build(deps): fix audit vulnerabilities via bumps and overrides

[karrui]

Resolves all pnpm audit and trivy findings (3 critical, 27 high, 32 moderate, 7 low) by combining direct dependency bumps with a small set of caret-bounded transitive overrides.

Direct bumps

• turbo / @turbo/gen 2.6.1 → 2.9.16: the new release drops node-plop, inquirer, ts-node and handlebars entirely, eliminating the tmp / diff / ip-address / handlebars / minimatch@3/@9 / brace-expansion@1/@2 vulnerability chains in one move.
• testcontainers 11.11.0 → 12.0.1: pulls dockerode@5 (drops the uuid dependency) and tightens tmp / undici / archiver to patched ranges, eliminating uuid / undici / tmp / protobufjs / @protobufjs/utf8 / minimatch@5 chains.
• vitest family 4.0.8 → 4.1.8 (catalog): patches the critical Vitest UI server CVE (GHSA-5xrq-8626-4rwp). Added vitest and @vitest/* to minimumReleaseAgeExclude so future security bumps are not blocked by the 24h release-age gate.

Overrides retained (7, all ^-bounded to the parent's major)

Override	Pinned by
@hono/node-server@1, ajv@8, defu@6, effect@3, hono@4	prisma@7.8.0's bundled @prisma/dev / @prisma/config / @prisma/streams-local
lodash@4	chevrotain@10.5.0 hard-pins 4.17.21 (via prisma-kysely → @mrleebo/prisma-ast)
postcss@8	next@16.2.7 still ships postcss@8.4.31

Naturally resolved by the bumps above, no override needed: ws, yaml, fast-uri, qs, path-to-regexp, brace-expansion@5.

Dependabot

Added vitest, playwright, t3-env groups to mirror the existing catalogs; broadened tailwindcss from @tailwindcss/postcss to @tailwindcss/* so @tailwindcss/vite groups with it.

Verification

• pnpm audit → No known vulnerabilities found
• trivy fs --scanners vuln --include-dev-deps → 0 vulnerabilities

[Copilot]

Pull request overview

Updates the monorepo’s Node.js dependency set to address audit-reported vulnerabilities by bumping key direct dependencies, adding/retaining a small set of transitive pnpm overrides, and aligning Dependabot grouping so these security-related packages update together.

Changes:

• Bump Vitest (and related @vitest/*) to 4.1.8 and exempt Vitest from the minimum release age gate for faster security response.
• Bump Turbo tooling and Testcontainers to newer major/minor versions.
• Add/adjust Dependabot groups (Vitest, Playwright, T3 env) and broaden Tailwind group patterns; add security-focused pnpm overrides for selected transitive dependencies.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

File	Description
pnpm-workspace.yaml	Updates Vitest catalog versions, excludes Vitest from release-age gating, and adds transitive security overrides.
package.json	Bumps root dev tooling versions (Turbo, Vitest).
apps/web/package.json	Bumps testcontainers major version used by web app test setup.
.github/dependabot.yml	Adds new dependency update groups and broadens Tailwind patterns to improve update hygiene.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.