fix: remediate open Dependabot alerts (lodash, picomatch)

[openassistuk]

Summary

• pin patched transitive security floors for lodash and picomatch through root pnpm.overrides
• refresh pnpm-lock.yaml so the vulnerable exact resolutions are gone from the dependency graph
• extend the existing dependency-security contract test and record the remediation in the changelog and April ExecPlan
• also pin the dev-only audited brace-expansion path narrowly so pnpm audit --json is clean on the branch

Root cause

GitHub Dependabot currently reports 3 open alerts on main, but they collapse to two vulnerable transitive packages in the lockfile:

• lodash via discord.js -> @sapphire/shapeshift
• picomatch via @tktco/node-actionlint -> fast-glob -> micromatch

The full audit gate also exposed a remaining dev-only brace-expansion advisory through the Vitest coverage toolchain, so this PR clears that narrow path too without broad dependency churn.

Validation

• node --test --import tsx/esm tests/node/dependency-security-overrides.test.ts
• pnpm audit --prod --json
• pnpm audit --json
• pnpm verify:all

[Copilot]

Pull request overview

This PR remediates open Dependabot/audit findings by pinning patched minimum versions for vulnerable transitive dependencies via root pnpm.overrides, regenerating the lockfile, and extending the existing override contract test while documenting the change in the changelog and an April ExecPlan.

Changes:

• Add pnpm.overrides floors for lodash, picomatch, and a narrow dev-only brace-expansion advisory path.
• Refresh pnpm-lock.yaml and extend tests/node/dependency-security-overrides.test.ts to enforce the new floors and absence of vulnerable resolutions.
• Record the remediation in CHANGELOG.md and a new docs/execplans/... document.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/node/dependency-security-overrides.test.ts	Extends the security override contract assertions to cover the new override keys and lockfile resolutions.
package.json	Adds new pnpm.overrides entries to pin patched transitive minimum versions.
pnpm-lock.yaml	Updates override map and resolved package graph to remove vulnerable exact versions.
CHANGELOG.md	Documents the security-floor remediation in the changelog.
docs/execplans/dependabot-alert-remediation-2026-04.md	Adds an ExecPlan capturing remediation context, steps, and validation commands.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.