Raise pnpm override floors to clear all frontend advisories

All 23 open Dependabot alerts against frontend/pnpm-lock.yaml resolve to
packages whose override floor sat below the patched release. Every floor
now carries an explicit upper bound, as an open-ended floor lets pnpm
resolve across a major version.

docs/backlog/frontend-js-yaml-overrides-stale.md

@@ -1,37 +0,0 @@
----
-worth: yes
-where: frontend/pnpm-lock.yaml:61
-added: 2026-08-11
----
-# frontend pnpm overrides still admit vulnerable js-yaml
-
-Three open Dependabot alerts against `frontend/pnpm-lock.yaml` survive because the pnpm override
-floors in that file are set below the patched versions.
-
-| override (line) | current floor | resolved version | advisory | patched in |
-|---|---|---|---|---|
-| `js-yaml@>=3.0.0 <4.0.0` (:61) | `>=3.14.2` | 3.15.0 (:4798, :12669) | GHSA-5p4m-2wfm-xmqj (high) | 3.15.1 |
-| `js-yaml@>=4.0.0 <5.0.0` (:62) | `>=5.0.0` | 5.2.0 (:4802, :12674) | GHSA-pm4m-ph32-ghv5 (high) | 5.2.2 |
-| | | | GHSA-724g-mxrg-4qvm (medium) | 5.2.1 |
-
-GHSA-5p4m-2wfm-xmqj is the same advisory PR #2141 closed for `site/`, patched there by moving to
-js-yaml 3.15.1. It remains open against the frontend lockfile, which is still on 3.15.0. Verified
-against the repository's Dependabot alerts, not inferred from version numbers.
-
-`.github/dependabot.yml` sets `open-pull-requests-limit: 0` on every npm directory, so no version
-update PR will ever reach these. Security updates bypass that limit, which is why #2141 existed at
-all, but the override floors pin the resolution regardless of what the bot proposes.
-
-Fix: raise both floors and re-lock.
-
-```yaml
-js-yaml@>=3.0.0 <4.0.0: '>=3.15.1 <4.0.0'
-js-yaml@>=4.0.0 <5.0.0: '>=5.2.2 <6.0.0'
-```
-
-Both js-yaml lines are build and test time only in the frontend (3.x arrives via
-`@istanbuljs/load-nyc-config`), so this is alert hygiene rather than a shipped vulnerability.
-
-Separately, and not covered here: `frontend/pnpm-lock.yaml` carries a wider queue of open alerts
-(brace-expansion, undici, fast-uri, postcss, svgo, webpack-dev-server, body-parser). Those were not
-audited and may or may not be reachable.

frontend/package.json

@@ -49,7 +49,6 @@
       "semver@>=7.0.0 <7.5.2": ">=7.5.2",
       "semver@>=6.0.0 <6.3.1": ">=6.3.1",
       "serialize-javascript@<=7.0.2": ">=7.0.3",
-      "svgo@>=2.1.0 <2.8.1": ">=2.8.1",
       "flatted@<3.4.0": ">=3.4.0",
       "flatted@<=3.4.1": ">=3.4.2",
       "lodash-es@>=4.0.0 <=4.17.23": ">=4.18.0",
@@ -59,8 +58,6 @@
       "serialize-javascript@>=6.0.0 <6.0.2": ">=6.0.2",
       "@xmldom/xmldom@<0.8.12": ">=0.8.12",
       "@babel/traverse@<7.23.2": ">=7.23.2 <8.0.0",
-      "fast-uri@<=3.1.0": ">=3.1.1",
-      "fast-uri@<=3.1.1": ">=3.1.2",
       "@xmldom/xmldom@<0.8.13": ">=0.8.13",
       "turbo@>=1.1.0 <2.9.14": ">=2.9.14",
       "@tootallnate/once@<2.0.1": ">=2.0.1",
@@ -73,20 +70,27 @@
       "form-data@>=4.0.0 <4.0.6": ">=4.0.6",
       "launch-editor@<=2.14.0": ">=2.14.1",
       "@babel/core@<=7.29.0": ">=7.29.6 <8.0.0",
-      "webpack-dev-server@<5.2.5": ">=5.2.5",
+      "webpack-dev-server@<5.2.6": ">=5.2.6 <6.0.0",
       "http-proxy-middleware@>=0.16.0 <2.0.10": ">=2.0.10",
       "turbo@<=2.9.13": ">=2.9.14",
       "yaml@>=1.0.0 <2.0.0": ">=1.10.3 <2.0.0",
       "yaml@>=2.0.0 <3.0.0": ">=2.9.0 <3.0.0",
-      "js-yaml@>=3.0.0 <4.0.0": ">=3.14.2 <4.0.0",
-      "js-yaml@>=4.0.0 <5.0.0": ">=5.0.0 <6.0.0",
+      "js-yaml@>=3.0.0 <4.0.0": ">=3.15.1 <4.0.0",
+      "js-yaml@>=4.0.0 <5.0.0": ">=5.2.2 <6.0.0",
       "minimatch@>=3.0.0 <4.0.0": ">=3.1.3 <4.0.0",
       "minimatch@>=9.0.0 <10.0.0": ">=9.0.7 <10.0.0",
       "ajv@>=8.0.0 <9.0.0": ">=8.18.0 <9.0.0",
       "ws@>=7.0.0 <8.0.0": ">=7.5.11 <8.0.0",
       "ws@>=8.0.0 <9.0.0": ">=8.21.0 <9.0.0",
-      "brace-expansion@>=1.0.0 <2.0.0": ">=1.1.12 <2.0.0",
+      "brace-expansion@>=1.0.0 <2.0.0": ">=1.1.18 <2.0.0",
       "brace-expansion@>=2.0.0 <3.0.0": ">=2.0.2 <3.0.0",
+      "brace-expansion@>=4.0.0 <6.0.0": ">=5.0.9 <6.0.0",
+      "fast-uri": ">=4.1.2 <5.0.0",
+      "nanoid@>=3.0.0 <4.0.0": ">=3.3.18 <4.0.0",
+      "postcss@<8.5.23": ">=8.5.23 <9.0.0",
+      "svgo": ">=4.0.2 <5.0.0",
+      "undici@>=7.0.0 <8.0.0": ">=7.29.0 <8.0.0",
+      "body-parser@<1.20.6": ">=1.20.6 <2.0.0",
       "preact": "10.6.2",
       "@types/minimatch": "5.1.2",
       "cheerio": "1.0.0-rc.12"