Bump qs and azurite in /src/extend-message-ext/Lab01-Run-NW-Teams/Northwind

[dependabot]

Bumps qs to 6.16.0 and updates ancestor dependency azurite. These dependencies need to be updated together.

Updates qs from 6.11.0 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

• [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
• [Deps] update @ljharb/eslint-config
• [Dev Deps] update @ljharb/eslint-config, iconv-lite
• [Tests] increase coverage

6.15.0

• [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
• [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

• [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
• [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
• [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

... (truncated)

Commits

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

Updates azurite from 3.31.0 to 3.37.0

Release notes

Sourced from azurite's releases.

2026.08 Version 3.37.0

General:

1. Added support for Azure Storage Service Version 2026-06-06.
2. Introduced configuration options to skip API version validation, including environment variable support.
3. Improved compatibility with newer Azure Storage SDK releases and service versions.
4. Addressed multiple customer-reported issues and protocol-alignment gaps.
5. Enhanced reliability, stability, and overall developer experience.

Blob:

1. Added CRC64 / NVME transactional checksum validation support for StageBlock operations.
2. Added support for Put Block From URL.
3. Added support for startFrom parameter in List Blobs operations.
4. Improved server behaviour alignment for blob tags and request validation.
5. Fixed blob batch request handling when multipart boundaries contain '=' characters.
6. Optimized blob copy validation by using HEAD requests instead of downloading source content.
7. Added version-agnostic upgrade and persistence compatibility test coverage.

Queue:

1. Improved API-version handling and protocol compatibility.
2. Enhanced error handling and service reliability.
3. Compatibility & Developer Experience:
4. Added support for skipping API version validation to enable testing against newer service versions.
5. Improved compatibility with newer Azure SDK releases.
6. Added version-agnostic upgrade and persistence compatibility test coverage.
7. Improved validation coverage and release quality checks.

Security & Dependency Updates:

1. Addressed multiple security vulnerabilities through dependency upgrades and package modernization.
2. Remediated known vulnerabilities in applicationinsights, serialize-javascript, markdown-it, and related dependency chains.
3. Upgraded Azure SDK, Express, TypeScript, OpenTelemetry, and supporting platform dependencies.
4. Improved credential and OAuth configuration security by preventing sensitive values from being logged.
5. Build & Infrastructure:
6. Improved release validation and upgrade testing coverage.
7. Enhanced automation for dependency maintenance and security-update workflows.
8. Updated release documentation, notices, and supporting project infrastructure.
9. Resolved workflow and build system reliability issues.

2026.07 Version 3.36.0

General:

1. Raised minimum supported Node.js runtime to 21+.
2. Updated Node 22 Alpine base image from 3.21 to 3.23 to address critical CVEs.
3. Migrated Windows/Linux executable build flow from pkg/pkg-fetch to Node.js SEA (Single Executable Applications) using esbuild and postject.
4. Addressed multiple dependency vulnerabilities by upgrading core packages and Azure SDK dependencies.
5. Removed deprecated azure-storage dependency and migrated test suites to modern Azure SDKs.
6. Improved overall security posture through dependency upgrades and credential-security fixes.

... (truncated)

Changelog

Sourced from azurite's changelog.

2026.08 Version 3.37.0

General:

