[Snyk] Fix for 1 vulnerabilities

[wetzja04-dot]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• packages/apps/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-14724253	828

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[continue]

Learn more

---

All Green is an AI agent that automatically:

✅ Addresses code review comments

✅ Fixes failing CI checks

✅ Resolves merge conflicts

---

Unsubscribe from All Green comments

[Copilot]

Pull request overview

This is a Snyk-generated PR that attempts to fix a high-severity vulnerability (SNYK-JS-QS-14724253, score 828) related to "Allocation of Resources Without Limits or Throttling" in the qs dependency. However, the proposed fix downgrades two @PolkaDot packages to significantly older versions, which creates critical version compatibility issues.

Key changes:

• Downgrade @polkadot/apps-config from ^0.166.2-7-x to ^0.68.1 (approximately 98 minor versions back)
• Downgrade @polkadot/react-signer from ^0.166.2-7-x to ^0.34.1 (approximately 132 minor versions back)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Downgrading @polkadot/apps-config from ^0.166.2-7-x to ^0.68.1 creates a severe version mismatch. This package is nearly 100 minor versions behind the other @PolkaDot dependencies in this file (which are all at ^0.166.2-7-x). This will likely cause API incompatibilities, TypeScript errors, and runtime failures since the package ecosystem expects all @PolkaDot packages to be at the same major version. Instead of downgrading, the qs vulnerability should be fixed by upgrading to a newer version that resolves the security issue while maintaining compatibility with the rest of the @PolkaDot ecosystem.

Suggested change

	"@polkadot/apps-config": "^0.68.1",
	"@polkadot/apps-config": "^0.166.2-7-x",

[Copilot]

Downgrading @polkadot/react-signer from ^0.166.2-7-x to ^0.34.1 creates a severe version mismatch. This package is over 130 minor versions behind the other @PolkaDot dependencies in this file (which are all at ^0.166.2-7-x). This will likely cause API incompatibilities, TypeScript errors, and runtime failures since the package ecosystem expects all @PolkaDot packages to be at the same major version. Instead of downgrading, the qs vulnerability should be fixed by upgrading to a newer version that resolves the security issue while maintaining compatibility with the rest of the @PolkaDot ecosystem.

Suggested change

	"@polkadot/react-signer": "^0.34.1",
	"@polkadot/react-signer": "^0.166.2-7-x",