deps(dashboard): settle the transitive advisory tail in one pass

[blitzcrieg1]

Replaces #93, #89 and #72, which could not converge.

Why not just merge the Dependabot PRs

Four packages, four PRs, one lockfile. Every merge invalidated the others: the remaining three went BLOCKED, rebased to CLEAN, then went BLOCKED again the moment one landed. Three more rebases would have raced identically.

What this does

@hono/node-server, brace-expansion and fast-uri are all transitive with no parent release available, so they are pinned forward with overrides once, together:

Package	Resolved
@hono/node-server	1.19.17
brace-expansion	5.0.9
fast-uri	3.1.5

postcss is a direct devDependency and could not be overridden while the manifest said ^8, so it moves to ^8.5.23 there instead.

The one that stays open, and why

postcss keeps an alert, and the reason belongs in the file rather than as an unexplained red row.

next@15.5.21 pins postcss to exactly 8.4.31 and bundles its own copy:

postcss@8.4.31
node_modules/next/node_modules/postcss
  postcss@"8.4.31" from next@15.5.21

Forcing a version past a framework's exact pin is how a build breaks in a way nobody traces back to a dependency file. Dependabot's own answer was #91, which took Next 16 along with it: the third time today a major framework migration has arrived attached to an unrelated advisory, and the third time it has been declined.

This is build-time tooling in a static export. It goes when Next 16 goes, deliberately.

Recorded in the file

overridesNote now carries both decisions and the removal condition for each, so the next person finds the reasoning without going through git log.

Verified

• npm ci from a clean slate: lockfile in sync
• tsc --noEmit clean, lint clean
• 99 tests pass
• Static export builds both routes

🤖 Generated with Claude Code