override and update deps with security issues

.changeset/crisp-dolls-go.md

@@ -0,0 +1,8 @@
+---
+"@opennextjs/aws": patch
+---
+
+override and update deps with security issues
+
+- bumps express version used for the express-dev wrapper.
+- overrides patch versions used for qs, brace-expansion, and nanoid.

.github/actions/setup/action.yml

@@ -27,7 +27,7 @@ runs:
     # Install pnpm. https://github.com/pnpm/action-setup
     - uses: pnpm/action-setup@v4
       with:
-        version: 9
+        version: 10
         # run_install: false
 
     # Get pnpm store path so we can cache it

.github/workflows/e2e.yml

@@ -90,7 +90,7 @@ jobs:
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 10
 
       - name: Set up NodeJS
         uses: actions/setup-node@v4

packages/open-next/package.json

@@ -50,7 +50,7 @@
     "chalk": "^5.6.2",
     "cookie": "^1.0.2",
     "esbuild": "catalog:",
-    "express": "^5.1.0",
+    "express": "^5.2.1",
     "path-to-regexp": "^6.3.0",
     "urlpattern-polyfill": "^10.1.0",
     "yaml": "^2.8.1"