diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2e97e2f..d7a6146 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@ Top-level changes that are not tied to a single published package — build syst
 
 The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 2026-10-12 — Weekly `pnpm audit` is green again
+
+- **`overrides`** in `pnpm-workspace.yaml` raise `brace-expansion` to `^5.0.11` and `source-map-js`
+  to `^1.2.2`, past their published high-severity advisories; the lockfile follows.
+- **`auditConfig.ignoreGhsas`** lists `GHSA-vfj7-8cjw-p6xm` (`braces`, reached only through
+  `leasot`): the registry has no patched release yet. Remove the entry once `braces` >=3.0.4 exists.
+
 ## 2026-10-01 — CI runs on Ubuntu 26.04 and no action is left on Node.js 20
 
 - **`actions/upload-artifact` v4 → v7** in `ci.yml`: v4 targets Node.js 20, which the runner forces
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 004fd80..3670bba 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -81,6 +81,8 @@ catalogs:
 
 overrides:
   vite: ^7.3.6
+  brace-expansion: ^5.0.11
+  source-map-js: ^1.2.2
 
 importers:
 
@@ -921,8 +923,8 @@ packages:
     resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
     engines: {node: 18 || 20 || >=22}
 
-  brace-expansion@5.0.9:
-    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
+  brace-expansion@5.0.12:
+    resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
     engines: {node: 20 || >=22}
 
   braces@3.0.3:
@@ -1338,8 +1340,8 @@ packages:
     resolution: {integrity: sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==}
     engines: {node: '>=12'}
 
-  source-map-js@1.2.1:
-    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+  source-map-js@1.2.2:
+    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
     engines: {node: '>=0.10.0'}
 
   stackback@0.0.2:
@@ -1975,7 +1977,7 @@ snapshots:
 
   balanced-match@4.0.4: {}
 
-  brace-expansion@5.0.9:
+  brace-expansion@5.0.12:
     dependencies:
       balanced-match: 4.0.4
 
@@ -2242,7 +2244,7 @@ snapshots:
     dependencies:
       '@babel/parser': 7.29.8
       '@babel/types': 7.29.8
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   make-dir@3.1.0:
     dependencies:
@@ -2261,7 +2263,7 @@ snapshots:
 
   minimatch@10.2.6:
     dependencies:
-      brace-expansion: 5.0.9
+      brace-expansion: 5.0.12
 
   minipass@7.1.3: {}
 
@@ -2318,7 +2320,7 @@ snapshots:
     dependencies:
       nanoid: 3.3.18
       picocolors: 1.1.1
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   queue-microtask@1.2.3: {}
 
@@ -2386,7 +2388,7 @@ snapshots:
 
   slash@4.0.0: {}
 
-  source-map-js@1.2.1: {}
+  source-map-js@1.2.2: {}
 
   stackback@0.0.2: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 6e2bfee..81a4414 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,6 +11,10 @@ packages:
 # the workspace on 7.x. Drop it once Oxc lowers decorators.
 overrides:
   vite: ^7.3.6
+  # Floors that lift transitive dev dependencies past published advisories
+  # (`pnpm audit`, see .github/workflows/dependency-advisories.yml).
+  brace-expansion: ^5.0.11
+  source-map-js: ^1.2.2
 
 # pnpm >=11 refuses dependency build scripts unless they are listed here
 # (`strictDepBuilds` is on by default). esbuild's postinstall fetches the
@@ -114,3 +118,11 @@ catalogs:
 # day old.
 minimumReleaseAgeExclude:
   - '@spearwolf/signalize@1.0.0'
+
+# braces <=3.0.3 (stack exhaustion on deeply nested patterns) has no patched
+# release on the registry yet. It is reached only through leasot's glob
+# expansion of our own source paths in `pnpm make:todo`, a dev-time script that
+# never sees untrusted patterns. Drop this once braces >=3.0.4 is published.
+auditConfig:
+  ignoreGhsas:
+    - GHSA-vfj7-8cjw-p6xm