fix(deps): patch current High, Medium, and Low advisories

[seonghobae]

Summary

• patches every vulnerability currently reported by OSV for the pnpm lockfile
• keeps brace-expansion major lines compatible by upgrading 1.x and 5.x independently while preserving the already-safe 2.1.2 line
• moves effective pnpm 9 security overrides into the root package manifest and removes stale duplicate workspace entries

Patched advisories

• brace-expansion 1.1.15 -> 1.1.16 and 5.0.6 -> 5.0.7: GHSA-3jxr-9vmj-r5cp / CVE-2026-13149
• fast-uri 3.1.2 -> 3.1.4: GHSA-4c8g-83qw-93j6 and GHSA-v2hh-gcrm-f6hx
• js-yaml 4.2.0 -> 4.3.0: GHSA-52cp-r559-cp3m
• hono 4.12.25 -> 4.12.27: GHSA-hvrm-45r6-mjfj, GHSA-w62v-xxxg-mg59, and GHSA-xgm2-5f3f-mvvc
• @hono/node-server 1.19.14 -> 2.0.11: GHSA-frvp-7c67-39w9 and GHSA-9mqv-5hh9-4cgg
• sharp 0.34.5 -> 0.35.3: GHSA-f88m-g3jw-g9cj and its bundled libvips fixes
• body-parser 2.2.2 -> 2.3.0: GHSA-v422-hmwv-36x6

Validation

• frozen pnpm 9.15.4 install and Prisma client generation
• shadcn CLI startup after the @hono/node-server major-line override
• all workspace typechecks and lints
• CLI: 153 tests passed
• shared: 42 tests passed
• web without database: 230 passed, 13 environment-dependent tests skipped
• web with isolated PostgreSQL 16: 243 tests passed with no skips
• Prisma migration drift: no difference detected
• all 17 migrations deployed successfully to an empty PostgreSQL database
• Next.js production build completed successfully
• OSV lockfile scan: zero findings
• Trivy filesystem scan at Medium, High, and Critical: zero findings

The package ranges are deliberately narrow so unrelated dependency major lines are not coerced.

[Copilot]

Pull request overview

This PR updates pnpm overrides (and the generated lockfile) to remediate currently reported OSV vulnerabilities, moving effective pnpm 9 override pins into the root package.json and cleaning up stale workspace-level entries.

Changes:

• Move/add security-related pnpm.overrides into the root package.json (and reflect them in pnpm-lock.yaml).
• Update patched dependency versions in the lockfile (e.g., hono, js-yaml, fast-uri, body-parser, sharp, @hono/node-server).
• Remove stale brace-expansion / fast-uri entries from pnpm-workspace.yaml overrides.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pnpm-workspace.yaml	Removes stale override entries so workspace overrides don’t duplicate / mislead when pnpm 9 is in use.
pnpm-lock.yaml	Regenerates lockfile to apply the new overrides and upgraded patched dependency versions.
package.json	Adds/updates root pnpm.overrides to enforce patched versions under pnpm 9.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 10 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file