fix: patch high-severity transitive vulnerabilities via pnpm overrides

[Copilot]

Three high-severity CVEs in transitive dependencies (rollup via unbuild, minimatch via c8 → test-exclude) were causing pnpm audit --audit-level=high to fail in CI.

Changes

• package.json — adds pnpm.overrides to pin vulnerable transitive deps to patched versions:

"pnpm": {
  "overrides": {
    "rollup": ">=4.59.0",
    "minimatch": ">=10.2.3"
  }
}

• pnpm-lock.yaml — regenerated; resolves to rollup@4.59.0 and minimatch@10.2.4

Vulnerabilities addressed

Advisory	Package	Vulnerable	Patched
GHSA-mw96-cpmx-2vgc	rollup	<4.59.0	>=4.59.0
GHSA-7r86-cg39-jmmj	minimatch	<10.2.3	>=10.2.3
GHSA-23c5-xmqv-rm74	minimatch	<10.2.3	>=10.2.3

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/docs-cache@29

commit: 37d77a1

[Copilot]

Pull request overview

This PR addresses CI failures from pnpm audit --audit-level=high by forcing patched versions of vulnerable transitive dependencies via pnpm overrides (notably rollup and minimatch).

Changes:

• Add pnpm.overrides in package.json to require patched rollup and minimatch versions.
• Regenerate pnpm-lock.yaml to resolve to rollup@4.59.0 and minimatch@10.2.4.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
package.json	Introduces pnpm overrides for patched rollup/minimatch versions.
pnpm-lock.yaml	Lockfile updates reflecting the new override-driven resolutions.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This repo already has an overrides: block in pnpm-workspace.yaml (currently for minimatch). Adding a second overrides source in package.json can be confusing and lead to drift; consider consolidating overrides in one place (update/remove the workspace override if package.json is the new source of truth).

Suggested change

	},
	"pnpm": {
	"overrides": {
	"rollup": ">=4.59.0",
	"minimatch": ">=10.2.3"
	}

[Copilot]

The override ranges are open-ended (">=") which can allow future major versions (e.g., rollup@5, minimatch@11) to be selected the next time the lockfile is regenerated, potentially introducing breaking changes. Prefer pinning to an exact patched version (or at least a major-locked range like ^4.59.0 / ^10.2.3), and consider using the selector form (e.g., only override <patched) to minimize blast radius.

Suggested change

	"rollup": ">=4.59.0",
	"minimatch": ">=10.2.3"
	"rollup": "^4.59.0",
	"minimatch": "^10.2.3"