fix: upgrade vulnerable dependencies

[luojiyin1987]

Problem

GitHub reports four open Dependabot alerts on the default branch.
The alerts affect the transitive postcss and sharp dependencies.

The current lock file also contains vulnerable serialize-javascript and brace-expansion versions.

Required changes

• Add pnpm overrides for all four affected dependencies.
• Refresh the pnpm lock file.
• Confirm that the production dependency audit reports no known vulnerabilities.
• Run the TypeScript check and production build.

Acceptance criteria

• pnpm audit --prod reports no known vulnerabilities.
• The lock file resolves postcss to 8.5.18
• The lock file resolves sharp to 0.35.0 .
• The lock file contains patched serialize-javascript and brace-expansion versions.