chore(deps): bump qs from 6.15.3 to 6.16.0 in /packages/eval/harbor/deepseek-harness-toolchain

[dependabot]

Bumps qs from 6.15.3 to 6.16.0.

Changelog

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

Commits

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[jackwener]

I reviewed this at 1e041a7dc0515698738d6e7d70c8e28c24533226. No P0, P1, P2, or P3. No UI, so nothing to grade for accessibility.

The only change is the reviewed DeepSeek Harness eval lockfile resolving qs 6.15.3 → 6.16.0. Integrity matches the published tarball (sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==). One node_modules/qs entry; express and body-parser already asked for ^6.14.0 / ^6.15.2, so 6.16.0 is in range. @deepseek-ai/dsh@0.1.0-rc.6 is unchanged and still matches the prepare-script spec.

6.16.0 is the patch for GHSA-x5fp-wj9c-mxmx (arrayLimit bypass on []= comma groups) and the isBuffer throw on stringify. This tree is the eval toolchain, not the shipped Desktop/CLI closure — that production bump already landed in #4578. The committed toolchain fingerprint is supposed to move only on a rebuild with --write; this lockfile is the next npm ci input, and verification fails closed until those two agree.

Hosted test and label are green. I am not merging it.

简体中文

我审的是 1e041a7dc0515698738d6e7d70c8e28c24533226。没有 P0/P1/P2/P3。没有界面，无可及性项。

只改了 DeepSeek Harness eval 的 lockfile：qs 6.15.3 → 6.16.0。integrity 对得上 npm 上的包。express / body-parser 的范围本来就收得下。生产侧 #4578 已经合过；这是剩下的评测工具链 lock。fingerprint 要等 --write 重建才改，这是既有约定。hosted test 绿。我不合入。

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.