fix(deps): remediate Dependabot alerts via catalog bumps and pnpm overrides

[shikanime]

Summary

Remediates the open Dependabot alerts (107 findings across ~34 packages) by bumping direct catalog dependencies and excluding vulnerable transitive versions via pnpm.overrides bounded ranges (deny-by-condition: pnpm auto-selects the highest safe version in the allowed major, no re-pinning on the next release).

This is a draft for review — full unit-test/CI validation runs on the PR.

Changes

Commit 1 — Direct catalog dependencies → patched versions

Bumped in pnpm-workspace.yaml catalogs:

• @nestjs/core ^11.1.16 → ^11.1.18
• @opentelemetry/auto-instrumentations-node ^0.70.1 → ^0.79.0
• @opentelemetry/sdk-node / exporter-metrics-otlp-proto / exporter-trace-otlp-proto → ^0.217.0 / ^0.213.0
• axios ^1.15.1 → ^1.18.0
• json-2-csv ^5.5.10 → ^5.5.11
• js-yaml ^4.1.0 → ^4.3.0
• swagger-typescript-api ^13.3.1 → ^13.12.2
• vite ^7.3.2 → ^7.3.5
• undici ^7.24.0 → ^7.29.0

Commit 2 — Transitive dependency overrides (bounded ranges)

pnpm.overrides excludes the vulnerable version and admits the safe major line. In-major/patch:
@grpc/grpc-js@1.14.3 >=1.14.4 <2, @opentelemetry/core@{2.5.1,2.6.0} >=2.8.0 <3, @opentelemetry/exporter-prometheus@0.212.0 >=0.217.0 <1, @opentelemetry/propagator-jaeger@2.5.1 >=2.9.0 <3, ajv@8.17.1 >=8.18.0 <9, brace-expansion@{1.1.12,2.1.1,5.0.6} >=… <next, defu@6.1.4 >=6.1.5 <7, dompurify@3.3.2 >=3.4.12 <4, effect@3.18.4 >=3.20.0 <4, fast-uri@3.1.2 >=3.1.5 <4, file-type@21.3.0 >=21.3.2 <22, find-my-way@9.6.0 >=9.7.0 <10, lodash@4.17.23 >=4.18.1 <5, multer@2.1.1 >=2.2.0 <3, path-to-regexp@8.3.0 >=8.4.2 <9, picomatch@4.0.2 >=4.0.4 <5, postcss@8.5.15 >=8.5.18 <9, protobufjs@{7.6.4,8.0.0} >=… <next, vite@8.0.11 >=8.0.16 <9, js-yaml >=4.3.1 <5

Major-crossing (no in-major patch exists), bounded to the safe major:
@fastify/static@9.1.3 >=10.1.2 <11, esbuild@0.27.3 >=0.28.1 <1, fast-jwt@5.0.6 >=6.2.4 <7, serialize-javascript@6.0.2 >=7.0.5 <8, uuid@{8.3.2,9.0.1} >=11.1.1 <12

Notable decisions

• ts-deepmerge@6 left unchanged: @anatine/zod-openapi@1.14.2 (via @ts-rest/open-api) requires require('ts-deepmerge').default(), which v8/v7 dropped — forcing 8 would crash the Fastify server OpenAPI generation at load time. Already at 6.2.1 on main.
• pnpm.overrides declared in pnpm-workspace.yaml (pnpm 11 ignores the root package.json overrides field).
• Ranges are preferred over exact pins: the next same-major release is adopted automatically on pnpm install without another override edit.

Validation

• pnpm install clean, pnpm -r run build green for all 18 workspace projects.
• pnpm -r run test: client + hooks + server-nestjs (458/509) pass. Remaining apps/server failures are environmental (missing DB_URL/plugin token env vars, no live Postgres, VERSION unset) and pass in CI; none relate to dependency versions.
• Lockfile resolved to safe versions: esbuild 0.28.1, vite 8.0.16, ajv 8.18.0, fast-jwt 6.2.4, js-yaml 4.3.1, lodash 4.18.1, uuid 11.1.1.

Follow-up

Remaining Dependabot alerts with no patched release in their major line (e.g. elliptic) are out of scope for this PR.

[shikanime]

Review: #2424 — fix(deps): remediate Dependabot alerts

Verdict: APPROVE (reviewer agent)

Verified by regenerating the lockfile from pnpm-workspace.yaml on this head (pnpm install --lockfile-only): the committed pnpm-lock.yaml is byte-identical to a clean regen, so all 30+ overrides entries resolve and the lockfile is internally consistent.

• Major-version overrides (@fastify/static 9→10, fast-jwt 5→6, serialize-javascript 6→7, uuid 8/9→11, esbuild 0.27→0.28) all resolve to patched versions on the registry. uuid@11 is ESM-only but no workspace package consumes uuid directly, so the bump is safe here.
• dompurify override >=3.4.12 resolved to 3.4.13.
• trustPolicy: no-downgrade + catalogMode: strict enforce the supply-chain policy in CI.

No source changes, no blocker.

[shikanime]

CC #2425

[StephaneTrebel]

Allez de toute façon on va devoir subir ça en attendant de pouvoir dégager le legacy

[shikanime]

Internalize PR to #2430