fix(deps): clear Dependabot alerts (bump override floors)

[JoshC8C7]

What

Clears all 8 open Dependabot alerts by bumping the pinned override floors (in both overrides and pnpm.overrides) to patched versions and regenerating both lockfiles.

Package	Alert(s)	Override change	Result
dompurify	#161, #163	^3.4.0 → ^3.4.9	3.4.10
js-yaml	#154, #159	^4.1.1 → ^4.2.0	4.2.0
protobufjs	#160	^7.5.8 → ^7.6.3	7.6.4 (pnpm tree)
@babel/core	#153, #158	added ^7.29.6	7.29.7
@opentelemetry/core	#164	added ^2.8.0	2.8.0 (pnpm tree)

Why

pnpm-lock.yaml was stale because prior Dependabot PRs only updated the npm lockfile. Both lockfiles are now regenerated in sync. protobufjs / @opentelemetry/core aren't in the npm-resolved tree (those alerts were pnpm-lock-only), so their npm overrides are harmless no-ops.

Verification

• Both lockfiles regenerated; grepped to confirm every patched version landed.
• npm audit clean of the 8 alerts.
• Scope is package.json + the two lockfiles only — no source changes.

Out of scope (pre-existing on main, not touched here)

• 1 failing test (stripMarkdown expectation vs. its dependency-free impl).
• npm run lint errors (no-explicit-any, set-state-in-effect).
• ajv <6.14.0 (dev-only eslint transitive; "fix" forces ajv 8 and breaks eslint).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
documentation	Ready	Preview, Comment	Jun 15, 2026 10:17pm

[Copilot]

Pull request overview

This PR clears outstanding Dependabot alerts by raising dependency override floors to patched versions and regenerating lockfiles so npm and pnpm installs resolve the patched transitive versions consistently.

Changes:

• Bumped override floors for vulnerable transitive packages (e.g., dompurify, js-yaml, protobufjs, @babel/core, @opentelemetry/core) in both npm overrides and pnpm.overrides.
• Regenerated pnpm-lock.yaml to reflect the updated override floors and refreshed resolved versions across the dependency graph.
• Regenerated the npm lockfile to align with the same override intent.

Reviewed changes

Copilot reviewed 1 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Updates override floors in both overrides and pnpm.overrides to patched ranges.
pnpm-lock.yaml	Lockfile regenerated to apply new overrides and update resolved transitive versions accordingly.
package-lock.json	npm lockfile reflects updated resolved versions consistent with the new override floors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.