fix(deps): bump pnpm overrides for ws / brace-expansion / body-parser alerts

[touyou]

Summary

• fix(deps): bump pnpm overrides to patch open Dependabot alerts #293 マージ後にGitHubが新規検知した5件のDependabotアラートに対応。
• 既存の pnpm.overrides の一部が今回の新しいアドバイザリに対して陳腐化していたため、範囲・バージョンを引き上げ、ws は新規追加した。

package	before	after	対応alert
ws	(override無し, 8.18.2で解決)	ws@>=8.0.0 <8.21.0: ^8.21.0 (新規)	#117
brace-expansion (2.x系)	>=2.0.0 <2.0.3: ^2.0.3	>=2.0.0 <2.1.2: ^2.1.2	#131
brace-expansion (5.x系)	(未対応, 5.0.6で解決)	>=3.0.0 <5.0.7: ^5.0.7 (新規)	#130
brace-expansion (1.x系)	<1.1.13: ^1.1.13	<1.1.16: ^1.1.16	#129
body-parser	>=2.2.0 <2.2.1: ^2.2.1	>=2.2.0 <2.3.0: ^2.3.0	#132

Test plan

• pnpm install で lockfile を再生成し、ws@8.21.0 / brace-expansion@1.1.16,2.1.2,5.0.7 / body-parser@2.3.0 に解決されることを確認
• pnpm install --frozen-lockfile 成功
• pnpm type-check 成功
• pnpm test 611 passed / 10 skipped / 19 todo

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01HxuveRGRZF1DgtLarQko33

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sparkle-design	Ready	Preview, Comment	Jul 21, 2026 4:21am

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 83fda643-62a2-4a01-ad34-a0706850d166

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch worktree-dependabot-fixes-2

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the repo’s pnpm.overrides to address newly detected Dependabot alerts (ws / brace-expansion / body-parser) and regenerates the lockfile so installs resolve to patched versions.

Changes:

• Bump existing pnpm.overrides ranges/targets for brace-expansion (1.x/2.x) and body-parser.
• Add new pnpm.overrides entries for ws and brace-expansion (5.x range).
• Regenerate pnpm-lock.yaml so dependency resolution reflects the updated overrides (e.g., ws@8.21.0, brace-expansion@1.1.16/2.1.2/5.0.7, body-parser@2.3.0 and its updated transitive deps).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Updates pnpm.overrides entries/ranges to force patched versions for the affected advisories.
pnpm-lock.yaml	Lockfile regeneration reflecting the new override rules and resulting resolved versions.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file