#99 fix(security): patch Aikido-flagged dependencies

Summary

Patches the dependencies that Aikido flagged, plus every other finding from pnpm audit in both lockfiles. All changes raise override floors in the style of #98. No package crosses a major version.

Changes

pnpm-lock.yaml (root, override in pnpm-workspace.yaml)

Package	From	To	Advisories
brace-expansion@1	1.1.18	1.1.21	GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7 (High); GHSA-q2hr-2g5m-vwhr (Moderate)
brace-expansion@2	2.1.4	2.1.7	same
brace-expansion@5	5.0.9	5.0.12	same

.deepsec/pnpm-lock.yaml (overrides in .deepsec/package.json and .deepsec/pnpm-workspace.yaml, kept in sync)

Package	From	To	Advisories
undici	7.29.0	7.30.0 (floor 7.29.1)	CVE-2026-84961 (Critical per Aikido), CVE-2026-84933, CVE-2026-19534; GHSA-rfgv-xxqx-mfg5, GHSA-w293-vg96-wgc3 (High) and 8 Moderate/Low
fast-uri	3.1.7	3.1.8	GHSA-hrr3-gc8f-f4qj (Moderate)
ip-address	10.7.0	10.7.2 (floor 10.7.1)	GHSA-j6r3-76f7-8jcv, GHSA-h3mg-xc3c-68pw
brace-expansion@5	5.0.9	5.0.12	same three as root

Skipped

• proxy-addr: not in either lockfile (pnpm why proxy-addr is empty). The Aikido entry is for sdk-node.
• image-size (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq): already ignored in auditConfig. No patched version is published. No change.
• No minimumReleaseAge exception was needed. All new versions are older than 7 days. Note: .deepsec has no release age policy (pnpm 9), so undici resolved to 7.30.0 (published 2026-09-25).

Verification

Check	Result
Root pnpm audit	before 11 (8 high, 3 moderate; 2 high ignored). After 2 (the 2 ignored image-size)
.deepsec pnpm audit (pnpm 9.15.4)	before 16 (4 high, 9 moderate, 3 low). After 0
pnpm install --frozen-lockfile	passes in root and in .deepsec
pnpm build	passes
pnpm typecheck	passes
pnpm lint	passes
pnpm test	23 suites, 502 of 502 tests pass, 0 skipped

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}