chore(deps): OSV batch — clear all 21 known vulnerabilities across 8 packages (#3614)

Direct bumps (published manifests, so downstream installs get the fixes):
- apps/docs: next 16.2.10 → 16.2.11 (9 advisories incl. GHSA-6gpp-xcg3-4w24,
  GHSA-89xv-2m56-2m9x, GHSA-m99w-x7hq-7vfj, GHSA-p9j2-gv94-2wf4)
- create-objectstack: tar ^7.5.20 → ^7.5.21 (GHSA-r292-9mhp-454m)
- metadata: js-yaml ^5.2.1 → ^5.2.2 (GHSA-pm4m-ph32-ghv5)

Workspace overrides for transitive-only advisories (no publishable package
declares these, so the override-consistency gate is unaffected):
- brace-expansion >=5.0.0 <5.0.8 → ^5.0.8 (via minimatch@10.x, GHSA-mh99-v99m-4gvg)
- sharp <0.35.0 → ^0.35.0 (next optionalDep ^0.34.5 excludes the fix,
  GHSA-f88m-g3jw-g9cj)
- react-router <8.3.0 → ^8.3.0 (GHSA-qwww-vcr4-c8h2 has no 7.x fix;
  fumadocs-core peer allows 8.x)
- @sveltejs/kit <2.69.1 → ^2.69.1 (better-auth optional peer,
  GHSA-866w-xmhq-wj7x / GHSA-wqjv-9729-c5q2)
- @hono/node-server <2.0.5 → ^2.0.10 (GHSA-frvp-7c67-39w9 has no 1.x fix;
  @modelcontextprotocol/sdk only imports getRequestListener, still exported
  by 2.x — dedupes onto the workspace's existing 2.0.10)

react-router and @sveltejs/kit were optional peers pulled in by auto-install;
re-resolution drops them from the graph entirely (the overrides remain as
guards against future reintroduction).

Verified: turbo build 72/72, turbo test 131/131, docs build + types:check
(sharp 0.35.3 og-image generation exercised), check-override-consistency and
check-changeset-fixed gates, MCP streamableHttp import smoke against
node-server 2.0.10, and OSV querybatch over all 1453 lockfile packages — zero
known vulnerabilities.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

.changeset/osv-batch-2026-07-dep-bumps.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/create-objectstack": patch
+"@objectstack/metadata": patch
+---
+
+chore(deps): OSV security batch — bump tar to ^7.5.21 (GHSA-r292-9mhp-454m) and
+js-yaml to ^5.2.2 (GHSA-pm4m-ph32-ghv5)
+
+Both are declared-range bumps to the patched releases, so downstream installs
+resolve the fixed versions from the published manifests, not just this
+workspace's lockfile. The same batch clears the remaining transitive advisories
+(next 16.2.11 in apps/docs; workspace overrides for brace-expansion, sharp,
+react-router, @sveltejs/kit, @hono/node-server) — those live in pnpm-workspace.yaml
+and the private docs app, which do not ship.

apps/docs/package.json

@@ -18,7 +18,7 @@
     "fumadocs-ui": "16.11.5",
     "lucide-react": "^1.25.0",
     "mermaid": "^11.16.0",
-    "next": "16.2.10",
+    "next": "16.2.11",
     "next-themes": "^0.4.6",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",

packages/create-objectstack/package.json

@@ -22,7 +22,7 @@
   "dependencies": {
     "chalk": "^5.6.2",
     "commander": "^15.0.0",
-    "tar": "^7.5.20"
+    "tar": "^7.5.21"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

packages/metadata/package.json

@@ -51,7 +51,7 @@
     "@objectstack/types": "workspace:*",
     "chokidar": "^5.0.0",
     "glob": "^13.0.6",
-    "js-yaml": "^5.2.1",
+    "js-yaml": "^5.2.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {