Add npm vulnerability skills, fix qs advisories

[brionmario]

Purpose

Add two agent skills that codify how we handle pnpm/npm security advisories in this monorepo:
Fix npm Vulnerability (update the head dependency, or fall back to a scoped pnpm-workspace.yaml
override with a tracking GitHub issue) and Prune npm Overrides (audit existing overrides and remove
ones upstream has since fixed). AGENTS.md is updated to list both under a new "Skills" section.

As a concrete instance of the first skill, this PR also applies it to fix two live advisories:
GHSA-x5fp-wj9c-mxmx (array-limit bypass via bracket-key comma parsing) and GHSA-4mjr-xmp4-gh2g (DoS via
attacker-controlled isBuffer) in qs, transitive via body-parser's own qs: ~6.15.1 range. That
range caps at 6.15.3 and the patched 6.15.4 was never published upstream, so the override jumps straight
to 6.16.0.

Approach

• .agent/skills/fix-npm-vulnerability/SKILL.md — new skill, invoked when pnpm audit or Dependabot
  surfaces an advisory. Tries updating the head dependency first; falls back to a scoped override plus a
  tracking issue when the fix isn't released upstream yet.
• .agent/skills/prune-npm-overrides/SKILL.md — new skill for periodically reviewing
  pnpm-workspace.yaml overrides and dropping the ones no longer needed.
• AGENTS.md — documents both skills under a new "Skills" section.
• pnpm-workspace.yaml — adds the body-parser>qs: 6.16.0 override (scoped, since it's only reachable
  through body-parser), following the format the fix-npm-vulnerability skill produces.
• package.json — bumps the pinned pnpm devEngines version to 11.25.0.
• pnpm-lock.yaml — regenerated after the override and pnpm bump.

Related Issues

• [SKILL] Add a skill for resolving npm vulnerabilities thunderid#5263

Related PRs

• N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 3b85a569-c094-47b9-90aa-461d4802fa7b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}