fix: patch high-severity transitive deps (js-yaml, rollup, sharp, tmp)

[sammdec]

Summary

Adds pnpm overrides to pull patched versions of transitive dependencies flagged with high-severity advisories. All four ship as pnpm.overrides since these are indirect deps.

Package	Before	After	Advisory
js-yaml (4.x)	4.2.0	4.3.0	Quadratic CPU consumption via YAML merge-key chains
rollup	2.79.2	2.80.0	Arbitrary file write via path traversal
sharp	0.34.5	0.35.3	Four inherited libvips CVEs
tmp	0.0.33	0.2.7	Path traversal via unsanitized prefix/postfix

The js-yaml override is scoped to the >=4.0.0 <4.3.0 range so the unaffected 3.x copy is left untouched.

pnpm audit confirms these four advisories are cleared. No source changes — transitive bumps only.

Deferred (not in this PR)

These also have high-severity fixes, but their only patched releases are <7 days old and are held back by the repo's minimumReleaseAge (7-day) supply-chain quarantine. Rather than weaken the quarantine via minimumReleaseAgeExclude, they're deferred until the versions age out:

• fast-uri ≥3.1.4 (host confusion) — published Jul 19, eligible ~Jul 26
• ws ≥8.21.0 (memory-exhaustion DoS + memory disclosure) — published Jul 17, eligible ~Jul 24
• next ≥15.5.21 (App Router DoS + two Server Action SSRFs) — published Jul 23, eligible ~Jul 30

Moderate/low advisories are intentionally out of scope.

Test plan

• pnpm install succeeds; lockfile regenerated
• pnpm audit no longer reports the four patched advisories
• CI green (build + tests validate the sharp/rollup bumps)

🤖 Generated with Claude Code

[odin-by-borg]

Mjolnir Security Review

Verdict	CLEAN · 0 findings
Commit	15ea3d3 · 23s

No security vulnerabilities identified. This PR improves the project's security posture by adding dependency overrides that force upgrades of several packages to newer versions: js-yaml (4.2.0 → 4.3.0), tmp (0.0.33 → 0.2.7), sharp (0.34.5 → 0.35.3), and rollup (2.79.2 → 2.80.0). The js-yaml and tmp upgrades are particularly noteworthy as the older versions had known security concerns (js-yaml <4.3.0 had a code-execution vulnerability via crafted YAML, and tmp 0.0.33 used insecure temporary file creation patterns). No application code was changed — only package.json overrides and the corresponding lock file updates.

---

_{2 PRs reviewed}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
interface	Ready	Preview, Comment	Jul 23, 2026 9:29am

[github-actions]

• Ipfs hash: bafybeihon6oukbyj3bzgy4tmt4nu6unqumxofkstpedww4m3k7h5xepl3e
• Ipfs preview link: https://bafybeihon6oukbyj3bzgy4tmt4nu6unqumxofkstpedww4m3k7h5xepl3e.ipfs.cf-ipfs.com/

[github-actions]

📦 Next.js Bundle Analysis for aave-ui

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	1.32 MB (-14 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!