• Updated the lockfile-resolved @typescript-eslint/parser version from 8.66.0 to 8.67.0; added an ESLint TypeScript parsing smoke test to validate the updated parser configuration.
• Raised the minimum supported Node.js runtime from 21 to 22 because Node.js 21 has reached end of life.
• Updated Mocha to 12.0.0-rc.5 for Node.js 26 compatibility and removed the obsolete npm always-auth setting.
• Fixed npm 10 lockfile validation by explicitly resolving the picomatch peer dependency.
• Bumped @azure/storage-blob dev dependency from 12.28.0 to 12.33.0.
• Added an npm overrides entry to pin the transitive serialize-javascript dependency (via mocha) to 7.0.3, remediating GHSA-5c6j-r48x-rmvq.
• Replaced the deprecated vsce dev dependency with @vscode/vsce 3.9.2, updating the VS Code packaging toolchain to resolve linkify-it 5.0.2 and remediate GHSA-v245-v573-v5vm / CVE-2026-59887.
• Bumped @typescript-eslint/parser dev dependency from 5.62.0 to 8.65.0, and aligned @typescript-eslint/eslint-plugin to 8.65.0 to match. Updated .eslintrc.js for v8 compatibility (no-extra-semi and no-unused-expressions rules).
• Bumped @azure/storage-queue dev dependency from 12.27.0 to 12.31.0.
• Applied npm audit fix to updates across multiple dependencies to address security vulnerabilities and maintenance updates.
• Bumped applicationinsights from 2.9.6 to 3.15.1 and updated telemetry SDK type usage for compatibility.
• Bumped express from ^4.16.4 to ^5.2.1, updated @types/express from ^4.16.0 to ^5.0.6, and added @types/mime as an explicit dev dependency because it is no longer provided transitively by the Express type packages.
• Replaced cross-var with cross-env-shell to remove the vulnerable Babel 6 dependency chain while preserving cross-platform npm package version expansion.
• Bumped @types/args dev dependency from 5.0.3 to 5.0.4 (patch update).
• Bumped @types/mime dev dependency from 1.3.5 to 4.0.0. @types/mime v4 is a stub package; removed mime from the explicit types list in tsconfig.json to avoid a missing type-definition error.
• Bumped typescript dev dependency from 5.9.3 to 7.0.2 for the main build, while keeping a TypeScript 6.0.3 install (pinned exactly, aliased as the typescript package) for @typescript-eslint, which only supports TypeScript >=4.8.4 <6.1.0. Updated tsconfig.json to remove compiler options removed in TypeScript 7 (moduleResolution: "node", downlevelIteration) and to explicitly list all @types packages (e.g. mocha, node) under types, since TypeScript 7 no longer auto-includes @types/* packages when the option is omitted.
• Bumped eslint dev dependency from 8.57.1 to 10.9.0 and migrated ESLint configuration from legacy .eslintrc.js to the flat config format (eslint.config.js) required by ESLint v9+. Added @eslint/js and globals as dev dependencies to support the flat config.
• Bumped applicationinsights from 3.15.1 to 3.16.0 to address CVE-2026-54285.
• Bumped @types/vscode dev dependency from 1.103.0 to 1.134.0.
• Bumped tedious from 18.6.2 to 20.0.0.
• Removed the to-readable-stream dependency; replaced all usages with Node.js built-in Readable.from() for Node stream compatibility and added unit coverage for the readable body stream path.
• Bumped the default Blob, Queue, and Table service API version to 2026-06-06.
• Added support for service API versions 2026-04-06 and 2026-02-06 for Blob, Queue, and Table endpoints.
• Bumped multistream from ^2.1.1 to ^4.1.0 and @types/multistream from ^2.1.2 to ^4.1.4. Updated FSExtentStore.readExtents() and MemoryExtentStore.readExtents() to call multistream with new (now a class in v4) and added unit test coverage for merging multiple extents into a single stream.
• Bumped rcedit dev dependency from 4.0.1 to 5.0.2 (pinned exact version due to major bump) and updated scripts/buildExe.js to use rcedit's new named export since v5 is ESM-only and no longer exposes a default export.
• Bumped @types/mocha dev dependency from ^9.0.0 to ^10.0.10, and added a Mocha context typing smoke test.
• Added support for enabling --skipApiVersionCheck via the AZURITE_SKIP_API_VERSION_CHECK=true environment variable across the azurite, azurite-blob, azurite-queue, and azurite-table command-line entrypoints. Only the exact, case-sensitive value true enables it.
