chore(deps): clear 11 dev-only Dependabot alerts / INF-1404

[minac]

Summary

Closes INF-1404 (protobufjs), INF-1373 (@protobufjs/utf8), INF-1656 (shell-quote) and INF-1472 (qs). All four arrive through the same two dev dependencies, so one bump clears 11 alerts (2 critical, 4 high, 5 moderate).

• dd-trace 5.24.0 → 5.126.0, express 4.21.1 → 4.22.2.
• dd-trace 5.81.0 dropped protobufjs and shell-quote, so those two (and @protobufjs/utf8 under them) leave the tree instead of getting a pinned patch.
• The qs override moves from 6.14.2 to ^6.16.0.

Why the qs override stays

The 6.14.2 pin came from INF-897, an arrayLimit bypass through comma parsing. It only covered a flat key. 6.15.3 and earlier gate the comma-count check on isFlatArrayValue, so a[]=,,,, skips it. A local check confirms that: against arrayLimit 5 with throwOnLimitExceeded, both 6.14.2 and 6.15.3 accept a[]= plus 25 commas, and 6.16.0 raises. express 4.22.2 asks for qs ~6.15.1, which caps below the fix, so the override can't go yet (the caret lets it pick up later patches on its own).

What didn't change

No runtime dependency changes. pino, pino-http and redact-object are untouched, and the published tarball is still the 8 files under dist/, so no consumer needs a release.

Review focus

The qs caret is the part worth a second pair of eyes. A caret on an override is looser than every other pin in this file, and I'm not certain that's the right call here.

How to verify

1. Run npm ci, then npm run build. It's green on this branch.
2. Run npm audit. It reports no vulnerabilities.
3. Run npm ls protobufjs shell-quote. Neither package is in the tree.

How does it look

N/A, non-visual.

-- Written by Miguel's Claude

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 2261fbec-75f4-44f3-b6c3-2a1f3cd12b3b

---

_{Comment @coderabbitai help to get the list of available commands.}