Bump qs and express

[dependabot]

Bumps qs and express. These dependencies needed to be updated together.
Updates qs from 6.15.3 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

Commits

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

Updates express from 4.22.2 to 4.22.3

Changelog

Sourced from express's changelog.

4.22.3

• Allow conditional revalidation for QUERY requests
  • req.fresh now includes QUERY in the freshness check, so QUERY responses can return 304 when a validator matches
• deps: qs@~6.16.0

Commits

• 899b524 4.22.3 (#7466)
• 1fad2c3 ci: add npm staged publication with dist-tag support (#7465)
• 4138650 deps: qs@~6.16.0 (#7440)
• 61ccf2e feat: allow conditional revalidation for QUERY requests (v4) (#7377)
• 715101b Update path-to-regexp to 0.1.13 because CVE-2026-4867 (#7135)
• f472e5f docs: fix the release date format for 4.22.2
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.