[BUG] simple-rest pulls vulnerable decode-uri-component version

Describe the bug

@refinedev/[email protected] depends on query-string@^7.1.1, which resolves to [email protected] and pulls decode-uri-component@^0.2.2. Versions of decode-uri-component before 0.5.0 are affected by CVE-2026-45822 / GHSA-vcc3-ghjq-m6fr, a denial-of-service vulnerability when decoding malformed percent-encoded input.

The current secure query-string release uses decode-uri-component@^0.5.0, but it is ESM-only. Any upgrade must preserve the ESM and CommonJS exports promised by @refinedev/simple-rest.

Steps To Reproduce

1. Install @refinedev/[email protected].
2. Inspect the installed dependency graph.
3. Observe @refinedev/simple-rest -> [email protected] -> [email protected].
4. Run a vulnerability scanner that includes GHSA-vcc3-ghjq-m6fr.

Expected behavior

@refinedev/simple-rest must not install a vulnerable decode-uri-component release, and its ESM and CommonJS package exports must continue to work.

Packages

• @refinedev/[email protected]
• [email protected]
• [email protected]

Additional Context

Advisory: https://github.com/advisories/GHSA-vcc3-ghjq-m6fr

The fixed [email protected] release is ESM-only, so a direct transitive override breaks CommonJS consumers of query-string@7.