[Snyk] Upgrade query-string from 7.1.3 to 9.3.1

[shafeeqd959]

Snyk has created this PR to upgrade query-string from 7.1.3 to 9.3.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 15 versions ahead of your current version.

• The recommended version was released 7 months ago.

Release notes

Package name: query-string

• 9.3.1 - 2025-09-18
  
  • Fix custom type functions with array formats 720f2ff

  ---

  v9.3.0...v9.3.1

• 9.3.0 - 2025-09-09
  
  • Add replacer option to stringify() 509014d
  • Fix encoded separator incorrectly splitting single values into arrays ec67fea

  ---

  v9.2.2...v9.3.0

• 9.2.2 - 2025-07-03
  
  • Accept valueless parameters as true when using a boolean with types option (#410) 557a550

  ---

  v9.2.1...v9.2.2

• 9.2.1 - 2025-06-15
  
  • Fix stringifyUrl not respecting passed in options 38dae7b

  ---

  v9.2.0...v9.2.1

• 9.2.0 - 2025-05-20
  
  • Add support for boolean type in the types option (#407) 10d263a

  ---

  v9.1.2...v9.2.0

• 9.1.2 - 2025-05-02
  
  • Fix types option with arrayFormat: comma and one item in array (#406) 3e61882

  ---

  v9.1.1...v9.1.2

• 9.1.1 - 2024-10-09
  
  • Fix arrayFormat bracket-separator with a URL encoded value (#392) 19c43d4

  v9.1.0...v9.1.1

• 9.1.0 - 2024-07-22
  
  • Add types option to the .parse() method (#385) 672eb82

  v9.0.0...v9.1.0

• 9.0.0 - 2024-02-26
  

  Breaking

  • Require Node.js 18 fd5a1c9

  Fixes

  • Fix passing empty fragmentIdentifier to stringifyUrl() cc232cb

  v8.2.0...v9.0.0

• 8.2.0 - 2024-02-03
  
  • Allow BigInt as stringifiable value in the types (#377) 7f84490

  v8.1.0...v8.2.0

• 8.1.0 - 2022-12-20
• 8.0.3 - 2022-12-14
• 8.0.2 - 2022-12-13
• 8.0.1 - 2022-12-13
• 8.0.0 - 2022-12-12
• 7.1.3 - 2022-12-02

from query-string GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	1	10	✅ Passed
🟠 High Severity	11	4	25	✅ Passed
🟡 Medium Severity	14	16	500	✅ Passed
🔵 Low Severity	0	2	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	1	15 / 30 days	⚠️ Warning
🟠 High	0	1	30 / 120 days	⚠️ Warning
🟡 Medium	0	3	90 / 365 days	⚠️ Warning
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 1
• High without fixes: 4
• Medium without fixes: 16
• Low without fixes: 2

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

[abhishek-ezhava-cstk]

Closing: not mergeable as-is. query-string v9 is ESM-only, and this plugin is CommonJS (main: gatsby-node.js, no "type": "module"), so the bump would break require() for consumers. npm audit reports no advisory against the current ^7.1.3, so there is no exposure in staying on v7. A move to v9 needs a dual-format/ESM migration tracked separately.

Also closed as secret-scan hygiene — the commit message on this branch embeds a Snyk project URL that TruffleHog flags as a SnykKey (false positive; it is a dashboard project ID, not an API key).