fix(deps): three security overrides had been overtaken by their own fixes

pnpm-workspace.yaml

@@ -68,22 +68,45 @@ overrides:
   # declares ^0.28.
   'esbuild@>=0.27.3 <0.28.1': '^0.28.1'
   # #153 GHSA-h67p-54hq-rp68 / CVE-2026-53550 — js-yaml merge-key DoS, 3.x line.
-  # Exact pin: 3.15.0 is the only patched 3.x release. Installed with the
-  # one-off `--config.minimum-release-age=0` bypass (published 2026-06-26,
-  # matures 2026-07-04) per SKILL.md, instead of a minimumReleaseAgeExclude
-  # entry.
-  'js-yaml@<3.15.0': '3.15.0'
+  # #189 GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 (HIGH) — quadratic-CPU DoS in
+  # `!!omap` duplicate-key detection; patched in 3.15.1.
+  #
+  # The `<3.15.0` selector had been overtaken by its own fix: the tree resolved
+  # exactly 3.15.0, so nothing matched and nothing lifted it to 3.15.1. Keep the
+  # ceiling AHEAD of the patched floor, not at it. Reached via `read-yaml-file`.
+  'js-yaml@<3.15.1': '3.15.1'
   # #152 GHSA-h67p-54hq-rp68 / CVE-2026-53550 — js-yaml merge-key DoS, 4.x line.
-  # Exact-pinned to the MATURED 4.2.0 (4.3.0 is still inside the cooldown), and
-  # kept exact because a past js-yaml upgrade broke changesets — bump this
-  # deliberately and re-verify `changeset status`/`version` when you do.
-  'js-yaml@>=4.0.0 <5': '4.2.0'
-  # Not a Dependabot alert — cooldown-regression guard. Re-resolving the
-  # lockfile let minimumReleaseAge demote ajv's fast-uri to 3.1.2, un-fixing
+  # #155 GHSA-52cp-r559-cp3m / CVE-2026-59869 (HIGH, patched 4.3.0) and
+  # #188 GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 (HIGH, patched 4.3.1).
+  #
+  # THIS ENTRY WAS ENFORCING THE VULNERABILITY. Unlike an overtaken selector,
+  # `>=4.0.0 <5` kept matching — so an exact pin written to FIX an advisory was
+  # holding the tree at 4.2.0 and blocking 4.3.1. That shape cannot self-heal
+  # and Dependabot cannot fix it either.
+  #
+  # The "a past js-yaml upgrade broke changesets" caution is DISCHARGED for this
+  # bump, checked rather than assumed: @changesets/parse declares
+  # `js-yaml: ^4.1.1`, which 4.3.1 satisfies; 4.2.0 and 4.3.1 have identical
+  # `dependencies` (argparse ^2.0.1) and `exports`, no `engines`, no `main`;
+  # 4.3.0/4.3.1 are security backports only, with no API removal on the 4.x
+  # line. The breaking churn — grouped constant exports, `MERGE_KEY` removal,
+  # mandatory `identify` — is all on 5.x, which the `<5` ceiling excludes.
+  # Verified with `changeset status` against @changesets/parse's own resolved
+  # copy. Kept exact so a 4.x regression cannot arrive silently.
+  'js-yaml@>=4.0.0 <5': '4.3.1'
+  # Cooldown-regression guard AND two live advisories. Re-resolving the lockfile
+  # let minimumReleaseAge demote ajv's fast-uri to 3.1.2, un-fixing
   # GHSA-4c8g-83qw-93j6 / CVE-2026-13676 (host confusion via failed IDN
-  # canonicalization). Pin the patched release (published 2026-06-29, matures
-  # 2026-07-06); safe to relax to ^3.1.3 after that date.
-  'fast-uri@<3.1.3': '3.1.3'
+  # canonicalization) — hence a pin rather than a floor.
+  #
+  # But 3.1.3 was itself overtaken: #158 (HIGH) needs 3.1.4 and #175 (HIGH)
+  # needs 3.1.5, so the exact pin was enforcing a vulnerable version — the same
+  # shape as the js-yaml 4.x entry above. Reached via ajv.
+  'fast-uri@<3.1.5': '3.1.5'
+
+  # #190 (HIGH) — brace-expansion. Transitive, reached through several dev
+  # toolchains; 5.0.7 is a patch on the line already resolved.
+  'brace-expansion@<5.0.7': '^5.0.7'
 
 # Supply-chain hardening — see skills/stash-supply-chain-security/
 # 7 days in minutes; mirrors the Dependabot cooldown so manual + automated