fix: patch ReDoS vulnerabilities in brace-expansion and @eslint/plugin-kit

package.json

@@ -15,6 +15,19 @@
     "turbo": "^2.5.8",
     "typescript": "5.9.3"
   },
+  "pnpm": {
+    "overrides": {
+      "[email protected]": "1.1.12",
+      "[email protected]": "2.0.2",
+      "@eslint/[email protected]": "0.4.0"
+    },
+    "comments": {
+      "overrides": {
+        "brace-expansion": "Security fix for CVE-2025-5889 (ReDoS vulnerability). Patches brace-expansion 1.1.11→1.1.12 and 2.0.1→2.0.2. Upstream dependency [email protected] hasn't updated to use newer minimatch/glob versions yet.",
+        "@eslint/plugin-kit": "Security fix for GHSA-xffm-g5w8-qvg7 (ReDoS vulnerability). Using override instead of updating eslint to avoid updating all other eslint dependencies. [email protected] uses @eslint/[email protected] (vulnerable), but 0.4.0 is backward compatible."
+      }
+    }
+  },
   "packageManager": "[email protected]",
   "engines": {
     "node": ">=18"