Fix Dependabot transitive security updates

[cursor]

Adds targeted pnpm overrides for vulnerable transitive dependencies that Dependabot could not update automatically, then regenerates the lockfile.

Validation:

• pnpm install --lockfile-only --frozen-lockfile
• pnpm --filter db db:generate && pnpm check-types

  

[cursor]

CI Autofix Automation

Failure logs: https://github.com/andrmaz/cortex/actions/runs/27463460309/job/81181436325
Broken by: #21 (cc @coderabbitai)
Reason: PR #21 regenerated the pnpm lockfile while adding test dependencies, leaving vulnerable transitive versions of brace-expansion, flatted, @hono/node-server, postcss, and picomatch. Dependabot's security-update jobs were configured for direct updates, so each advisory failed with security_update_not_possible instead of updating the transitive package.
Fixed by: Added targeted root pnpm.overrides for the five vulnerable transitive ranges and regenerated pnpm-lock.yaml. Verified with pnpm install --lockfile-only --frozen-lockfile and pnpm --filter db db:generate && pnpm check-types.

View PR

  

_{Sent by Cursor Automation: Fix CI failures}