fix(deps): take the fix for the fifteen OSV advisories blocking every PR (#17029)

* fix(deps): take the fix for the fifteen OSV advisories blocking every PR

`Validate Package Dependencies` (OSV-Scanner against pnpm-lock.yaml) exits 1 on
fifteen advisories across seven packages, so every PR is red and main's next
scheduled run goes red on its own. All fifteen name a published fix version, so
this is the take-the-fix path osv-scanner.toml's header describes, not the
exemption path; that ledger keeps its zero entries and is untouched, as is
.github/workflows/validate-deps.yml.

  GHSA-2xp9-vwfh-vxw4  9.5  next             16.3.1  -> 16.3.3
  GHSA-p293-qw3h-jr36  9.0  next             16.3.1  -> 16.3.3
  GHSA-rgj7-g3m4-5g8c  8.9  sharp            0.35.3  -> 0.35.4
  GHSA-2x7j-588g-ccc2  7.5  nodemailer       9.0.5   -> 9.1.1
  GHSA-cc9r-2j5m-2m83  6.5  nodemailer       9.0.5   -> 9.1.1
  GHSA-wmmp-3585-3rmp  6.5  nodemailer       9.0.5   -> 9.1.1
  GHSA-8m3c-c648-2xjj  5.9  nodemailer       9.0.5   -> 9.1.1
  GHSA-gqvv-2mrq-wpjv  6.5  hono             4.12.34 + 4.13.2 -> 4.13.7
  GHSA-crvj-82cr-hjcx  5.9  hono             4.12.34 + 4.13.2 -> 4.13.7
  GHSA-g6gw-c38x-mqfc  5.3  hono             4.12.34 + 4.13.2 -> 4.13.7
  GHSA-82fw-gwwq-j7x9  5.9  vitest           4.1.10  -> 4.1.11
  GHSA-82fw-gwwq-j7x9  5.9  @vitest/mocker   4.1.10  -> 4.1.11

hono was resolved at TWO versions and both were flagged. The transitive copy
@modelcontextprotocol/sdk pulled sat exactly on the old `^4.12.34` override
floor, so nothing ever re-resolved it, while our own three declarations floated
up to 4.13.2. Lifting the target to `^4.13.5` excludes the floor, forces both
edges to re-resolve, and the tree deduplicates onto one hono@4.13.7 — moving
only our declarations would have left the transitive copy flagged.

sharp and hono are TARGET-ONLY override lifts: both selectors already sit at the
compatibility boundary this file's header mandates (`<0.36.0` for the 0.x line,
`<5.0.0` for hono), so neither moves.

next is an exact pin in the private docs app. nodemailer and hono move their
declared ranges in lockstep with the override, per the downstream-install rule
the overrides header states — the @objectstack/hono PEER range stays the
permissive `^4.12.8`, and metadata-core's optional `vitest` peer stays `^4.0.0`,
both for the reason that header gives: a peer states what host we work against.

@vitest/coverage-v8 moves in lockstep with vitest because its peer on vitest is
EXACT (`"vitest": "4.1.10"`), so a lone vitest bump would have broken the peer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

* build(deps): re-derive the lockfile from the declared state after the merge

The vitest move was originally taken with `pnpm update`, which re-resolves the
whole updated SUBTREE and not just the package named: it dragged second,
patch-level copies of postcss (8.5.28 beside 8.5.26) and picomatch (4.0.7
beside 4.0.5) into the tree, plus @inquirer/*, ip-address, type-fest and
seroval — none of them flagged, none of them forced by a flagged bump.

Regenerating from origin/main's lockfile with a plain `pnpm install`, so the
only inputs are the declared ranges and the two override targets this PR
changes, gives a strictly tighter result:

  registry tuples  1372 -> 1370   (was 1372 -> 1373 under `pnpm update`)
  removed 50, added 48, and EVERY added tuple is in a flagged family

Two duplicates collapse and nothing else moves:
  hono      4.12.34 + 4.13.2  ->  4.13.7        (the OSV duplicate)
  tinyexec  0.3.2 + 1.2.4 + 1.3.0  ->  0.3.2 + 1.3.0
    vitest 4.1.10 held 1.2.4; 4.1.11 declares the same `^1.0.2` and dedupes
    onto the 1.3.0 copy that was already in the tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-trump

.changeset/osv-advisory-bumps-2026-09.md

@@ -18,7 +18,7 @@
     "fumadocs-ui": "16.14.4",
     "lucide-react": "^1.31.0",
     "mermaid": "^11.16.0",
-    "next": "16.3.1",
+    "next": "16.3.3",
     "next-themes": "^0.4.6",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",

apps/docs/package.json

@@ -28,6 +28,6 @@
     "@objectstack/formula": "workspace:*",
     "@objectstack/objectql": "workspace:*",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }

examples/app-crm/package.json

@@ -46,6 +46,6 @@
     "@objectstack/service-messaging": "workspace:*",
     "@playwright/test": "^1.62.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }

examples/app-showcase/package.json

@@ -37,6 +37,6 @@
     "@objectstack/trigger-record-change": "workspace:*",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }

examples/app-todo/package.json

@@ -17,6 +17,6 @@
   "devDependencies": {
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   }
 }

examples/embed-objectql/package.json

@@ -26,9 +26,9 @@
   },
   "devDependencies": {
     "@objectstack/runtime": "workspace:*",
-    "hono": "^4.13.2",
+    "hono": "^4.13.5",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "description": "Hono adapter for ObjectStack — edge-compatible REST API server for Cloudflare Workers, Deno, Bun, and Node.",
   "keywords": [

packages/adapters/hono/package.json

@@ -24,7 +24,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

packages/apps/account/package.json

@@ -24,7 +24,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",

packages/apps/setup/package.json

@@ -24,7 +24,7 @@
     "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "objectstack",