fix(deps): pin esbuild ≥0.28.1 via pnpm-workspace overrides (GHSA-gv7w-rqvm-qjhr)

.changeset/pnpm-overrides-esbuild.md

@@ -0,0 +1,11 @@
+---
+---
+
+fix(deps): pin esbuild ≥0.28.1 and migrate orphaned overrides to pnpm-workspace.yaml
+
+pnpm v10 reads `overrides` from `pnpm-workspace.yaml`, not package.json's `pnpm`
+field — so the existing minimatch/tar pins were silently ignored and nothing
+pinned esbuild. `tsup`/`tsx`/`vite` pulled esbuild 0.27.7 / 0.28.0 (< 0.28.1),
+tripping GHSA-gv7w-rqvm-qjhr (high) in `pnpm audit`. Moved all overrides to
+`pnpm-workspace.yaml` and added `esbuild: '>=0.28.1'`. No published-package code
+change (build/test tooling + lockfile only); empty changeset.

package.json

@@ -47,10 +47,6 @@
   },
   "packageManager": "pnpm@10.31.0+sha512.e3927388bfaa8078ceb79b748ffc1e8274e84d75163e67bc22e06c0d3aed43dd153151cbf11d7f8301ff4acb98c68bdc5cadf6989532801ffafe3b3e4a63c268",
   "pnpm": {
-    "overrides": {
-      "minimatch@<10.2.3": "10.2.3",
-      "tar@>=2.0.0 <7.5.11": "^7.5.11"
-    },
     "ignoredBuiltDependencies": [
       "@nestjs/core",
       "@prisma/engines",