chore(deps): Weekly Dependency + Security Sweep (Wk 3) — enable Dependabot + pnpm audit sweep + docs pass

[PAMulligan]

Weekly Dependency + Security Sweep (Wk 3)

Part of the recurring PMDS repos dependency + security maintenance. For a coding agent to remediate and open a PR.

⚠️ Dependabot is currently INACTIVE for this repo

GitHub reports: "Dependabot alerts are inactive. To receive Dependabot alerts, you must enable Dependency graph in this repository's settings." So there is no alert data to work from yet — the sweep must be driven by a local pnpm audit.

• (Owner action) Enable Dependency graph + Dependabot alerts in Settings → Security. (Repo-settings/permissions change — left to the maintainer, not the coding agent.)

Workflow (per repo standard)

• Run pnpm audit (and pnpm outdated) to enumerate vulnerable + outdated deps
• Bump outdated + vulnerable deps with pnpm (regenerate pnpm-lock.yaml via pnpm — do NOT hand-edit the lockfile)
• Pay special attention to the shared-stack packages flagged in the sibling repos this week: esbuild (→ >=0.28.1), js-yaml (→ >=4.2.0), @babel/core (→ >=7.29.6), and tar (→ >=7.5.16, major bump) — check whether any appear in Nerva's tree (directly or transitively via Hono / drizzle-orm / Cloudflare Workers tooling) and remediate the same way (pnpm.overrides where transitive).
• Run the test suite and confirm CI is green
• Honor the minimumReleaseAge guard (do not pull versions newer than the configured cooldown)
• README/docs accuracy pass (see below)
• Open one PR with a Conventional Commits title/message

README / docs accuracy pass

• Verify any counts/claims in the README match the actual repo (schema-first / CRUD-gen / OpenAPI feature descriptions)
• Verify version badges (shields) reflect current versions / build status
• Verify install steps run cleanly on a fresh clone (pnpm install + quickstart)

PR

• Conventional Commits, e.g.: chore(deps): audit + bump vulnerable/outdated deps; docs accuracy pass

---

Filed as part of the weekly PMDS repos Dependency + Security Sweep.