Problem

The Validate Package Dependencies CI job (pnpm audit --audit-level=high) fails on every dependency-touching PR with a high-severity esbuild advisory — GHSA-gv7w-rqvm-qjhr, affecting esbuild >=0.17.0 <0.28.1 via tsup → esbuild, tsx → esbuild, and vite → esbuild.

Root cause

pnpm v10 reads overrides from pnpm-workspace.yaml, not from package.json's pnpm field — that's the recurring [WARN] The "pnpm" field in package.json is no longer read by pnpm … pnpm.overrides … ignored message in every install.

Consequences on main:

• The repo's existing minimatch / tar pins live in package.json's pnpm.overrides → silently ignored (dead security pins).
• Nothing pins esbuild at all → tsup/tsx/vite resolve 0.27.7 and 0.28.0 (both < 0.28.1, vulnerable). The lockfile carried three esbuild versions.

Fix

• Add a real overrides: block to pnpm-workspace.yaml: esbuild: '>=0.28.1' + the migrated minimatch / tar pins.
• Drop the now-redundant pnpm.overrides from package.json.

Result

• esbuild collapses to a single 0.28.1 across the whole tree.
• pnpm audit --audit-level=high: 2 high → 0 (now 2 low | 5 moderate); total advisories 11 → 7 (the migrated minimatch/tar pins also re-applied).
• Verified the forced bump doesn't break tooling: @objectstack/formula tsup build succeeds and vitest 95/95 pass on esbuild 0.28.1.

Test-only tooling/lockfile change — no published-package code changes; empty changeset.

🤖 Generated with Claude Code