Resolve all 69 open Dependabot security alerts

[valuecodes]

What

• Closes all 69 open Dependabot alerts (20 high, 43 moderate, 6 low) — every alert had a patched version available.
• Direct dependency bumps: hono 4.12.12→4.12.27, vite 7.3.1→7.3.6, fast-xml-parser 5.5.11→5.9.3.
• Parent upgrade: wrangler 4.81.1→4.107.0 — a newer miniflare pulls patched undici (7.28.0), ws (8.21.0) and esbuild (0.28.1), avoiding overrides for those.
• In-range re-resolution (no override, no parent bump — the lockfile just had stale versions): ajv 6.15.0, flatted 3.4.2, js-yaml 4.3.0, minimatch 3.1.5, brace-expansion 1.1.15/5.0.7, @babel/core 7.29.7, tsx 4.23.0 (→esbuild 0.28.1); rollup/postcss/picomatch/fast-xml-builder came patched via the vite bump.
• Two narrow pnpm.overrides for the only two transitives not fixable via a stable parent upgrade: yaml (>=2.8.3 <3 — vite's optional peer, resolved out entirely) and esbuild@0.18→0.25.12 (pinned by the deprecated @esbuild-kit/core-utils that drizzle-kit still requires).
• Workers AI field rename in apps/jobs: max_output_tokens→max_tokens — required by wrangler 4.107.0's regenerated AI schema for @cf/meta/llama-3.1-8b-instruct-fast (same value/semantics), plus its test.

How to test

pnpm typecheck
pnpm lint
pnpm test
pnpm format:check
pnpm build
pnpm --filter rehoboam-api exec wrangler deploy --dry-run
pnpm --filter rehoboam-jobs exec wrangler deploy --dry-run --config wrangler.local.jsonc

Security review

Dependency security patches only (69 CVEs); the sole code change is a Workers AI request-field rename. No application auth, input-handling, or data-flow logic changed.

Notes

• The 2 pnpm.overrides are temporary — remove them once the parent packages ship compatible patched versions (drizzle-kit dropping @esbuild-kit; vite's optional yaml peer).
• Merging to main auto-deploys all three Workers; recommend a post-deploy smoke check of the jobs AI path (the max_tokens rename) and a revert plan, per the Codex plan review.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR focuses on resolving Dependabot security alerts by updating direct and transitive dependencies across the pnpm workspace, and includes a small compatibility update for Cloudflare Workers AI request payloads required by the newer wrangler tooling.

Changes:

• Added two targeted pnpm.overrides (yaml range pin and esbuild@0.18→0.25.12) to address remaining transitive vulnerabilities not fixed by parent upgrades.
• Upgraded key direct dependencies (wrangler, vite, hono, fast-xml-parser) and refreshed pnpm-lock.yaml accordingly.
• Updated apps/jobs Workers AI request field from max_output_tokens to max_tokens, along with its unit test.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Captures dependency graph updates plus applied overrides and patched transitive resolutions.
package.json	Adds root pnpm.overrides for yaml and esbuild@0.18 while keeping existing tooling config intact.
apps/ui/package.json	Bumps vite to a patched version.
apps/api/package.json	Bumps hono and wrangler to patched versions.
apps/jobs/package.json	Bumps fast-xml-parser and wrangler to patched versions.
apps/jobs/src/clients/ai-client.ts	Renames Workers AI request field to max_tokens to match updated schema expectations.
apps/jobs/src/tests/ai-client.test.ts	Updates request-shape assertions to validate max_tokens.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.