fix(deps): bump pnpm overrides to patch open Dependabot alerts

[touyou]

Summary

• 既存の pnpm.overrides (package.json) が過去のCVE発覚時点のバージョンで固定されたままになっており、その後リリースされた新しいアドバイザリに対して陳腐化していた。各パッケージのoverrideを最新の first_patched_version まで引き上げ、postcss / ip-address / @babel/core は新規にoverrideを追加した。
• pnpm install（pnpm 10.12.4, .tool-versions 準拠）でlockfileを再生成し、対象パッケージが全て安全なバージョンに解決されることを確認済み。

package	before	after	対応するalert
js-yaml	^4.1.1 (>=4.0.0 <4.1.1のみ)	^4.2.0 (>=4.0.0 <4.2.0)	#128
undici	^6.24.0	^6.27.0	#121 #120 #119
tar	^7.5.11	^7.5.16	#116
form-data	^4.0.4	^4.0.6	#115
hono	^4.12.18	^4.12.25	#114 #113 #112 #111 #110 #108 #107 #106 #105
qs	^6.14.2 (<6.14.2のみ)	^6.15.2 (<6.15.2)	#102
postcss	(なし)	^8.5.10 (新規)	#91
ip-address	(なし)	^10.1.1 (新規)	#83
@babel/core	(なし)	^7.29.6 (新規, <=7.29.0のみ)	#123

対象外

• vite関連 (Inputの修正 #124 #125 Tagの修正 #126 #127) は既存の Dependabot PR chore(deps-dev): bump vite from 6.4.2 to 6.4.3 #285 (vite 6.4.2 → 6.4.3, CI green) で対応済みのため、本PRのスコープ外とした。

Test plan

• pnpm install（pnpm 10.12.4）で lockfile を再生成し、対象パッケージが全て patched version 以上に解決されることを確認
• pnpm install --frozen-lockfile が成功する（CIの pnpm install --frozen-lockfile と同条件）
• pnpm type-check 成功
• pnpm test 611 passed / 10 skipped / 19 todo
• pnpm lint:check はworktreeがネストした環境固有の "multiple lockfiles" 検出エラーで実行できず未検証（コード変更とは無関係と判断、CI上のlint jobで最終確認要）

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01HxuveRGRZF1DgtLarQko33

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sparkle-design	Ready	Preview, Comment	Jul 21, 2026 1:55am

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• package.json is excluded by !**/*.json
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/*.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 85f06a1a-672c-4ae0-88fc-44da1abdf48c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch worktree-dependabot-fixes

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates pnpm.overrides to bump several transitive dependencies to versions that satisfy current Dependabot security alerts, and regenerates the lockfile to ensure the patched versions are actually resolved in the dependency graph.

Changes:

• Updated pnpm.overrides entries (and added new ones) to bring vulnerable packages up to their patched versions (e.g., undici, tar, js-yaml, qs, form-data, hono, plus new overrides for postcss, ip-address, @babel/core).
• Regenerated pnpm-lock.yaml so resolved versions reflect the updated overrides (e.g., postcss 8.5.x, js-yaml 4.3.x, tar 7.5.x, undici 6.27.x, @babel/core 7.29.7).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps/extends pnpm.overrides to patched versions to address Dependabot alerts.
pnpm-lock.yaml	Lockfile regenerated to reflect new overrides and ensure patched resolutions are used.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file