• Bumped @types/node dev dependency from ^14.14.24 to ^26.1.2 (resolved 14.18.63 to 26.1.2), and fixed the resulting type errors in the extent stores and binary tests. Added unit tests covering FSExtentStore.appendExtent() and MemoryExtentStore.appendExtent() for the Buffer input path. Also fixed MemoryExtentStore.appendExtent() to convert stream chunks to Buffer so extent count/offset are measured in bytes rather than characters for multi-byte string chunks.
• Removed husky dev dependency entirely. It was never configured (the "husky": {} config was empty, no .husky/ hooks directory existed, and prepare never called husky).
• Bumped find-process dev dependency from ^1.4.4 to ^2.1.1.
• Added a version-agnostic upgrade/persistence compatibility test suite (tests/upgrade/, run via npm run test:upgrade, test:upgrade:docker, test:upgrade:vsix) that installs the latest published Azurite (npm, Docker/MCR image, and VS Code Marketplace VSIX), seeds blob (block/append/page, txt/json/csv/xml/binary), queue, and table data, upgrades in place to the local build, and verifies byte-for-byte / value-for-value integrity across all three distribution channels. The VSIX suite additionally has a standalone lifecycle test that installs/activates/starts/stops the latest published Marketplace VSIX and the locally packaged VSIX. Added dev dependency @vscode/test-electron for the VSIX tests, and a dedicated .github/workflows/UpgradeCompatibility.yml CI workflow that runs on merge to main and on demand.
• Replaced the rimraf dependency with Node.js built-in fs.rm()/fs.rmSync(): rimrafAsync now wraps fs.rm with Windows retry handling, test cleanup retries and then tolerates transient errors, and the clean/clean:deep npm scripts use a new scripts/clean.js. Removes the deprecated rimraf → glob@7 → inflight dependency.
• Bumped cross-env dev dependency from ^7.0.3 to ^10.1.0. Cross-env 10 is ESM-only and moved its bin scripts from src/bin/ to dist/bin/. Updated tests/packageScripts.test.ts to resolve the cross-env-shell script from cross-env's declared bin mapping.
• Bumped lint-staged dev dependency from ^15.0.1 to ^17.3.0. The .lintstagedrc configuration was still using the deprecated linters/ignore format removed in lint-staged v10+, so it was migrated to the flat glob-to-command format and a .prettierignore file was added (mirroring the previous ignore patterns for dist, swagger, generated, ChangeLog.md, and BreakingChanges.md) so prettier continues to skip those paths.
• Bumped @vscode/test-electron dev dependency from ^2.4.1 to ^3.1.0.
• Updated the lockfile-resolved @types/node dev dependency from 26.1.2 to 26.2.0 (declared package.json range remains ^26.1.2).
• Relaxed the serialize-javascript override from the exact 7.0.3 pin to ^7.0.7 (resolves to 7.1.0) to remediate GHSA-qj8w-gfj5-8c6v (CPU-exhaustion DoS, affects 5.0.0 - 7.0.4), bumped mocha dev dependency from 12.0.0-rc.5 to 12.0.0-rc.6 and deduped the transitive serialize-javascript/iconv-lite copies.
• Bumped esbuild dev dependency from 0.28.1 to 0.28.2.
• Bumped the @typescript-eslint/eslint-plugin and @typescript-eslint/parser dev dependencies from 8.66.0 to 8.67.0 (declared package.json ranges remain ^8.65.0).
• Bumped mysql2 from 3.23.2 to 3.23.3 for SQL metadata-store connection-pool fixes; added driver and pool coverage.
• Bumped globals dev dependency from 17.9.0 to 17.11.0.
• Fixed clear-text logging for unknown OAuth-level handling in Blob, Queue, and Table token authenticators by removing the raw configured value from warning logs, with coverage added for the affected path.
• Bumped @azure/identity dev dependency lockfile resolution from 4.13.1 to 4.13.2 (declared package.json range remains ^4.2.1).
• Updated the lockfile-resolved mysql2 version from 3.23.3 to 3.23.4 (declared package.json range remains ^3.10.1; fixes leading-zero truncation in TIME fractional seconds and aligns callback Pool/PoolConnection typings with runtime behavior).

Blob:

... (truncated)

Commits

• 422ed99 Implement Put Block From URL (#2681)
• 9144a4b Validate copy sources with HEAD instead of downloading the blob (#2680)
• 826a978 Bump mysql2 from 3.23.3 to 3.23.4 (#2747)
• 9ac9808 Bump eslint from 10.8.1 to 10.9.0 (#2746)
• 07c4dde Bump @​types/vscode from 1.125.0 to 1.134.0 (#2748)
• 0899119 Bump @​azure/identity from 4.13.1 to 4.13.2 (#2744)
• 6f975ba Support startFrom on List Blobs (#2688)
• d59cc5d Update 3.37.0 release documentation and notices (#2743)
• 9074bea Avoid logging raw OAuth configuration values (#2740)
• 64edae5 Bump @​typescript-eslint/parser from 8.66.0 to 8.67.0 (#2736)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for azurite since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.