chore: audit fix

[simeng-li]

Summary

• Clean up root pnpm dependency version override settings, remove overlapped version overrides
• Run pnpm audit to fix new security issues.

Testing

Checklist

• .changeset
• unit tests
• integration tests
• necessary TSDoc comments

[Copilot]

Pull request overview

This PR updates pnpm dependency overrides and regenerates the lockfile to address security advisories found via pnpm audit, primarily by tightening/refreshing override ranges and bumping resolved transitive versions.

Changes:

• Clean up and update pnpm.overrides entries (range adjustments, removal of redundant overlaps, add serialize-javascript override).
• Regenerate pnpm-lock.yaml to apply updated overrides and bring in patched dependency versions (e.g., Next, SvelteKit, minimatch, serialize-javascript).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates pnpm.overrides ranges/targets to address audit findings and reduce overlap.
pnpm-lock.yaml	Lockfile refresh reflecting the updated overrides and new resolved dependency graph.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

Comments suppressed due to low confidence (2)

package.json:55

• The Next.js override values were changed from open-ended ">=15.5.10" to caret "^15.5.10", which prevents Next 16+ from being selected. In the lockfile this results in Next being resolved to 15.5.12 instead of 16.1.6. Please confirm this restriction/downgrade is intentional for the audit fix; if the goal is only to enforce a minimum patched version, keep an open-ended lower bound (or pin to a specific patched version) rather than narrowing to the 15.x range.

      "next@>=10.0.0 <15.5.10": "^15.5.10",
      "next@>=15.5.1-canary.0 <15.5.10": "^15.5.10",

pnpm-lock.yaml:636

• This lockfile hunk shows Next.js being resolved to 15.5.12 where it previously resolved to 16.1.6, due to the override/specifier change to "^15.5.10". Please double-check this downgrade is intended and that all Next-based samples/packages remain compatible; otherwise adjust the override so the resolver can pick the latest patched version across majors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.