fix(deps): resolve disclosed dependency advisories

[aryamthecodebreaker]

This PR contains only the dependency advisory repair developed and verified on the v0.10 branch. It does not include unfinished v0.10 features and does not merge Dependabot branches.

Changes:

• pin fast-uri 3.1.7 in the root override and lockfile
• update qs to 6.16.0
• update browserslist to 4.28.8 plus its required transitive browser-data packages

Verification:

• clean npm ci
• npm audit --audit-level=high: 0 vulnerabilities
• exact npm dependency-tree inspection
• all current-main typechecks and 739 tests
• lint, production build, generated artifacts, Action/server metadata, smokes, study integrity, retrieval, 9/9 adversarial at 0% false confidence, and the 1,000-file scanner bound

No package version, tag, npm publish, release, or v0.10 feature is included.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
fixmap	Ready	Preview	Sep 4, 2026 1:25am UTC