fix(frontend): override vulnerable transitive dependencies (#150)

Dependabot security updates report update_not_possible because the
vulnerable packages are transitive and their parents pin them. The
Dependabot job fails on every run.

pnpm overrides raise minimatch to 9.0.9, esbuild to 0.28.2 and
postcss-selector-parser to 6.1.4. All three versions are older than the
seven day minimum release age. pnpm audit reports no known
vulnerabilities. The build and the 47 tests pass.

Co-authored-by: copilot-swe-agent[bot] <[email protected]>

frontend/pnpm-lock.yaml

@@ -5,9 +5,9 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  esbuild@<0.28.1: ^0.28.1
+  minimatch@<9.0.9: ^9.0.9
-  minimatch@<9.0.7: ^9.0.7
+  esbuild@<0.28.2: ^0.28.2
-  postcss-selector-parser@<6.0.11: ^6.0.11
+  postcss-selector-parser@<6.1.4: ^6.1.4
 
 importers:
 
@@ -70,13 +70,13 @@ importers:
         version: 2.4.6
       autoprefixer:
         specifier: ^10.4.23
-        version: 10.4.23([email protected]3)
+        version: 10.4.23([email protected]7)
       jsdom:
         specifier: ^27.4.0
         version: 27.4.0([email protected])
       postcss:
         specifier: ^8.5.23
-        version: 8.5.23
+        version: 8.5.27
       tailwindcss:
         specifier: ^3.4.19
         version: 3.4.19
@@ -369,9 +369,6 @@ packages:
     resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
     engines: {node: '>=6.0.0'}
 
-  '@jridgewell/[email protected]':
-    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
-
   '@jridgewell/[email protected]':
     resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
 
@@ -821,9 +818,6 @@ packages:
     resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
     engines: {node: '>= 6'}
 
-  [email protected]:
-    resolution: {integrity: sha512-PxZwGNvH7Ak8WX5iXzoK1KPZttBXNPuaOvI2ZYU7NrlM+d9Ov+TUvlLOBNGzVXAntMSMMlJPd+jY6ovrVjSmUw==}
-
   [email protected]:
     resolution: {integrity: sha512-/Uaf1lAzr59XcMpW0o96WoEfr+VXK2OX4U9AgFoiSHsVJ4HppnIFUjtYzsyDH2+tgANaQb2/oxYGwCPapN1FpA==}
 
@@ -1115,10 +1109,6 @@ packages:
     resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
     engines: {node: '>= 0.4'}
 
-  [email protected]:
-    resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
-    engines: {node: '>= 0.4'}
-
   [email protected]:
     resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
@@ -1573,17 +1563,13 @@ packages:
     peerDependencies:
       postcss: ^8.2.14
 
-  [email protected].2:
+  [email protected].4:
-    resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==}
+    resolution: {integrity: sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==}
     engines: {node: '>=4'}
 
   [email protected]:
     resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
 
-  [email protected]:
-    resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==}
-    engines: {node: ^10 || ^12 || >=14}
-
   [email protected]:
     resolution: {integrity: sha512-79Iho8QeYyooJ8e9lCRyTVlyTAkS/kXBYKff6TMzS3kEWGQ8Ds5UEtXpGrSUDLUWok6QTvxeYy0GO8fopHnaSA==}
     engines: {node: ^10 || ^12 || >=14}
@@ -2200,19 +2186,17 @@ snapshots:
 
   '@jridgewell/[email protected]':
     dependencies:
-      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/sourcemap-codec': 1.6.0
       '@jridgewell/trace-mapping': 0.3.31
 
   '@jridgewell/[email protected]': {}
 
-  '@jridgewell/[email protected]': {}
-
   '@jridgewell/[email protected]': {}
 
   '@jridgewell/[email protected]':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
-      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/sourcemap-codec': 1.6.0
 
   '@napi-rs/[email protected]':
     optional: true
@@ -2317,7 +2301,7 @@ snapshots:
 
   '@tailwindcss/[email protected]([email protected])':
     dependencies:
-      postcss-selector-parser: 6.1.2
+      postcss-selector-parser: 6.1.4
       tailwindcss: 3.4.19
 
