chore: patch path-to-regexp advisory

[corwinm]

Summary

• Adds a path-scoped pnpm override for @vercel/node>path-to-regexp to resolve the high-severity Dependabot alert GHSA-9wv6-86v2-598j / CVE-2024-45296.
• Refreshes pnpm-lock.yaml so @vercel/node uses path-to-regexp@6.3.0, the first patched version, while React Router/Express router keeps its existing path-to-regexp@8.4.2 resolution.

Advisory context

• Dependabot alert: https://github.com/corwinm/corwinm-remix/security/dependabot/1
• Vulnerable range: >= 4.0.0, < 6.3.0
• Fixed version: 6.3.0

Verification

• pnpm why path-to-regexp confirms @vercel/node now resolves to 6.3.0 and router still resolves to 8.4.2.
• pnpm audit --json reports 0 vulnerabilities.
• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm build

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
corwinm-remix	Ready	Preview, Comment	Jul 8, 2026 11:34pm