fix: bump transitive deps to resolve brace-expansion and ip-address CVEs

[angelocordon]

Summary

Addresses three SECVULN tickets by upgrading @openapitools/openapi-generator-cli from 2.39.1 to 2.40.1, which allows transitive dependencies to resolve to their patched versions.

Vulnerabilities addressed

Package	Old version	New version	Advisory	SECVULN
brace-expansion	5.0.6	5.0.9	GHSA-mh99-v99m-4gvg	SECVULN-51496
brace-expansion	5.0.6	5.0.9	GHSA-rgw5-rvv9-x895	SECVULN-51925
ip-address	10.2.0	10.5.0	GHSA-mwp4-54f8-5fhr	SECVULN-51926

Details

SECVULN-51496 / SECVULN-51925 — brace-expansion DoS
brace-expansion@5.0.6 has two related DoS vulnerabilities. 5.0.8 added an EXPANSION_MAX_LENGTH bound, but intermediate arrays were still unbounded (fixed fully in 5.0.9). An attacker passing a crafted string to expand() can trigger an uncatchable OOM crash or a multi-minute CPU stall.

SECVULN-51926 — ip-address SSRF / trust-boundary bypass
ip-address@10.2.0 decodes leading-zero octets as decimal while OS resolvers decode them as octal. isPrivate()/isLoopback() etc. mis-classify addresses like 012.0.0.1 (classified public, but resolves to 10.0.0.1), enabling SSRF bypass. Fixed in 10.3.1; we now resolve to 10.5.0.

Dependency chain

Both packages are transitive dev-only dependencies:

@openapitools/openapi-generator-cli
  ├── glob -> minimatch -> brace-expansion
  └── proxy-agent -> socks-proxy-agent -> socks -> ip-address

Additional fix

Migrated the existing pnpm.overrides config from the pnpm field in package.json (silently ignored since pnpm v10) to pnpm-workspace.yaml, which is the correct location.