6854eac80e
Resolves 8 open Dependabot alerts in web/pnpm-lock.yaml (all dev-only transitive dependencies) by pinning patched versions through the existing pnpm.overrides mechanism: - undici 7.24.7 -> 7.28.0 (via jsdom; alerts #43-#49, incl. 2 high: TLS cert validation bypass & cross-origin routing via SOCKS5 ProxyAgent) - js-yaml 4.1.1 -> 4.2.0 (via @eslint/eslintrc; alert #39, quadratic DoS) - @babel/core 7.29.0 -> 7.29.6 (via @vitejs/plugin-react; alert #38, arbitrary file read via sourceMappingURL) No vulnerable versions remain in the lockfile. Web build and lint pass; the only failing tests (ServerStorageStep ResizeObserver) are pre-existing on main and unrelated to these bumps. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>