fix(deps): raise override floors to clear 3 High advisories (nanoid, js-yaml, undici)

[lukaso-bot]

Fixes #145.

osv dependency scan is red on main's untouched lockfile — new advisories
were published against three packages that were already there, so every open PR
(#138, #139, #141, #142, #144) fails that job without having changed anything.

What this does

Raises three pnpm.overrides floors, the same mechanism 9b6080a used:

Package	Was	Now	Advisory	CVSS
nanoid	3.3.16	3.3.18	GHSA-2v37-7h3g-55p8	8.2
js-yaml	4.3.0	4.3.1	GHSA-5p4m-2wfm-xmqj	7.5
undici	7.28.0	7.29.0	GHSA-4cwx-7wf7-3272	7.4

None is a direct dependency — all three are transitive, which is why Dependabot
does not offer them.

Two constraints kept intact:

• nanoid@3 is keyed to the 3.x range, not a bare nanoid: ">=3.3.18", so
  the override cannot pull nanoid 5.x into a consumer expecting 3.x.
• jsdom>undici keeps its <8 upper bound (>=7.29.0 <8). That pin is why
  9b6080a exists: jsdom 29 does not collect against undici 8. Confirmed still
  true below — undici@8.9.0 remains in the lockfile for its other consumer,
  exactly as on main, so this is not a major bump.

Evidence — the gate red before, green after

The guard here is scripts/osv-check.sh itself, and it was already observed
failing on the real defect. Run on this branch's parent (39a72d06, main):

Total 4 packages affected by 11 known vulnerabilities (0 Critical, 3 High, 7 Medium, 1 Low, 0 Unknown)
| GHSA-5p4m-2wfm-xmqj | 7.5 | js-yaml | 4.3.0   | 4.3.1   |
| GHSA-2v37-7h3g-55p8 | 8.2 | nanoid  | 3.3.16  | 3.3.18  |
| GHSA-4cwx-7wf7-3272 | 7.4 | undici  | 7.28.0  | 7.29.0  |
✗ osv: 0 Critical + 3 High vulnerability(ies) — must be resolved before merge.   → exit 1

Same command on this branch:

Total 1 package affected by 4 known vulnerabilities (0 Critical, 0 High, 3 Medium, 1 Low, 0 Unknown)
| GHSA-54fx-42gc-7vw4 | 5.3 | hono | 4.12.32 | 4.12.34 |   (×4, all hono)
✓ osv: no High/Critical vulnerabilities.                                          → exit 0

All 5 undici findings plus js-yaml and nanoid are gone. The four remaining are
hono 4.12.32 Mediums, which do not gate and which #142 bumps (4.13.1).

Gate

Full local gate green on this branch, after pnpm -r build:

• pnpm lint — 110 files, no fixes
• pnpm -r typecheck — core / cli / web / web-og all Done
• pnpm -r test — web 277 passed / 6 skipped, cli 45, web-og 27 + 6 workers
• pnpm -r build — clean

The jsdom-collects risk is the one that mattered and it is covered: the web
suite (which uses jsdom 29) passes on undici 7.29.0.

Scope

Deliberately just the lockfile floors. It is not folded into #144 (the
/internal/* cache fix) so the security bump can be reviewed and merged on its
own, without waiting on that PR's review — main is running the vulnerable
versions until something merges and release.yml redeploys.

Note scripts/validate.sh runs osv warn-only locally (|| true), so this was
only ever visible at the CI gate.

[lukaso-bot]

Merge this one first. Ordering matters here and it isn't visible from the PR list.

osv dependency scan started failing on main's untouched lockfile around 2026-08-17. This PR
is the only open branch that clears it, which makes it the keystone for the whole queue:

PR	osv last ran	Reads as	Actually
#146 (this)	2026-08-17	green	green — contains the fix
#138	2026-08-12	green	stale — predates the advisories
#139	2026-08-12	green	stale
#141	2026-08-12	green	stale
#142	2026-08-15	green	stale
#144	2026-08-20	red	red only on osv, for this reason

The four "green" rollups are green because their last osv run predates the advisories, not
because their lockfiles are clean. Any rebase or new commit re-runs osv and turns them red.
#144 already shows what that looks like: its gate is 9/10 with osv the sole failure, and
nothing in its own diff causes it.

So:

1. Merge fix(deps): raise override floors to clear 3 High advisories (nanoid, js-yaml, undici) #146. Nothing else in the queue needs to happen first.
2. Merge the rest in whatever order you like. They pick up the raised floors from main and
   osv goes honestly green instead of stale-green.

Worth noting separately: main is running the vulnerable versions right now. The last deploy
(2026-08-03, version 1261aaeb) predates all three advisories, so production is serving
nanoid 3.3.16 / js-yaml 4.3.0 / undici 7.28.0. Merging this PR is what triggers release.yml
to redeploy with the floors raised.

The 4 remaining hono findings are Medium and don't gate; hono@4.12.34 is a separate bump.

[lukaso-bot]

Re-verified today against current OSV data, since this PR's CI green is from 17 Aug
and the advisory database moves under a stale run.

Scanning this branch's lockfile now:

Total 1 package affected by 4 known vulnerabilities (0 Critical, 0 High, 3 Medium, 1 Low)
| GHSA-54fx-42gc-7vw4 | 5.3 | hono | 4.12.32 | 4.12.34 |
| GHSA-79qm-7rj5-m7r9 | 3.7 | hono | 4.12.32 | 4.12.34 |
| GHSA-8j4g-w8fx-2239 | 5.3 | hono | 4.12.32 | 4.12.34 |
| GHSA-f23p-vx2j-j53r | 4.8 | hono | 4.12.32 | 4.12.34 |

Still 0 High / 0 Critical, so the gate passes. The three Highs this PR targets
(nanoid, js-yaml, undici) are gone. The four hono Mediums are new since 17 Aug and
are not gated by scripts/osv-check.sh — they belong to Dependabot, not to this PR.

Branch is also still current with origin/main (39a72d06 is an ancestor), so no
rebase is needed. Ready to merge as-is.

[lukaso-bot]

Superseded by #138 — closing without merge

The override floors this PR exists to add are already on main. #138 merged at
1a717ce carrying the same pnpm.overrides block (the osv fix that was pushed onto its
branch as 0ec52be), so origin/main:package.json is now byte-identical to this
branch's:

undici       >=7.29.0      js-yaml@4  ^4.3.1      nanoid@3  ^3.3.18

and main's lockfile resolves nanoid@3.3.18, js-yaml@4.3.1, undici@7.29.0 — the
three High advisories are gone. main's osv dependency scan job is green (run
32395419314, 2026-08-20T17:02Z).

Merging this now would be actively harmful: the only content left in
git diff origin/main origin/fix/osv-override-floors is a revert of #138's
@cloudflare/workers-types 4→5 bump in packages/web/package.json and
packages/web-og/package.json, because this branch was cut before #138 landed.

Closing. #145 is fixed and closed too.