chore(deps): resolve Dependabot alerts via pnpm overrides (91 -> 1)

Add root pnpm.overrides pinning vulnerable transitive dependencies to
patched versions across the workspace. Majors are preserved; packages
vulnerable in multiple majors (minimatch, picomatch, brace-expansion)
are pinned per major, and packages whose only fix lives in a newer major
(serialize-javascript, uuid) are forced to that major.

Clears every high and low alert and 45/46 moderate. The one remaining is
vite <=6.4.1 pulled in by the vitest test runner (dev-only, never
shipped); its only fix is vite 6.4.2, which requires vitest 3 — and
vitest 3 breaks the tests that dynamically import temp config files.

Author: bugra9

package.json

@@ -72,7 +72,50 @@
             "sharp",
             "unrs-resolver",
             "workerd"
-        ]
+        ],
+        "overrides": {
+            "@babel/helpers@7": "^7.26.10",
+            "@babel/plugin-transform-modules-systemjs@7": "^7.29.4",
+            "@babel/runtime@7": "^7.26.10",
+            "@xmldom/xmldom@0.8": "^0.8.13",
+            "ajv@6": "^6.14.0",
+            "brace-expansion@1": "^1.1.13",
+            "brace-expansion@2": "^2.0.3",
+            "brace-expansion@5": "^5.0.6",
+            "devalue@5": "^5.8.1",
+            "esbuild@0": ">=0.25.0",
+            "estree-util-value-to-estree@3": "^3.3.3",
+            "fast-uri@3": "^3.1.2",
+            "fast-xml-builder@1": "^1.1.7",
+            "flatted@3": "^3.4.2",
+            "hono@4": "^4.12.18",
+            "image-size@1": "^1.2.1",
+            "ip-address@10": "^10.1.1",
+            "js-yaml@3": "^3.14.2",
+            "lodash@4": "^4.18.0",
+            "mdast-util-to-hast@13": "^13.2.1",
+            "mermaid@11": "^11.15.0",
+            "minimatch@3": "^3.1.4",
+            "minimatch@9": "^9.0.7",
+            "node-forge@1": "^1.4.0",
+            "on-headers@1": "^1.1.0",
+            "path-to-regexp@0.1": "^0.1.13",
+            "picomatch@2": "^2.3.2",
+            "picomatch@4": "^4.0.4",
+            "postcss@8": "^8.5.10",
+            "prismjs@1": "^1.30.0",
+            "qs@6": "^6.15.2",
+            "serialize-javascript": "^7.0.5",
+            "svelte@5": "^5.55.7",
+            "svgo@3": "^3.3.3",
+            "undici@6": "^6.24.0",
+            "uuid": "^11.1.1",
+            "vite@6": "^6.4.2",
+            "webpack@5": "^5.104.1",
+            "webpack-dev-server@5": "^5.2.4",
+            "ws@8": "^8.20.1",
+            "yaml@2": "^2.8.3"
+        }
     },
     "packageManager": "pnpm@10.33.2+sha512.a90faf6feeab71ad6c6e57f94e0fe1a12f5dcc22cd754db40ae9593eb6a3e0b6b12e3540218bb37ae083404b1f2ce6db2a4121e979829b4aff94b99f49da1cf8"
 }