Fix Dependabot CVEs in transitive dependencies

[asutermo]

Summary

• Raise pnpm override floor for hono to 4.12.25 to address CVE-2026-47673, CVE-2026-47674, CVE-2026-47675, and CVE-2026-47676.
• Raise pnpm override floor for brace-expansion to 5.0.6 to address CVE-2026-45149.
• Regenerate pnpm-lock.yaml with patched transitive versions.

Verification

• pnpm audit --json (0 vulnerabilities)
• pnpm install --frozen-lockfile
• pnpm --filter @freeplayai/vercel build
• pnpm --filter './packages/vercel/examples/node/server' build
• pnpm --filter './packages/vercel/examples/node/client' build
• pnpm --filter './packages/vercel/examples/next' build
• pnpm typecheck

Notes

• pnpm build still has an existing recursive ordering race where examples can compile before @freeplayai/vercel finishes emitting declaration files; the ordered filtered build passes.

  

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/brace-expansion	5.0.6	🟢 7.3	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 11 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 4 Found 9/22 approved changesets -- score normalized to 4 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/hono	4.12.25	Unknown	Unknown

Scanned Files

• pnpm-lock.yaml