Security: update vulnerable dependencies

[dmlvr]

No description provided.

[Copilot]

Pull request overview

This PR updates dependency constraints and lockfile resolutions to address vulnerable transitive dependencies across the DevExtreme pnpm/Nx monorepo, primarily via pnpm overrides and targeted Angular patch/minor bumps.

Changes:

• Updated pnpm overrides to force patched versions of vulnerable transitive dependencies (e.g., brace-expansion, ip-address, undici, fast-uri, hono).
• Bumped the Angular 20.3 catalog versions from ~20.3.25 to ~20.3.27 and refreshed pnpm-lock.yaml accordingly.
• Updated apps/demos to use a newer @angular/platform-server range.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pnpm-workspace.yaml	Updates pnpm overrides (and Angular 20.3 catalog entries) to remediate known vulnerable dependency ranges.
pnpm-lock.yaml	Reflects regenerated resolutions after overrides/catalog changes (including hono, brace-expansion, and Angular patch updates).
apps/demos/package.json	Bumps @angular/platform-server version range used by the demos app.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

apps/demos/package.json:94

• In this app, only @angular/platform-server is bumped to ^22.0.7 while the rest of @angular/* dependencies remain at ^22.0.0. With Angular, package versions are expected to stay aligned; as reflected in the updated lockfile, this ends up resolving platform-server to 22.1.0 while other Angular packages remain at 22.0.2, which can cause peer-dependency mismatch and runtime/build issues. Consider bumping all @angular/* dependencies together to the same version (and regenerate pnpm-lock.yaml).

        "@angular/platform-server": "^22.0.7",

pnpm-lock.yaml:17922

• The lockfile shows @angular/platform-server resolved to 22.1.0, but it is installed with @angular/common/@angular/compiler/@angular/core at 22.0.2. Angular packages typically require exact version alignment across @angular/; this peer mismatch can lead to installation warnings/errors or subtle runtime issues. Recommend updating the Angular 22 dependency set so all @angular/ resolve to the same version (and re-generating pnpm-lock.yaml).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

apps/demos/package.json:94

• @angular/platform-server is pinned to ^22.0.7 while the rest of the Angular framework packages in this package are ^22.0.8. Angular packages are typically expected to be kept on the same patch version to avoid peer-dependency mismatches and subtle runtime/build issues; consider aligning this to ^22.0.8 (or whichever patch you intend to standardize on).

        "@angular/platform-server": "^22.0.7",