chore(deps): upgrade dependencies and convert audit ignore to overrides

[btravers]

Summary

Upgrade catalog dependencies to latest (respecting the 7-day minimumReleaseAge maturity gate), tidy pnpm-workspace.yaml, and replace the auditConfig.ignoreGhsas block with targeted overrides that pull each vulnerable transitive to its patched version.

Only pnpm-workspace.yaml and pnpm-lock.yaml changed. No package.json pins needed bumping (demesne has no @oxlint/plugins pins).

Catalog bumps

Package	From	To
@arethetypeswrong/cli	0.18.4	0.18.5
@btravstack/theme	1.6.1	1.7.0
@commitlint/cli	21.0.2	21.2.1
@commitlint/config-conventional	21.0.2	21.2.0
@orpc/{client,contract,server}	2.0.0-beta.15	2.0.0-beta.16
@types/node	24.13.2	26.1.1
@vitest/coverage-v8	4.1.8	4.1.10
hono	4.12.28	4.12.30
knip	6.20.0	6.26.0
lefthook	2.1.9	2.1.10
oxfmt	0.56.0	0.58.0
oxlint	1.72.0	1.73.0
tsdown	0.22.3	0.22.7
turbo	2.10.4	2.10.5
vitest	4.1.8	4.1.10

Held back

• typescript 6.0.3 — typedoc's peer caps at 6.0.x; TS 7 breaks typedoc.
• vitepress 1.6.4 — 2.x is only alpha.
• prisma / @prisma/client / @prisma/adapter-pg 7.8.0 — 7.9.0 published 2026-07-20, inside the 7-day maturity window.

Catalog is now alphabetically sorted, the overrides block is co-located, and the minimumReleaseAge / minimumReleaseAgeStrict / minimumReleaseAgeExclude block is grouped at the end.

Security: ignore → override conversion

Removed the auditConfig.ignoreGhsas block and replaced it with scoped overrides:

Advisory	Severity	Path	Resolution
GHSA-fx2h-pf6j-xcff (was ignored)	high	docs > vitepress > vite	vite: 6.4.3
GHSA-v6wh-96g9-6wx3	moderate	docs > vitepress > vite	vite: 6.4.3
GHSA-4w7w-66w2-5vf9	moderate	docs > vitepress > vite	vite: 6.4.3
GHSA-67mh-4wv8-2f99	moderate	vite > esbuild	dragged to esbuild 0.25.x by vite: 6.4.3
GHSA-92pp-h63x-v22m	moderate	prisma > @prisma/dev > @hono/node-server	@hono/node-server@1: 1.19.13

vitepress 1.6.x pins vite ^5.4.14 (no patched 5.x release), so vite is pulled up to 6.4.3 — the docs vitepress build is verified against it.

Overrides removed as unnecessary

After the catalog bumps, these transitives resolve to patched versions on their own (test-removed, reinstalled, audit stayed clean at all levels):

• brace-expansion@5 (GHSA-3jxr-9vmj-r5cp) — now resolves to 5.0.7 naturally.
• js-yaml@3 / js-yaml@4 (GHSA-52cp-r559-cp3m) — now resolve to 3.15.0 / 4.3.0 naturally.

The two remaining overrides (vite, @hono/node-server@1) were each confirmed still load-bearing (removing either reintroduces its advisory).

Verification

• pnpm install — clean, lockfile passes supply-chain policies.
• pnpm audit — No known vulnerabilities found (clean at every level, including --audit-level=high → exit 0).
• pnpm typecheck — pass.
• pnpm build — pass (includes the vitepress docs build, confirming the vite 6.4.3 override).

Integration tests were not run.

[Copilot]

Pull request overview

This PR updates the workspace dependency catalog and lockfile to the latest eligible versions, and replaces the previous audit ignore configuration with explicit pnpm overrides to force patched transitive versions.

Changes:

• Bumped multiple catalog dependencies (tooling + libraries) and refreshed pnpm-lock.yaml accordingly.
• Removed auditConfig.ignoreGhsas and introduced overrides to enforce patched versions for vulnerable transitives.
• Reorganized pnpm-workspace.yaml sections (catalog ordering, overrides placement, maturity gate grouping).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pnpm-workspace.yaml	Updates catalog versions and replaces audit ignore with new overrides configuration and commentary.
pnpm-lock.yaml	Lockfile refresh reflecting catalog bumps and new overrides (vite, @hono/node-server@1).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.