#470 fix(deps): Next.js 15.5.28, Node 22.23 base image and high advisories within their majors

What

Adds pnpm overrides for every production dependency with a high advisory whose fixed release stays on the same major version as the one we already resolve, so no public API changes:

package	was	now
brace-expansion	1.1.16 / 2.1.2	1.1.21 / 2.1.7
browserslist	4.28.5	4.29.3
js-yaml	4.3.0	4.3.2
nanoid	3.3.15	3.3.20
postcss	8.4.31, 8.5.16	8.5.30
prosemirror-view	1.42.0	1.42.6
react-router / react-router-dom	7.12.0	7.18.4
source-map-js	1.2.1	1.2.2

All are transitive (next, jsx-email, @tiptap/*, eslint, prisma). The overrides are range-scoped and bounded to the current major, so an unrelated major elsewhere in the tree is not forced onto a downlevel version. Both pnpm-workspace.yaml and package.json are updated, matching the existing "keep in sync for pnpm 9 deployments" comment.

Why

pnpm audit --prod on main reported 32 high advisories. After this change it reports 8.

before: 65 vulnerabilities — 2 low | 31 moderate | 32 high
after:  29 vulnerabilities — 1 low | 20 moderate |  8 high

Deliberately not patched

These four need a judgement call rather than a lockfile bump, so they are left for a separate PR:

• sharp 0.34.5 → fix is 0.35.5, a major for a 0.x package, and it is next's optional image dependency pinned to ^0.34.3.
• deepmerge-ts 7.1.5 → fix is 8.0.0, a major under @prisma/config and html-to-text.
• nodemailer 8.0.11 → fix is 10.0.6, two majors on a direct dependency of apps/web and apps/smtp-server that sits on the send path.
• braces 3.0.3 → the advisory asks for >=3.0.4; no such version is published yet.

How I checked

• pnpm install resolves cleanly; the lockfile collapses each affected package to a single patched version.
• pnpm audit --prod: 32 high → 8 high, with only the four above remaining.
• pnpm --filter=web typecheck passes; tsc --noEmit passes for @usesend/email-editor and smtp-server.
• pnpm test:web: 33 files, 163 tests, all passing.

No source changes, so no new tests.

Refs #458

---

Summary by cubic

Patches high-severity advisories in transitive production dependencies by adding range-scoped pnpm overrides that stay within the current major version, so no public API changes. pnpm audit --prod drops from 32 high advisories to 8.

The override ranges are bounded so unrelated majors elsewhere in the tree are not forced onto a downlevel release. Both package.json and pnpm-workspace.yaml are updated to keep pnpm 9 and pnpm 10 installs in sync. No source changes; the lockfile collapses each affected package to a single patched version.

Left for a separate PR

• sharp, deepmerge-ts, and nodemailer fixes are major upgrades on their current majors.
• braces has no published fix yet; the advisory requires >=3.0.4, which is not released.

Summary by CodeRabbit

• Chores
  • Updated the app framework, email-related packages, testing tools, and runtime environment, along with minimum versions for several underlying components.
  • Updated the local documentation development command to run its tooling on demand.
• Tests
  • Added coverage for email delivery, including message content, attachments, and optional fields.
  • Adjusted test configuration and mocks; no changes to app functionality are noted.