diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8e07972..b81cbbe 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,6 +4,9 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  tinypool: '>=2.1.2'
+
 importers:
 
   .:
@@ -279,8 +282,8 @@ packages:
       oxlint-tsgolint:
         optional: true
 
-  tinypool@2.1.0:
-    resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
+  tinypool@2.2.0:
+    resolution: {integrity: sha512-jBrmx4lYmaC9k/mgPbylxs7kBUxHtD8256up+HjLaDFfXScKJQyil+SWXSvhAtT7XHo+yTVlpB81PGmHP8oLSQ==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
   typescript@6.0.3:
@@ -406,7 +409,7 @@ snapshots:
 
   oxfmt@0.45.0:
     dependencies:
-      tinypool: 2.1.0
+      tinypool: 2.2.0
     optionalDependencies:
       '@oxfmt/binding-android-arm-eabi': 0.45.0
       '@oxfmt/binding-android-arm64': 0.45.0
@@ -450,6 +453,6 @@ snapshots:
       '@oxlint/binding-win32-ia32-msvc': 1.60.0
       '@oxlint/binding-win32-x64-msvc': 1.60.0
 
-  tinypool@2.1.0: {}
+  tinypool@2.2.0: {}
 
   typescript@6.0.3: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index cdd1496..ac8f7d1 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -9,3 +9,7 @@ auditConfig:
 # Reject packages published less than 7 days ago to reduce supply-chain attack risk.
 # Value is in minutes: 7 days × 24 h × 60 min = 10080
 minimumReleaseAge: 10080
+
+# Pin transitive tinypool (via oxfmt) to a version without known advisories.
+overrides:
+  tinypool: ">=2.1.2"