fix: patch js-yaml and prune stale overrides

[Shramkoweb]

Summary

• Patch js-yaml advisory 1121859 (<3.15.0, moderate): both parents (gray-matter, @istanbuljs/load-nyc-config) allow ^3.13.1, so an in-range lockfile update to 3.15.0 suffices — no override needed
• Prune 6 redundant pnpm.overrides (hono, @opentelemetry/core, @opentelemetry/resources, @opentelemetry/sdk-trace-base, js-yaml@4, @babel/core@7) — each verified empirically: removed, re-resolved, resolutions unchanged and audit stayed clean
• Keep the 2 load-bearing overrides: @hono/node-server ^1.19.13 (@prisma/dev@0.24.3 shipped by latest prisma@7.8.0 pins vulnerable 1.19.11, advisory 1116281) and postcss ^8.5.10 (latest next@16.2.10 pins vulnerable 8.4.31, advisory 1117015). Side fix: the old postcss override froze the direct dep at a stale 8.5.15; it now resolves to a single 8.5.20 matching package.json

Type

• feat — new feature
• fix — bug fix
• docs — docs only
• style — formatting / whitespace
• refactor — internal restructuring
• perf — performance
• test — tests only
• build — build system / deps
• ci — CI config
• chore — maintenance

Linked spec or plan

None — routine security hygiene pass via the fixing-package-security skill.

Test plan

• pnpm verify:full exits 0 locally
• pnpm audit reports 0 vulnerabilities

Breaking changes

None

Summary by CodeRabbit

• Chores
  • Updated the application framework and development tooling to newer versions.
  • Updated the project’s package manager version.
  • Simplified package version overrides while preserving required compatibility settings.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
portfolio	Ready	Preview	Jul 19, 2026 10:58pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cc3f8f57-f270-4c65-a3c9-1afa13a3cf18

📥 Commits

Reviewing files that changed from the base of the PR and between 1e40e74 and 5b48e0f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

package.json updates Next.js, development dependency versions, and pnpm. Several pnpm override entries are removed while the @hono/node-server and postcss overrides remain.

Changes

Dependency and tooling updates

Layer / File(s)	Summary
Dependency version updates package.json	Updates Next.js, @types/node, PostCSS, and Tailwind CSS versions.
pnpm version and overrides package.json	Updates pnpm from 10.34.4 to 10.34.5 and removes several override entries.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Shramkoweb/Portfolio#486: Updates dependency versions and pnpm overrides in package.json.
• Shramkoweb/Portfolio#501: Updates the pnpm version and override entries in package.json.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: patching js-yaml and removing stale pnpm overrides.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pnpm-overrides-refresh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}