fix: bump qs minimum to ^6.14.2 for CVE-2026-2391 (#7057)