetry boot smoke-tested OK: node --require ./instrumentation.js.
• npm ls qs --all → every copy at 6.16.0; npm ls protobufjs --all → 7.6.6.

Because the qs resolution sits one minor outside Express's declared ~6.15.1,
query parsing was smoke-tested explicitly against express@4.22.2 + qs@6.16.0
— flat params, nested objects (a[b][c]), array syntax (list[]), percent-encoded
URLs and UTF-8 values, plus a nested urlencoded POST body. All parsed identically.
npm ls reports the expected invalid: "~6.15.1" note on qs, which is the
intended effect of the resolution, not a peer-dependency break.

Test plan

• npm test passes
• App boots cleanly: node --require ./instrumentation.js start.js (Prometheus exporter on :6060)
• Sanity-check a real POST /test/run request with a query string in staging

🤖 Generated with Claude Code

[lukaszczerpak-cloudinary]

please deploy the new version of WSTS with updated packages