chore(deps): clear new high advisories via overrides, register unpatched ones

[Jerry-CodeHub]

内容

• 扩展/新增 11 条 pnpm-workspace.yaml 安全 overrides（piscina、proxy-addr、compression、source-map-js、brace-expansion、fast-uri、dompurify、hono、moment、pbkdf2、postcss-selector-parser），清掉今日新披露的 2 critical + 7 high
• braces（GHSA-vfj7-8cjw-p6xm，high，上游无补丁，仅 @umijs/lint 构建链）：auditConfig.ignoreGhsas 登记忽略；sprintf-js（moderate，无补丁，仅测试链）一并登记进 THIRD-PARTY-NOTICES
• dependabot.yml：ignore pdfjs-dist（锁版跟随 react-pdf 内置版本，repo-hygiene 门禁强制一致）与 @ant-design/icons 的 major（待 antd 6 一并评估）

验证

• pnpm audit --prod --audit-level=high 退出码 0（余 7 条 moderate/low 均已登记接受）
• pnpm check 全过（typecheck + lint + 122 tests）

解除 #21/#22/#34 共同的 audit 阻塞。

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 380da76b-f21a-4e2f-a126-283b54f5ad92

📥 Commits

Reviewing files that changed from the base of the PR and between 1aa702c and e9d9ad9.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• .github/dependabot.yml
• THIRD-PARTY-NOTICES.md
• pnpm-workspace.yaml

 ________________________________________________
< PENDU: Prompt Engineered Nifty Debugging Unit. >
 ------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}