chore(deps): bump pkg-pr-new to 0.0.91
pkg-pr-new 0.0.66 depends on query-registry, which pulls zod 3.25.76 and decode-uri-component 0.4.1 into our lockfile. Every zod 3.x is affected by GHSA-mrhx-c7xc-m3w5 (high), and decode-uri-component is only fixed in 0.5. Newer pkg-pr-new releases ship as a single bundle with no runtime dependencies.
Changes
package.json: root devDependencypkg-pr-new0.0.66 → 0.0.91 (2026-10-07; 0.0.92 is 4 days old).pnpm-lock.yaml: re-locked. Drops 39 packages, includingquery-registry,zod3.25.76,decode-uri-component0.4.1,query-stringand@actions/core. Nothing outside the root importer changes.
No changeset: root devDependency only.
Testing
pnpm install --frozen-lockfile,pnpm typecheckandscripts/check-dependency-versions.tspass. The lockfile is stable under anotherpnpm install --lockfile-only.- The
preview-releaseworkflow runspnpm pkg-pr-new publish <dirs> --pnpm; 0.0.91 still takes positional directories and--pnpm. Publishing needs the GitHub Actions environment, and that step only runs whenpackages/**changes, so it isn't exercised on this PR. The next PR that touches a package runs it. - 0.0.91 (like 0.0.92) bundles its own
zod4.3.6 internally. Dependabot doesn't track it, andpkg-pr-newonly validates our own package metadata in CI, so the memory-exhaustion advisory isn't reachable there.
Summary by cubic
Bumps the root devDependency pkg-pr-new from 0.0.66 to 0.0.91. Newer versions ship as a single bundle with no runtime dependencies, so the lockfile drops 39 packages including the vulnerable zod 3.25.76 (GHSA-mrhx-c7xc-m3w5) and decode-uri-component 0.4.1.
pnpm install --frozen-lockfile, pnpm typecheck, and the dependency check script pass; the lockfile is stable under pnpm install --lockfile-only. The preview-release workflow still works with 0.0.91, but publishing requires the GitHub Actions environment and only runs when packages/** changes, so it isn't exercised on this PR.
No changeset: root devDependency only.