fix(deps): pin esbuild ≥0.28.1 via pnpm-workspace overrides (GHSA-gv7w-rqvm-qjhr) (#1910)

pnpm v10 reads `overrides` from `pnpm-workspace.yaml`, NOT package.json's `pnpm`
field (hence the recurring "pnpm field ignored" warning). The repo's minimatch
/tar pins lived in package.json and were therefore silently dead, and nothing
pinned esbuild at all — so `tsup`/`tsx`/`vite` resolved esbuild 0.27.7 and 0.28.0
(both < 0.28.1), tripping the high-severity advisory GHSA-gv7w-rqvm-qjhr that
fails `pnpm audit --audit-level=high` (the "Validate Package Dependencies" CI job)
on every dependency-touching PR.

Fix: add a real `overrides:` block to pnpm-workspace.yaml — `esbuild: '>=0.28.1'`
plus the migrated minimatch/tar pins — and drop the dead `pnpm.overrides` from
package.json. esbuild now resolves to a single 0.28.1 across the tree; high
advisories drop from 2 to 0. tsup build + vitest verified working on 0.28.1.

Test-only tooling/lockfile change; empty changeset.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

.changeset/pnpm-overrides-esbuild.md

@@ -0,0 +1,11 @@
+---
+---
+
+fix(deps): pin esbuild ≥0.28.1 and migrate orphaned overrides to pnpm-workspace.yaml
+
+pnpm v10 reads `overrides` from `pnpm-workspace.yaml`, not package.json's `pnpm`
+field — so the existing minimatch/tar pins were silently ignored and nothing
+pinned esbuild. `tsup`/`tsx`/`vite` pulled esbuild 0.27.7 / 0.28.0 (< 0.28.1),
+tripping GHSA-gv7w-rqvm-qjhr (high) in `pnpm audit`. Moved all overrides to
+`pnpm-workspace.yaml` and added `esbuild: '>=0.28.1'`. No published-package code
+change (build/test tooling + lockfile only); empty changeset.

package.json

@@ -47,10 +47,6 @@
   },
   "packageManager": "pnpm@10.31.0+sha512.e3927388bfaa8078ceb79b748ffc1e8274e84d75163e67bc22e06c0d3aed43dd153151cbf11d7f8301ff4acb98c68bdc5cadf6989532801ffafe3b3e4a63c268",
   "pnpm": {
-    "overrides": {
-      "minimatch@<10.2.3": "10.2.3",
-      "tar@>=2.0.0 <7.5.11": "^7.5.11"
-    },
     "ignoredBuiltDependencies": [
       "@nestjs/core",
       "@prisma/engines",