chore(deps): re-patch the six transitive advisories that widened past their overrides

[arkgast]

Summary

• pnpm audit --audit-level=high has been failing repo-wide — on main as well as on every open branch — since the advisory DB widened the ranges on dependencies this repo already overrides. It is the 4th step of pnpm pr-tests and a step in the checks job, so it failed CI on diffs that touched no dependency at all (PR feat(rules,backstage,beacon,auth): position-assignment lane + role-lifecycle follow-through #222 merged with it red).
• 9 high advisories across 5 packages, all dev/build tooling that never reaches a shipped bundle. Four are ranges that widened past an existing override, so the override kept pinning a version that is now itself vulnerable; two are newly flagged with no override at all.

package	was	now	why this shape
undici	^7.28.0	^7.29.0	floor moved; stays in major 7 — jsdom@29 requires undici-7 internals v8 removed
brace-expansion (v5)	<5.0.7 selector	<5.0.9	widened twice since the override was written
brace-expansion (v2)	not covered	<2.1.4	the v2 copy was explicitly out of scope before, now in range
fast-uri	<=3.1.3 selector	<3.1.5	stays in 3.x — ajv requires ^3.0.1
nanoid	—	<3.3.18	via postcss (^3.3.x); upper bound keeps 5.x/6.x out of scope
postcss	—	<8.5.18	GHSA-r28c-9q8g-f849, path traversal via sourceMappingURL auto-loading

• Every patch was available inside the existing major, so no consumer range is violated and no major moves. Resolved after install, exactly one copy of each: brace-expansion 2.1.4 + 5.0.9, undici 7.29.0, fast-uri 3.1.5, nanoid 3.3.18, postcss 8.5.26. All Node 24 compatible, none deprecated, no new native postinstall (allowBuilds unchanged).
• The 5 pre-existing moderates cleared with the same bumps.

Test plan

• pnpm audit --audit-level=high — no known vulnerabilities found (was: 5 moderate | 9 high)
• pnpm install --frozen-lockfile clean (the CI install mode)
• pnpm pr-tests passes end to end (format, turbo run ci, knip, audit, test:seed, test:harness)
• checks pass
• emulator pass

Reviews

• secure-dep-vetting — every version taken from the live registry, none from memory; per-major latest verified (brace-expansion@2 → 2.1.4, undici@7 → 7.29.0, fast-uri@3 → 3.1.5, nanoid@3 → 3.3.18, postcss@8 → 8.5.26), engines.node checked against Node 24 on each, deprecated empty on each.
• Agent(bundle-budget-watcher) — all four CI-gated budgets pass with headroom (spotlight eager JS 107/108 kB gz, spotlight CSS 16/17, backstage eager JS 160/162, backstage CSS 13/15); pnpm knip clean. Measured index-chunk gz delta vs origin/main: 0 B — a --force rebuild of a baseline worktree at origin/main (0 cached, 7 tasks) emits byte-identical chunks, same content hashes (index-CX0vhM-Y.js 132 922 B gz, index-CD_vz9VG.js 103 928 B gz, and both CSS files). postcss is the only bump in the CSS pipeline and both apps use @tailwindcss/vite with no postcss.config.*, so it has no configured plugin surface here.

🤖 Generated with Claude Code