security: close the last 5 advisories via verified resolution overrides

[Ndevu12]

Takes open Dependabot alerts from 5 to 0.

I previously argued against resolutions for these. That was the right default but the wrong final answer — I had not actually tested whether the forced versions work. I have now, and they do, so here they are with the evidence.

Why a bump could not fix these

All five are pinned by an upstream package rather than declared in any manifest here, so there is no floor to raise:

Alert	Package	Pinned by
#50	esbuild	tsup@8.5.1 (latest) declares esbuild@^0.27.0 — cannot reach patched 0.28.1
#24 #102 #104	postcss	next depends on exactly postcss@8.4.31
#87	sharp	next declares sharp@^0.34.5; fix is 0.35.0, outside the range

I checked next@16.2.12 (latest, a major upgrade): it still pins postcss@8.4.31. So even upgrading Next by a major would not have closed those three.

The overrides, and what verified them

Root — esbuild: ^0.28.1. Forcing this collapses the tree to a single esbuild copy (0.27.7 is gone entirely). The risk was that tsup and tsx, which declared ^0.27.0 / ~0.27.0, would break against 0.28. They do not:

• yarn build — tsup compiles the library (CJS + ESM + DTS)
• yarn clean — a tsx-executed script runs
• yarn build-storybook — succeeds
• yarn test:coverage — 286 tests pass, 92.9% statements / 84.1% branches
• yarn typecheck, yarn lint, yarn format:check — clean

examples/nextjs-demo — postcss: ^8.5.25, sharp: ^0.35.3. The risk was Nexts CSS pipeline depending on postcss 8.4.31 internals. It does not:

• yarn build — compiles successfully, prerenders all 3 static pages

These are liabilities, and the PR says so

An override forces a version upstream never tested against. Left undocumented that is exactly the debt worth avoiding, so SECURITY.md now carries a Dependency overrides section recording, for each entry: what pins the package, which advisory it answers, the precise condition for removing it, and the commands to check whether upstream has caught up:

npm view tsup dependencies.esbuild
npm view next dependencies.postcss optionalDependencies.sharp

They should be deleted the moment tsup ships against esbuild@^0.28 and next moves off postcss@8.4.31.

Verification of the outcome

Cross-checking every open alert against the resulting lockfiles:

Open alerts RESOLVED by this branch: 5
Still vulnerable: 0

Plus the standing invariant, re-run: every direct dependency across all four manifests still declares a floor at or above its patched version.