[viqueen]

Summary

• pnpm audit flagged minimatch (moderate, DoS via globparts amplification, GHSA-g3hv-75wg-m249), pulled in through nx, which pins minimatch 10.2.5. The fix is in 11.0.1 and later.
• Add a pnpm override minimatch: ^11.0.1 in pnpm-workspace.yaml. The lockfile now resolves 11.0.5, plus one new small dependency (@isaacs/nonrecursive-glob-match).
• The lockfile is in pnpm's native format (single quotes, inline resolution), as pnpm and Dependabot write it. It is in .prettierignore, so the diff looks large but is mostly a one-time style change.
• Add .claude/settings.json to stop Claude Code adding attribution (co-author trailer, PR footer, session link) to commits and PRs.

Notes

• This is a major-version bump under nx. nx --version and nx show projects work, but there are no projects yet, so lint, build and test ran 0 tasks and nothing exercised minimatch's glob matching in a real build.
• The override can be dropped once nx ships a version with a patched minimatch.

Verification

• pnpm audit: no known vulnerabilities
• pnpm format:check: passes