   '@tanstack/[email protected]': {}
@@ -2569,13 +2553,13 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected]3):
+  [email protected]([email protected]7):
     dependencies:
       browserslist: 4.29.3
-      caniuse-lite: 1.0.30001762
+      caniuse-lite: 1.0.30001814
       fraction.js: 5.3.4
       picocolors: 1.1.1
-      postcss: 8.5.23
+      postcss: 8.5.27
       postcss-value-parser: 4.2.0
 
   [email protected]:
@@ -2639,8 +2623,6 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]: {}
-
   [email protected]: {}
 
   [email protected]: {}
@@ -2970,10 +2952,6 @@ snapshots:
     dependencies:
       has-symbols: 1.1.0
 
-  [email protected]:
-    dependencies:
-      function-bind: 1.1.2
-
   [email protected]:
     dependencies:
       function-bind: 1.1.2
@@ -3045,7 +3023,7 @@ snapshots:
 
   [email protected]:
     dependencies:
-      hasown: 2.0.2
+      hasown: 2.0.4
 
   [email protected]:
     dependencies:
@@ -3341,43 +3319,37 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected]3):
+  [email protected]([email protected]7):
     dependencies:
-      postcss: 8.5.23
+      postcss: 8.5.27
       postcss-value-parser: 4.2.0
       read-cache: 1.0.0
       resolve: 1.22.11
 
-  [email protected]([email protected]3):
+  [email protected]([email protected]7):
     dependencies:
       camelcase-css: 2.0.1
-      postcss: 8.5.23
+      postcss: 8.5.27
 
-  [email protected]([email protected])([email protected]3):
+  [email protected]([email protected])([email protected]7):
     dependencies:
       lilconfig: 3.1.3
     optionalDependencies:
       jiti: 1.21.7
-      postcss: 8.5.23
+      postcss: 8.5.27
 
-  [email protected]([email protected]3):
+  [email protected]([email protected]7):
     dependencies:
-      postcss: 8.5.23
+      postcss: 8.5.27
-      postcss-selector-parser: 6.1.2
+      postcss-selector-parser: 6.1.4
 
-  [email protected].2:
+  [email protected].4:
     dependencies:
       cssesc: 3.0.0
       util-deprecate: 1.0.2
 
   [email protected]: {}
 
-  [email protected]:
-    dependencies:
-      nanoid: 3.3.18
-      picocolors: 1.1.1
-      source-map-js: 1.2.1
-
   [email protected]:
     dependencies:
       nanoid: 3.3.18
@@ -3630,12 +3602,12 @@ snapshots:
       normalize-path: 3.0.0
       object-hash: 3.0.0
       picocolors: 1.1.1
-      postcss: 8.5.23
+      postcss: 8.5.27
-      postcss-import: 15.1.0([email protected]3)
+      postcss-import: 15.1.0([email protected]7)
-      postcss-js: 4.1.0([email protected]3)
+      postcss-js: 4.1.0([email protected]7)
-      postcss-load-config: 6.0.1([email protected])([email protected]3)
+      postcss-load-config: 6.0.1([email protected])([email protected]7)
-      postcss-nested: 6.2.0([email protected]3)
+      postcss-nested: 6.2.0([email protected]7)
-      postcss-selector-parser: 6.1.2
+      postcss-selector-parser: 6.1.4
       resolve: 1.22.11
       sucrase: 3.35.1
     transitivePeerDependencies:

frontend/pnpm-workspace.yaml

@@ -1,7 +1,8 @@
 allowBuilds:
   esbuild: true
   vue-demi: true
+# Patched versions of transitive dependencies that Dependabot cannot raise on its own.
 overrides:
-  "esbuild@<0.28.1": "^0.28.1"
+  "minimatch@<9.0.9": ^9.0.9
-  "minimatch@<9.0.7": "^9.0.7"
+  "esbuild@<0.28.2": ^0.28.2
-  "postcss-selector-parser@<6.0.11": "^6.0.11"
+  "postcss-selector-parser@<6.1.4": ^6.1.4