chore(deps): drop the security overrides that upstream has made redundant

[lollipop-onl]

Redo of #149, which landed as a no-op for the overrides.

What went wrong with #149

It was branched from #143, so when GitHub squashed the whole branch against main, the override removal cancelled out #143's override addition inside the same commit. Only the comment changes survived, and pnpm-lock.yaml was never updated. My mistake — a stacked PR needs its parent merged before the squash, or the base must be the parent branch at merge time.

main is fine and self-consistent: manifest and lockfile match, --frozen-lockfile installs, pnpm audit is clean, all 24 alerts stay closed. Nothing is broken; the cleanup just didn't happen. This branches from current main and does it properly.

What changes

Eleven of twelve overrides removed. Upstream ranges have widened (postcss ^8.5.13, esbuild ^0.27.0 || ^0.28.0, picomatch ^3 || ^4, vite ^6 || ^7 || ^8), so caret resolution reaches the patched releases unaided. Re-resolving gives identical versions for every one:

postcss 8.5.26 · nanoid 3.3.18 · js-yaml 4.3.1 · svgo 4.0.2 · vite 8.2.2 · qs 6.15.3 · defu 6.1.7 · picomatch 2.3.2 + 4.0.5 · esbuild 0.25.12 + 0.28.2 · smol-toml 1.8.0 (already ahead of the ^1.6.1 it pinned)

One override stays, and it earns its place

rollup-plugin-dts>typescript: ^6.0.3 is still load-bearing. I removed it, and the build broke:

TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')

The catalog's typescript: ^6.0.3 does not cover this — it constrains the workspace's direct dependency, while rollup-plugin-dts resolves its own typescript peer to 7.0.2, which ships no JS compiler API. Confirmed in the lockfile: with the override, the pairing is rollup-plugin-dts@6.3.0(typescript@6.0.3).

Worth noting this class of failure is invisible to pnpm test and pnpm typecheck — both stay green. Only pnpm build catches it.

Its comment now records the removal condition: unbuild asks for rollup-plugin-dts: ^6.2.1, and 6.5.0 added a fallback to @typescript/typescript6, but pnpm 10 resolves that range to 6.3.0.

Verification

• pnpm install --frozen-lockfile — clean
• pnpm typecheck — 5/5
• pnpm build --force — CLI + docs, 105 pages, internal links valid, 0 cached
• pnpm format:check — clean
• pnpm audit — no known vulnerabilities
• All 24 advisories re-checked individually against resolved lockfile versions, not pnpm audit alone: 0 vulnerable

pnpm test — 780/781 locally; the one failure is defaults to port 5033 (EADDRINUSE, an unrelated dev server on my machine holds that port). It fails identically on unmodified main. CI will confirm. Test count is 781/117 rather than 767/116 because #150 and #151 landed in the meantime.

Unrelated pre-existing issue spotted

A freshly built CLI exits 13 on --version with Detected unsettled top-level await at dist/index.mjs (await program.addCommands(loadCommands())). This reproduces identically on unmodified main, so it is not from this change and not addressed here — but it looks worth its own issue, since it affects the shipped binary.

🤖 Generated with Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	91.56%	1900 / 2075
🔵	Statements	91.71%	1981 / 2160
🔵	Functions	87.84%	419 / 477
🔵	Branches	80.53%	840 / 1043

File Coverage

No changed files found.

Generated in workflow #504 for commit 1fe9442 by the Vitest Coverage Report Action