chore(deps): upgrade dependencies and convert audit ignores to overrides

[btravers]

Summary

Upgrade catalog dependencies to latest (majors OK) within the 7-day minimumReleaseAge maturity gate, tidy pnpm-workspace.yaml, and replace the auditConfig.ignoreGhsas block (previously suppressing SIX high GHSAs) with targeted overrides that pull each vulnerable transitive to its first patched release.

Catalog bumps

• @arethetypeswrong/cli 0.18.4 → 0.18.5
• @btravstack/theme 1.6.1 → 1.7.0 (first-party; exempt from the maturity gate)
• @commitlint/cli 21.2.0 → 21.2.1
• @orpc/arktype / @orpc/openapi / @orpc/valibot / @orpc/zod → 1.14.8
• @types/node 24.13.2 → 26.1.1
• oxfmt 0.57.0 → 0.58.0
• tsdown 0.22.3 → 0.22.7
• turbo 2.10.3 → 2.10.5
• vitest + @vitest/coverage-v8 4.1.9 → 4.1.10

Held back

• typescript 6.0.3 — typedoc's peer caps at 6.0.x (TS7 breaks the docs build).
• vitepress 1.6.4 — 2.x is alpha-only.
• @changesets/cli 2.31.0, knip 6.26.0, oxfmt 0.58.0, oxlint 1.73.0, tsdown 0.22.7 — newer releases exist but are <7 days old, so the maturity gate steps them down to the newest release older than 7 days (2.31.1 / 6.27.0 / 0.59.0 / 1.74.0 / 0.22.8+ are all too fresh as of the upgrade date).

Advisory resolution: ignoreGhsas → overrides

Removed the entire auditConfig.ignoreGhsas block and converted every advisory to a scoped pkg@major override at its first patched version. This resolves all 6 previously-ignored high GHSAs plus the remaining moderates/low:

Override	GHSA(s)	Severity	Path
brace-expansion@1 → 1.1.16	GHSA-3jxr-9vmj-r5cp	High	@asyncapi/parser > spectral
brace-expansion@2 → 2.1.2	GHSA-3jxr-9vmj-r5cp	High	testcontainers > archiver
brace-expansion@5 → 5.0.7	GHSA-3jxr-9vmj-r5cp	High	typedoc > minimatch
js-yaml@3 → 3.15.0	GHSA-52cp-r559-cp3m / GHSA-h67p-54hq-rp68	High / mod	changesets > read-yaml-file
js-yaml@4 → 4.3.0	GHSA-52cp-r559-cp3m	High	changesets/parse, @asyncapi/parser
vite → 6.4.3	GHSA-fx2h-pf6j-xcff + GHSA-v6wh-96g9-6wx3 / GHSA-4w7w-66w2-5vf9 / GHSA-67mh-4wv8-2f99	High + mod	docs > vitepress > vite/esbuild
dompurify → 3.4.11	GHSA-cmwh-pvxp-8882 / GHSA-vxr8-fq34-vvx9	mod / low	docs > mermaid > dompurify
protobufjs → 7.6.5	GHSA-j3f2-48v5-ccww	mod	testcontainers > dockerode > @grpc/proto-loader

vite: 6.4.3 also drags esbuild up to a patched 0.25.x line, resolving the esbuild dev-server advisory transitively. Kept "@types/node": "catalog:" (pins @types/node to the catalog major everywhere; types-only).

Overrides removed as unnecessary

• tsx>esbuild: ^0.28.1 and vite@>=6>esbuild: ^0.28.1 — the new vite: 6.4.3 override already resolves the vulnerable esbuild line to a patched 0.25.x, so these scoped esbuild pins are redundant. Removed; audit stays fully clean and build passes.
• undici: ^8.5.0 — audit no longer flags undici (testcontainers now resolves a patched undici on its own). Removed; audit stays clean.

Cleanup

Alphabetically sorted the catalog, co-located the minimumReleaseAge / Strict / Exclude block, normalized blank-line formatting, and added the first-party packages (unthrown, @unthrown/vitest) alongside @btravstack/theme in minimumReleaseAgeExclude. Preserved allowBuilds and peerDependencyRules intent.

Verification

• pnpm install — clean, lockfile passes supply-chain policies.
• pnpm audit --audit-level=high — exit 0, no known vulnerabilities (fully clean at all levels).
• pnpm typecheck — 16/16 tasks pass.
• pnpm build — 14/14 tasks pass, incl. vitepress docs build against vite 6.4.3.
• Integration tests not run (per scope).

Only pnpm-workspace.yaml and pnpm-lock.yaml changed; no package.json pins were needed (no @oxlint/plugins pins in this repo, and catalog bumps flow through the catalog).

[Copilot]

Pull request overview

This PR updates the repo’s pnpm catalog-managed dependencies and replaces GHSA audit suppressions with targeted overrides, aiming to keep the workspace on newer tooling while maintaining a clean security audit.

Changes:

• Bumped multiple catalog entries (incl. majors) and tidied pnpm-workspace.yaml formatting/organization.
• Removed auditConfig.ignoreGhsas and added scoped overrides to force patched versions of vulnerable transitives.
• Regenerated pnpm-lock.yaml to reflect the new catalog and override resolutions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pnpm-workspace.yaml	Updates catalog versions, reorganizes config blocks, and replaces GHSA ignores with explicit transitive-patch overrides.
pnpm-lock.yaml	Lockfile refresh to capture new catalog versions and enforced override resolutions.