Dependency audit failing on main #522

The weekly dependency audit failed on main: https://github.com/devresponse/devresponsekit/actions/runs/38208554868

Failing:

• the app's lockfile (pnpm audit --audit-level high)
• GitHub's Dependabot alerts: an open high/critical alert (listed in the run log)

No commit changed the tree — a new high/critical advisory landed against a
dependency already on main. Bump (or floor via pnpm.overrides) the
affected package in the tree named above (for an alert, the run log names
the manifest); see SECURITY.md → Dependency advisory allowlist.