chore(deps): patch Dependabot vulnerabilities via direct bumps and overrides

Upgrade @fastify/static, js-yaml, react-router, and fast-xml-parser, and pin
patched transitive versions (dompurify, brace-expansion, find-my-way, sharp, etc.)
in pnpm-workspace overrides so GitHub Dependabot alerts clear.

Author: Innei

apps/admin/package.json

@@ -87,7 +87,7 @@
     "immer": "11.1.11",
     "jotai": "2.20.2",
     "js-cookie": "3.0.8",
-    "js-yaml": "5.2.1",
+    "js-yaml": "5.2.2",
     "json5": "2.2.3",
     "katex": "^0.17.0",
     "klinecharts": "10.0.0",
@@ -107,7 +107,7 @@
     "react": "19.2.7",
     "react-dom": "19.2.7",
     "react-resizable-panels": "4.12.2",
-    "react-router": "8.2.0",
+    "react-router": "8.3.0",
     "recharts": "3.9.2",
     "shiki": "4.3.1",
     "socket.io-client": "4.8.3",

apps/core/package.json

@@ -63,7 +63,7 @@
     "@earendil-works/pi-ai": "0.82.0",
     "@fastify/cookie": "11.1.1",
     "@fastify/multipart": "10.1.0",
-    "@fastify/static": "10.1.0",
+    "@fastify/static": "10.1.2",
     "@haklex/rich-headless": "0.31.1",
     "@innei/next-async": "0.4.0",
     "@innei/pretty-logger-nestjs": "0.4.2",
@@ -108,7 +108,7 @@
     "inquirer": "^14.0.2",
     "ioredis": "5.11.1",
     "isbot": "5.2.1",
-    "js-yaml": "^5.2.1",
+    "js-yaml": "5.2.2",
     "json5": "2.2.3",
     "jsondiffpatch": "^0.7.6",
     "jsonrepair": "^3.15.0",

packages/cli/package.json

@@ -76,7 +76,7 @@
     "@types/semver": "7.7.1",
     "better-auth": "^1.6.23",
     "effect": "3.22.0",
-    "fast-xml-parser": "5.10.0",
+    "fast-xml-parser": "5.10.1",
     "get-east-asian-width": "^1.6.0",
     "lexical": "^0.48.0",
     "minisearch": "^7.2.0",