security(deps): pin @asyncapi packages to non-compromised versions

Several AsyncAPI npm packages were briefly compromised on 2026-07-14
(the "Miasma RAT" supply-chain incident, delivered via a post-install
sync.js dropper). sei-js pulls @asyncapi/specs transitively through
mint -> @asyncapi/parser, whose "^6.8.0" range can float up into the
compromised 6.11.2 on any fresh install or lockfile regeneration.

Pin the four affected packages to their latest non-compromised
versions via pnpm.overrides so no install can resolve a malicious
release:

  @asyncapi/specs                6.11.1   (in tree: 6.10.0 -> 6.11.1)
  @asyncapi/generator            3.3.0    (preventive; not in tree)
  @asyncapi/generator-helpers    1.1.0    (preventive; not in tree)
  @asyncapi/generator-components 1.0.0    (preventive; not in tree)

No compromised version was ever present in the lockfile. The only
resolved change is @asyncapi/specs 6.10.0 -> 6.11.1; the generator
pins are defense-in-depth in case that toolchain is introduced later.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: alexander-sei

package.json

@@ -25,5 +25,13 @@
 		"ts-node": "2.1.2",
 		"typescript": "^5.8.2"
 	},
-	"packageManager": "pnpm@9.0.0"
+	"packageManager": "pnpm@9.0.0",
+	"pnpm": {
+		"overrides": {
+			"@asyncapi/specs": "6.11.1",
+			"@asyncapi/generator": "3.3.0",
+			"@asyncapi/generator-helpers": "1.1.0",
+			"@asyncapi/generator-components": "1.0.0"
+		}
+	}
 }