fix(security): add pnpm overrides for esbuild and fast-uri

[fro-bot]

Summary

Rebased version of #1463 (now CONFLICTING due to Renovate lock-file churn). Same intent: add pnpm overrides in pnpm-workspace.yaml for transitive esbuild and fast-uri. Freshly regenerated pnpm-lock.yaml.

Alerts Fixed

Alert	Severity	Package	Vulnerable Range	Patched
#86	HIGH	fast-uri	<= 3.1.0	3.1.2
#87	HIGH	fast-uri	<= 3.1.1	3.1.2
#89	LOW	esbuild	>= 0.27.3, < 0.28.1	0.28.1
#90	HIGH	esbuild	>= 0.17.0, < 0.28.1	0.28.1

Details

Both esbuild and fast-uri are transitive dependencies:

• esbuild: via vite, vitest, @eslint/config-inspector, bundle-require, tsup
• fast-uri: via ajv (used by eslint)

The overrides follow the same pattern as bfra-me/.github#2292 (esbuild override).

overrides:
  esbuild@>=0.17.0 <0.28.1: '>=0.28.1'
  fast-uri: '>=3.1.2'

Verification

• pnpm install regenerates lock with esbuild 0.28.1 and fast-uri 3.1.2
• pnpm-lock.yaml diff: 4 insertions
• No source code changes — only overrides + lockfile

Notes

This is a minimal security fix. No bulk dependency updates. Only the esbuild + fast-uri overrides were added to resolve the confirmed high-severity advisories.

#1463 should be closed in favor of this PR. Note that #1466 covers the separate vite HIGH/MODERATE alerts (#91, #92) and is independent.

[fro-bot]

fro-bot: lockfile regenerated against current main

The structural add/add conflict on pnpm-workspace.yaml is unchanged (both this branch and main originally created that file from an empty base in their first commit), so the GitHub merge button will still report CONFLICTING.

File content is now correct: pnpm-workspace.yaml on this branch already contains main's configuration plus the overrides: section (esbuild@>=0.28.1, fast-uri@>=3.1.2).

Lockfile regenerated: This push adds 21b7f3e fix(security): regenerate lockfile with esbuild/fast-uri overrides, which:

• Re-derives pnpm-lock.yaml from current main's lockfile
• Re-runs pnpm install --no-frozen-lockfile to apply the overrides
• Resolves Dependabot fix: remove obsolete config and workflow #86, fix: update CI badge #87, chore: update filter for yarn plugins #89, feat: add repo settings #90

Recommended manual merge step: When the GitHub merge button is clicked, choose Use the pull request's version for pnpm-workspace.yaml (since this branch's version already matches main's content + the security overrides). The lockfile merge should auto-resolve since this branch's lockfile is derived from main.

Verification:

• pnpm run lint: passes
• pnpm run build: passes (no dist/ change needed; this branch was rebased from fix(security): add pnpm overrides for esbuild and fast-uri #1463 which already had current dist/)
• esbuild resolves to 0.28.1, fast-uri resolves to 4.0.0