fix(deps): override cookie and esbuild past two advisories upstream will not release

[yashau]

What and why

Closes both open Dependabot alerts. Neither was fixable by bumping anything — in
both cases the direct dependent's own latest release still resolves the
vulnerable version, so there is no upstream release to take.

Advisory	Chain	Why no bump exists
cookie <0.7.0 — GHSA-pxg6-pf52-xh8x	@sveltejs/kit → cookie@0.6.0	Kit still declares cookie: ^0.6.0 as of 2.70.3, the current latest
esbuild <=0.24.2 — GHSA-67mh-4wv8-2f99	drizzle-kit → @esbuild-kit/esm-loader → @esbuild-kit/core-utils → esbuild@0.18.20	The @esbuild-kit/* packages are deprecated in favour of tsx and will not be released again, so the ~0.18.20 pin is permanent

Worth separating the two, because only one of them matters much:

cookie ships. @sveltejs/kit is a devDependency, but the built Worker
bundles Kit's runtime and Kit's runtime contains cookie. Below 0.7.0,
serialize() does not reject out-of-bounds characters in the cookie name, path
or domain, so a caller passing unvalidated input can close the field with ;
and append attributes of its choosing to the Set-Cookie header. 0.7.2 only
tightens validation; the parse/serialize signatures are unchanged.

esbuild does not. It is the development server's
Access-Control-Allow-Origin: * default, it is dev-only, and nothing in this
repository starts that server. It sits four levels down a drizzle-kit
dependency chain. Fixed for tidiness and to clear the alert, not because it was
reachable.

The correction goes in pnpm-workspace.yaml, which is where pnpm 11 reads
overrides from and where the rest of the supply-chain policy already lives:

overrides:
  "cookie@<0.7.0": "0.7.2"
  "esbuild@<0.25.0": "0.25.12"

Range selectors rather than bare names, so an entry stops matching once the
graph no longer produces a vulnerable resolution and can then simply be deleted.

Both target versions were already in the lockfile for another consumer, so
each entry deduplicates onto an existing copy rather than adding one, and
neither is subject to the minimumReleaseAge: 4320 cooldown directly above it.
The lockfile diff is purely subtractive — 237 lines out, 7 in: esbuild@0.18.20
and its 24 per-platform packages, and cookie@0.6.0, all leave the tree. No
package is added and no unrelated version moves.

Renovate could not have produced this. vulnerabilityAlerts is configured and
enabled, but it resolves an advisory by bumping to a fixed release, and here
there is none to bump to.

How to verify

npx -y pnpm@11.21.0 install

Then confirm the vulnerable versions are absent from the installed tree, not
merely from the lockfile — both greps should return nothing:

ls node_modules/.pnpm | grep -E '^(cookie@0\.6\.0|esbuild@0\.18\.20)$'

ls node_modules/.pnpm | grep '^cookie@' should show 0.7.2, 1.1.1 and
2.0.1 only. No Cloudflare account is needed for any of this.

Checklist

• mise run ci passes locally.
• Tests cover the change. A bug fix has a test that fails without the fix.
  
• No secret value can reach stdout, stderr, a log line, an error message, a
  server-rendered page payload or an audit detail field as a result of this
  change.
• Documentation is updated if behaviour, flags or output changed.
  

Encryption, database and authorization sections are not applicable — this
touches no code, only dependency resolution.

🤖 Generated with Claude Code