fix: upgrade vulnerable dependencies

[luojiyin1987]

Closes #109

Summary

• Add pnpm overrides for four vulnerable transitive dependencies.
• Refresh the lock file with patched dependency versions.
• Resolve all findings from pnpm audit --prod.

Security impact

• Upgrade postcss to 8.5.25.
• Upgrade sharp to 0.35.3.
• Upgrade serialize-javascript to 7.0.7.
• Upgrade brace-expansion to 5.0.9.

GitHub currently reports four open alerts on the default branch.
These changes address the affected postcss and sharp versions.

Checks

• pnpm install --frozen-lockfile passed.
• pnpm audit --prod passed with no known vulnerabilities.
• pnpm exec tsc --noEmit passed.
• pnpm exec eslint . found 62 existing errors in unchanged source files.
• pnpm run build compiled the application successfully.
• Static generation failed because the external /NGO data service returned HTTP 402.
• The external service reported DEPLOYMENT_DISABLED.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (5)

• package.json is excluded by none and included by none
• patches/next@16.3.0.patch is excluded by none and included by none
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !pnpm-lock.yaml and included by none
• pnpm-workspace.yaml is excluded by none and included by none
• tsconfig.json is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f1ad581d-2d24-411e-9962-d77b61a8d48a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dosubot]

📄 Knowledge review

Dosu skipped reviewing this PR because your organization has used its 200 included credits for the month. Your usage will reset on 2026-09-01. To have Dosu review this PR before then, ask your organization admin to upgrade to a pro account.

---

[TechQuery]

• Upgrade sharp to 0.35.3.

这个在项目整体依赖包升级（pnpm up 命令）之后就自动升级了。

• Upgrade serialize-javascript to 7.0.7.
• Upgrade brace-expansion to 5.0.9.

这两个包相比之前都是跨多个版本的大版本升级，请确认 API 是否兼容，否则就升级到同一大版本的最新小版本。

[luojiyin1987]

已确认这两个跨主版本升级，结论如下。

1. serialize-javascript@7.0.7 与现有调用兼容。rollup-plugin-terser@7.0.2 仍能取得函数导出。序列化冒烟测试和生产构建均通过。因此保留该 override，用于修复 GHSA-5c6j-r48x-rmvq。

2. brace-expansion@5.0.9 与旧版 minimatch 不兼容。minimatch@3.1.5 和 minimatch@5.1.9 处理花括号模式时会报 TypeError: expand is not a function。因此移除该全局 override。锁文件现在分别使用兼容版本：

   • minimatch@3.1.5 → brace-expansion@1.1.18
   • minimatch@5.1.9 → brace-expansion@2.1.4
   • minimatch@10.2.6 → brace-expansion@5.0.9

修正提交：8d646d5。

验证结果：

• pnpm install --frozen-lockfile 通过。
• pnpm audit --prod 未发现漏洞。
• pnpm exec tsc --noEmit 通过。
• pnpm run build 通过。