fix(deps): force js-yaml past the quadratic-CPU advisory

[msalvatti]

GHSA-5p4m-2wfm-xmqj (CVSS 7.5) — quadratic CPU consumption while resolving !!omap — covers >=3.0.0 <3.15.1 and >=4.0.0 <4.3.1. This repository's lockfile carried a version inside both ranges.

Exposure

Both copies are transitive and build-time only — they reach here through the test and tooling chain, and parse nothing but this repository's own configuration files. Nothing shipped is affected. The reason to merge is that a scanner blocks on it: nest-storage already had a required OSV check refuse a merge over exactly this.

Patched, not filtered

The fix is a patch bump inside each major, so there is no upgrade risk to weigh. Excluding dev dependencies from the scan instead would silence this advisory and every future one in the same position.

Where the override lives

In pnpm-workspace.yaml for repos on pnpm 11, and in package.json for repos still on pnpm 9. pnpm 11 stopped reading the pnpm field of package.json: an override written there warns once and is then ignored, which produces a lockfile that never changes and a pull request that looks like a fix while changing nothing. The lockfile was checked after regeneration in each repo for that reason.

Verification

pnpm install --lockfile-only regenerated the lockfile; it now resolves js-yaml to 3.15.1 and 4.3.1, with no version left inside either affected range.

[Copilot]

Pull request overview

This PR addresses the GHSA-5p4m-2wfm-xmqj advisory by forcing js-yaml to patched versions via pnpm overrides and regenerating the lockfile so the resolved js-yaml version is outside the affected ranges.

Changes:

• Adds pnpm overrides for js-yaml major lines (3 and 4) in the workspace root package.json.
• Regenerates pnpm-lock.yaml to reflect the overrides and resolve js-yaml to 4.3.1.
• Records the overrides in the lockfile metadata for reproducible installs.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pnpm-lock.yaml	Adds overrides and updates the resolved js-yaml version to 4.3.1 in the lockfile/snapshots.
package.json	Adds pnpm.overrides to force patched js-yaml versions during resolution.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

pnpm-lock.yaml:370

• The lockfile records @bymax-one/rust-auth as requiring a peer of next: ^16.2.11, but this workspace currently resolves next to 16.2.10 (see importers section). This leaves the peer dependency unsatisfied and can produce install warnings or failures under strict peer checks; the lockfile should be regenerated after aligning the resolved Next.js version to >=16.2.11 (or reverting the peer requirement if that change was accidental).
  pnpm-lock.yaml:370
• This lockfile update includes changes to the local file:../rust-auth/packages/rust-auth package metadata (engines + peerDependencies). Because that package lives outside this repository, these fields can drift based on the developer’s sibling checkout state and make lockfile regeneration non-reproducible. If the PR’s intent is only the js-yaml patch, consider regenerating the lockfile against the intended rust-auth state (or otherwise documenting why these additional changes are expected).