fix(deps): remediate OSV findings

[ReesMorris]

Summary

• override five vulnerable transitive packages to their fixed versions
• regenerate the pnpm 11.17.0 lockfile without unrelated dependency churn
• clear 11 current OSV findings affecting brace-expansion, fast-uri, hono, ip-address, and undici

Why

New advisory data made the default branch fail the repository's complete-lockfile OSV gate, including on documentation-only PRs. Existing Renovate PRs each leave part of the current baseline unresolved.

Four fixed versions remain within their parent ranges. Miniflare pins undici@7.28.0 exactly, so the root undici@7.29.0 override is the one intentional range bypass; full Wrangler, build, and browser verification passed against it.

This PR supersedes the brace-expansion update in #73. It does not replace the broader lock maintenance in #53 or the independent @hono/node-server update in #72.

Validation

• pnpm install --frozen-lockfile
• digest-pinned CI OSV Scanner v2.4.0 against pnpm-lock.yaml: No issues found
• pnpm verify
• pnpm why brace-expansion fast-uri hono ip-address undici: one fixed version of each
• git diff --check

Independent lockfile and override review completed clean. Both the CodeRabbit CLI retry and hosted incremental lane exhausted their quotas without reviewing this head; neither rate-limit status is counted as review evidence.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

@ReesMorris, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 40 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ab340899-1b94-4427-962b-44c31b1665e5

📥 Commits

Reviewing files that changed from the base of the PR and between 74bf629 and 4944d8f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ReesMorris]

Post-merge verification complete for squash commit 146f0b489889acded979f678647a56230bd6fd58.

• main Verification and production deployment passed: run 30923977781
• main CodeQL passed: run 30923978552
• the merged tree was the clean base for Docs docs(env): document Next.js delivery modes #75; its rebased OSV gate reported zero findings
• the subsequent exact published tree passed ASTILBA_DOCS_SITE=https://astilba.com pnpm smoke:all

CodeRabbit's hosted and CLI retries exhausted their quotas without reviewing this head; neither rate-limit status is counted as review evidence. The independent lockfile review and repository security/verification gates were clean.