fix(deps): bump transitive npm deps for security advisories

[tobyhede]

Summary

Security updates for transitive npm dependencies.

Package	From	To	Advisories	How
sharp (+ @img/sharp-*, libvips 1.3.0 -> 1.3.3)	0.35.0	0.35.4	GHSA-rgj7-g3m4-5g8c (#210)	existing override sharp@<0.35.0: 0.35.0 raised to sharp@<0.35.4: 0.35.4
fast-uri	3.1.5	3.1.6	CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172 (#198)	existing override raised to fast-uri@<3.1.6: 3.1.6
js-yaml 3.x	3.15.1	3.15.2	CVE-2026-84375 (#211)	existing override raised to js-yaml@<3.15.2: 3.15.2
js-yaml 4.x	4.3.1	4.3.2	CVE-2026-84375 (#211)	existing override js-yaml@>=4.0.0 <5 pin raised to 4.3.2
qs	6.15.3	6.16.0	CVE-2026-82417, CVE-2026-82562 (#201)	lockfile only
hono	4.13.2	4.13.7	CVE-2026-84363, CVE-2026-84364, CVE-2026-84365 (#205)	lockfile only
mysql2	3.16.0	removed	GHSA-3f6p-5ww8-9rcr, GHSA-rgwj-5xj2-c3m3 (#197)	lockfile only (see below)

Notes:

• Existing exact-pin overrides: the four existing pins were holding sharp, fast-uri and js-yaml at vulnerable versions. Each selector ceiling is raised together with its pin, following the rule in pnpm-workspace.yaml.
• No new overrides: e2e/tests/supply-chain.e2e.test.ts caps overrides at 12, and there are 11. qs, hono and mysql2 are fixed in the lockfile only, with no new override entries. pnpm update --depth Infinity would also have bumped unrelated packages (express-rate-limit, ip-address, negotiator, jose, lru.min), so it wasn't used.
• mysql2: it was only in the tree as drizzle-orm's optional peer (peerDependenciesMeta.mysql2.optional), and nothing in the workspace uses MySQL. On re-resolve, pnpm no longer installs that optional peer, so mysql2 and its own dependencies (aws-ssl-profiles, denque, generate-function, is-property, long, lru.min, named-placeholders, seq-queue, sqlstring) drop out of the lockfile.
• @types/node peer: sharp 0.35.4 declares an optional @types/node peer. That's why next@15.5.23, @clerk/nextjs and evlog snapshot keys now include (@types/node@26.2.0), which is already in the lockfile. No version changes come from it.
• Release age: all targets were published more than 7 days ago, so minimumReleaseAge is satisfied.
• Lockfile overlap: this PR is independent of the next 15.5.24 PR. Whichever merges second may need its lockfile regenerated (pnpm install --lockfile-only) because both touch the next@15.5.x(...) snapshot keys.

Verification (pnpm 10.33.2)

• pnpm install --frozen-lockfile succeeds
• The lockfile resolves only sharp 0.35.4, fast-uri 3.1.6, js-yaml 3.15.2 and 4.3.2, qs 6.16.0 and hono 4.13.7, with no mysql2 package
• e2e/tests/supply-chain.e2e.test.ts: 26/26 pass, including the override-count cap and "every security override actually took effect"
• turbo run build for wizard, nextjs and stack-drizzle (and their deps): all succeed
• packages/wizard: typecheck passes; tests pass (366 pass, 5 skipped)
• packages/nextjs: tests pass (25)
• packages/stack-drizzle: tests pass (371)
• pnpm changeset status runs cleanly on js-yaml 3.15.2 and 4.3.2

[changeset-bot]

⚠️ No Changeset found

Latest commit: 157c24a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[auxesis]

Thanks @tobyhede!