chore: fix path-to-regexp vulnerabilities

[peppescg]

Summary

Fix 3 Grype vulnerability findings via pnpm overrides with parent-selector targeting:

Package	From	To	CVE	Severity
path-to-regexp (via @koa/router)	8.3.0	≥8.4.0	GHSA-j3q9-mxjg-w52f	High
path-to-regexp (via @koa/router)	8.3.0	≥8.4.0	GHSA-27v5-c462-wpq7	Medium
path-to-regexp (via express@4)	0.1.12	0.1.13	GHSA-37ch-88jc-xwx2	High

Parent-selector overrides (@koa/router>path-to-regexp, router>path-to-regexp, express>path-to-regexp) are used intentionally to avoid bumping MSW's internal path-to-regexp@6.x, which would break test mocking.

Test plan

• grype . reports "No vulnerabilities found"
• pnpm test — 194/194 tests pass

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates pnpm dependency overrides to remediate reported path-to-regexp CVEs while keeping MSW’s path-to-regexp@6.x in place (per PR description).

Changes:

• Add pnpm.overrides parent-selector rules to force patched path-to-regexp versions for express, @koa/router, and router.
• Regenerate pnpm-lock.yaml to reflect path-to-regexp upgrades (0.1.13, 8.4.0) in the resolved dependency graph.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
package.json	Adds pnpm override rules targeting transitive path-to-regexp dependencies to address vulnerabilities.
pnpm-lock.yaml	Updates lockfile overrides and resolved versions for path-to-regexp to match the new override constraints.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]

- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details on the pull request process.

---

This review will be automatically dismissed once you add the justification section.

noop