Fix weekly dependency audit: override vulnerable transitive deps, ignore unpatched braces advisory

[Copilot]

The weekly "Report high-severity advisories" job (pnpm audit --audit-level=high) failed on four high-severity advisories in the dev dependency tree. Three have patched releases. The fourth, braces, does not.

• Overrides (pnpm-workspace.yaml, lockfile regenerated)

  • brace-expansion: ^5.0.11 clears two advisories, reached via rimraf → glob → minimatch.
  • source-map-js: ^1.2.2 clears one advisory, reached via vitest and vite.
  • Both packages resolve to a single patched version.

• Ignored advisory

  • braces (GHSA-vfj7-8cjw-p6xm, <=3.0.3, patched in >=3.0.4) is reached only via leasot → globby → fast-glob → micromatch. The registry's newest release is 3.0.3, so there is nothing to upgrade to.
  • The advisory is added to auditConfig.ignoreGhsas, with a comment saying why. leasot only runs in pnpm make:todo, on the repo's own source paths.
  • Reviewers: please confirm you are comfortable ignoring this one. The entry should be removed once braces ≥ 3.0.4 is published.

• Changelog

  • Root CHANGELOG.md entry added.

Two moderate advisories are still reported. They don't fail the job, because --audit-level=high gates the exit code.

overrides:
  brace-expansion: ^5.0.11
  source-map-js: ^1.2.2

auditConfig:
  ignoreGhsas:
    - GHSA-vfj7-8cjw-p6xm

[Copilot]

🟢 Approval recommended

The overrides resolve the patched advisories, while the narrowly scoped exception is justified and clearly documented.

0 open findings

What changed in this PR

Updates dependency-audit configuration to resolve patched advisories and temporarily suppress an unpatched, dev-only advisory.

Changes:

• Overrides vulnerable transitive dependencies with patched versions.
• Ignores the unpatched braces advisory with documented scope and removal criteria.
• Regenerates the lockfile and records the maintenance change.

File	Description
pnpm-workspace.yaml	Adds secure overrides and the documented advisory exception.
pnpm-lock.yaml	Resolves overridden dependencies to patched releases.
CHANGELOG.md	Records the audit remediation and temporary exception.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.