fix(security): clear HIGH advisories flagged by trivy on main

[ulises-jeremias]

MegaLinter's trivy step has been failing main since 2026-08-17 with 3 HIGH findings (trivy fs --severity HIGH,CRITICAL):

Package	Locked	CVE	Fixed in
brace-expansion	5.0.7	CVE-2026-14257, CVE-2026-69152	5.0.9
nanoid	3.3.16	CVE-2026-67213	3.3.18
undici (tools/danger)	7.28.0	CVE-2026-13697	7.29.0

What this does

• Bumps brace-expansion and nanoid naturally via pnpm update (parents' ranges allow it — no overrides needed for those two).
• Updates tools/danger lockfile: undici → 8.10.0 (npm update; the existing >=6.27.0 override permits it).
• Refreshes stale security floors in pnpm-workspace.yaml that had fallen below current fix versions and were now pinning vulnerable releases:
  • brace-expansion@<1.1.13 → @<1.1.18 at 1.1.18
  • brace-expansion@>=2 <2.0.3 → <2.1.4 at 2.1.4
  • fast-uri >=3.1.2 → >=3.1.5
  • js-yaml >=4.1.1 → >=4.3.1

These are transitive dependencies, so range-pins are the only direct lever — this follows the repo's established override pattern, just brought up to date.

Verification

• pnpm audit --audit-level=high → clean (was 5 HIGH; 6 moderate / 2 low remain, below the HIGH,CRITICAL gate)
• npm audit in tools/danger → found 0 vulnerabilities

Description

Clears all HIGH severity advisories reported by pnpm audit and trivy so the MegaLinter gate on main goes green again.

Testing

• pnpm audit --audit-level=high → clean (was 5 HIGH)
• npm audit in tools/danger → 0 vulnerabilities

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
create-awesome-python-app-website	Ready	Preview	Aug 23, 2026 4:47pm

[coderabbitai]

Warning

Review limit reached

@ulises-jeremias, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ef46fc6-8acf-40ca-ace8-1e0078f87664

📥 Commits

Reviewing files that changed from the base of the PR and between 7013b43 and 4f7b7e0.

⛔ Files ignored due to path filters (2)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• tools/danger/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

	Fails
🚫	📋 Missing Section - Please include the section: ## Description in your PR description.
🚫	📋 Missing Section - Please include the section: ## Type of Change in your PR description.
🚫	📋 Missing Section - Please include the section: ## How Has This Been Tested? in your PR description.
🚫	📋 Missing Section - Please include the section: ## Checklist in your PR description.

	Warnings
⚠️	📋 Unchecked Checklist Item - Please check the item: My code follows the style guidelines of this project in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: I have performed a self-review of my code in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: I have commented my code, particularly in hard-to-understand areas in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: I have made corresponding changes to the documentation in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: My changes generate no new warnings in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: Any dependent changes have been merged and published in downstream modules in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: I have checked my code and corrected any misspellings in your PR description.
⚠️	This PR is changing more than 200 lines.

	Messages
📖	Thanks! We ❤️ removing more lines than added!

Generated by 🚫 dangerJS against 4f7b7e0

[github-actions]

🦙 MegaLinter status: ❌ ERROR

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.04s
✅ COPYPASTE	jscpd	yes		no	no	2.5s
✅ EDITORCONFIG	editorconfig-checker	170		0	0	0.24s
✅ JAVASCRIPT	standard	1		0	0	0.72s
✅ JSON	jsonlint	9		0	0	0.11s
✅ JSON	npm-package-json-lint	yes		no	no	0.24s
✅ JSON	prettier	9		0	0	0.29s
✅ JSON	v8r	9		0	0	11.51s
✅ MARKDOWN	markdownlint	9		0	0	0.49s
✅ MARKDOWN	markdown-table-formatter	9		0	0	0.16s
✅ REPOSITORY	checkov	yes		no	no	14.25s
✅ REPOSITORY	gitleaks	yes		no	no	0.38s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	secretlint	yes		no	no	1.06s
✅ REPOSITORY	trivy	yes		no	no	8.85s
✅ REPOSITORY	trufflehog	yes		no	no	2.22s
❌ SPELL	cspell	171		12	0	4.01s
✅ YAML	prettier	12		0	0	0.36s
✅ YAML	yamllint	12		0	0	0.37s

See detailed report in MegaLinter reports

[ulises-jeremias]

Superseded by #26, which combines this security remediation with the cspell fix so both CI gates could be validated together. All lockfile/override changes landed through #26.