security: add transitive vulnerability overrides

[wtfiwtz]

Summary

Add pnpm overrides for transitive dependencies to address multiple security vulnerabilities throughout the dependency tree.

Changes

Add comprehensive pnpm.overrides to package.json for transitive dependencies:

Network & HTTP

• cookie: ^0.7.2
• tough-cookie: ^4.1.3
• qs: ^6.15.2
• form-data: ^4.0.5
• basic-ftp: ^5.3.0
• follow-redirects: ^1.16.0
• fast-uri: ^3.1.2

Compression & Serialization

• tar: ^7.5.11
• tar-fs: ^3.1.1
• serialize-javascript: ^7.0.5
• flatted: ^3.4.2

Parsers & Utilities

• js-yaml: ^4.1.1
• nth-check: ^2.0.1
• ip-address: ^10.1.1
• protocol-buffers-schema: ^3.6.1
• path-to-regexp@0.1.12: 0.1.13 (specific version upgrade)
• bn.js: ^5.2.3
• tmp: ^0.2.6

Build Tools

• postcss: ^8.5.10
• autoprefixer: ^10.4.20

CVEs Addressed

• CVE-2026-6321, CVE-2026-6322: fast-uri vulnerabilities
• CVE-2026-41305, CVE-2023-44270: postcss vulnerabilities
• Multiple transitive CVEs across:
  • Cookie handling and session management
  • Path parsing and traversal
  • YAML parsing
  • Compression and archiving
  • Serialization
  • Network request libraries

Specific CVE IDs vary by nested package depth and consuming packages, but these overrides force secure versions throughout the entire dependency tree.

Notes

Glob pattern matching overrides excluded: The overrides for minimatch, picomatch, micromatch, and braces were excluded from this PR due to compatibility issues with Babel traverse that caused test failures. These packages will be addressed through direct dependency upgrades in consuming packages or in future PRs when compatibility improves.

Test Results

• ✅ Frontend tests: All 15 test suites passed (90 tests)
• ✅ TypeScript compilation: Type checking passed successfully
• ✅ No runtime errors or dependency resolution failures

Related PRs

Part of the frontend security upgrade series split from #7720:

• security: upgrade axios to 1.16.0 #7736: axios 1.16.0
• security: upgrade dompurify to 3.4.0 for XSS protection #7737: dompurify 3.4.0
• security: migrate from markdown to marked (ReDoS fix) #7735: marked migration
• security: upgrade lodash to 4.18.0 #7738: lodash 4.18.0
• security: upgrade build toolchain dependencies #7739: build toolchain security updates
• security: migrate cypress.js from request to axios #7740: cypress.js migration (request → axios)
• security: remove elliptic package (CVE mitigation) #7741: remove elliptic (CVE mitigation)
• security: add transitive vulnerability overrides #7742 (this PR): transitive vulnerability overrides

This completes the frontend security upgrade series.

Made with Cursor