fix: patch high-severity transitive deps (js-yaml, rollup, sharp, tmp)

[sammdec]

Summary

Adds pnpm overrides to pull patched versions of transitive dependencies flagged with high-severity advisories. All four ship as pnpm.overrides since these are indirect deps.

Package	Before	After	Advisory
js-yaml (4.x)	4.2.0	4.3.0	Quadratic CPU consumption via YAML merge-key chains
rollup	2.79.2	2.80.0	Arbitrary file write via path traversal
sharp	0.34.5	0.35.3	Four inherited libvips CVEs
tmp	0.0.33	0.2.7	Path traversal via unsanitized prefix/postfix

The js-yaml override is scoped to the >=4.0.0 <4.3.0 range so the unaffected 3.x copy is left untouched.

pnpm audit confirms these four advisories are cleared. No source changes — transitive bumps only.

Deferred (not in this PR)

These also have high-severity fixes, but their only patched releases are <7 days old and are held back by the repo's minimumReleaseAge (7-day) supply-chain quarantine. Rather than weaken the quarantine via minimumReleaseAgeExclude, they're deferred until the versions age out:

• fast-uri ≥3.1.4 (host confusion) — published Jul 19, eligible ~Jul 26
• ws ≥8.21.0 (memory-exhaustion DoS + memory disclosure) — published Jul 17, eligible ~Jul 24
• next ≥15.5.21 (App Router DoS + two Server Action SSRFs) — published Jul 23, eligible ~Jul 30

Moderate/low advisories are intentionally out of scope.

Test plan

• pnpm install succeeds; lockfile regenerated
• pnpm audit no longer reports the four patched advisories
• CI green (build + tests validate the sharp/rollup bumps)

🤖 Generated with Claude Code

[odin-by-borg]

Mjolnir Security Review

New commits since last review at 15ea3d3.

---

_{7 PRs reviewed}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
interface	Ready	Preview	Aug 4, 2026 11:07am

[github-actions]

• Ipfs hash: bafybeihon6oukbyj3bzgy4tmt4nu6unqumxofkstpedww4m3k7h5xepl3e
• Ipfs preview link: https://bafybeihon6oukbyj3bzgy4tmt4nu6unqumxofkstpedww4m3k7h5xepl3e.ipfs.cf-ipfs.com/

[github-actions]

📦 Next.js Bundle Analysis for aave-ui

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	1.32 MB (-14 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

[github-actions]

• Ipfs hash: bafybeiduwto3vcaqgsit34z3fgbarcii5z75sqq73jgakk3rvf6njovgaa
• Ipfs preview link: https://bafybeiduwto3vcaqgsit34z3fgbarcii5z75sqq73jgakk3rvf6njovgaa.ipfs.cf-ipfs.com/

[github-actions]

📦 Next.js Bundle Analysis for aave-ui

This analysis was generated by the Next.js Bundle Analysis action. 🤖

🎉 Global Bundle Size Decreased

Page	Size (compressed)
global	1.32 MB (-11 B)

Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!