Fix weekly dependency audit: override vulnerable transitive deps, ignore unpatched braces advisory

CHANGELOG.md

@@ -4,6 +4,13 @@ Top-level changes that are not tied to a single published package — build syst
 
 The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 2026-10-12 — Weekly `pnpm audit` is green again
+
+- **`overrides`** in `pnpm-workspace.yaml` raise `brace-expansion` to `^5.0.11` and `source-map-js`
+  to `^1.2.2`, past their published high-severity advisories; the lockfile follows.
+- **`auditConfig.ignoreGhsas`** lists `GHSA-vfj7-8cjw-p6xm` (`braces`, reached only through
+  `leasot`): the registry has no patched release yet. Remove the entry once `braces` >=3.0.4 exists.
+
 ## 2026-10-01 — CI runs on Ubuntu 26.04 and no action is left on Node.js 20
 
 - **`actions/upload-artifact` v4 → v7** in `ci.yml`: v4 targets Node.js 20, which the runner forces

pnpm-workspace.yaml

@@ -11,6 +11,10 @@ packages:
 # the workspace on 7.x. Drop it once Oxc lowers decorators.
 overrides:
   vite: ^7.3.6
+  # Floors that lift transitive dev dependencies past published advisories
+  # (`pnpm audit`, see .github/workflows/dependency-advisories.yml).
+  brace-expansion: ^5.0.11
+  source-map-js: ^1.2.2
 
 # pnpm >=11 refuses dependency build scripts unless they are listed here
 # (`strictDepBuilds` is on by default). esbuild's postinstall fetches the
@@ -114,3 +118,11 @@ catalogs:
 # day old.
 minimumReleaseAgeExclude:
   - '@spearwolf/signalize@1.0.0'
+
+# braces <=3.0.3 (stack exhaustion on deeply nested patterns) has no patched
+# release on the registry yet. It is reached only through leasot's glob
+# expansion of our own source paths in `pnpm make:todo`, a dev-time script that
+# never sees untrusted patterns. Drop this once braces >=3.0.4 is published.
+auditConfig:
+  ignoreGhsas:
+    - GHSA-vfj7-8cjw-p6xm