Override transitive vulns: postcss, ip-address, fast-uri, hono

Patches 11 open Dependabot alerts in dependencies pulled in through
the shadcn CLI tree (shadcn → @modelcontextprotocol/sdk →
@hono/node-server, express-rate-limit, ajv-formats, …). These aren't
loaded by the running Next.js app — they only execute when you invoke
the shadcn CLI — but the alerts still surface in GitHub's UI, so it's
cleaner to pin them.

Uses npm `overrides` to force the patched version regardless of what
the upstream MCP SDK happens to request:

  postcss     ^8.5.10   — XSS via unescaped </style>
                          (GHSA-qx2v-qp2m-jg93, medium)
  ip-address  ^10.1.1   — XSS in Address6 HTML-emitting methods
                          (GHSA-v2v4-37r5-5v8g, medium)
  fast-uri    ^3.1.2    — path traversal + host confusion via
                          percent-encoded segments / authority
                          delimiters (GHSA-q3j6-qgpj-74h6 high,
                          GHSA-v39h-62p7-jpjc high)
  hono        ^4.12.18  — JSX HTML injection, bodyLimit bypass,
                          Cache middleware Vary leak, CSS injection
                          via style objects, JWT NumericDate
                          validation (GHSA-69xw-7hcm-h432 / 9vqf-7f2p-gf9v
                          / p77w-8qqv-26rm / qp7p-654g-cw7p /
                          hm8q-7f3q-5f36, low–medium)

After overrides:
  postcss     8.5.14   (was nested 8.4.31 inside next + top 8.5.14)
  ip-address  10.2.0   (was 10.1.0)
  fast-uri    3.1.2    (was 3.1.0)
  hono        4.12.19  (was 4.12.14)

Verified locally:
  npm run lint    — 0 errors (23 pre-existing warnings)
  npm run typecheck — clean
  npm test         — 89/89 passed
  npm run build    — succeeded

Pair this with #93 (next 16.2.6 bump) to clear all 22 alerts. Each PR
is independently revertible.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

package-lock.json

@@ -5685,9 +5685,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.0",
+      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
       "funding": [
         {
           "type": "github",
@@ -6274,9 +6274,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.14",
+      "version": "4.12.19",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.14.tgz",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.19.tgz",
-      "integrity": "sha512-am5zfg3yu6sqn5yjKBNqhnTX7Cv+m00ox+7jbaKkrLMRJ4rAdldd1xPd/JzbBWspqaQv6RSTrgFN95EsfhC+7w==",
+      "integrity": "sha512-xa3eYXYXx68XTT4hZ7dRzsXBhaq85ToSrlUJNoR0gwz/1Ap/CNwX47wfvV7pc/xWhjKVVkLT7zBJy8chhNguqQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -6406,9 +6406,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.1.0",
+      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -7872,34 +7872,6 @@
         }
       }
     },
-    "node_modules/next/node_modules/postcss": {
-      "version": "8.4.31",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
-      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "nanoid": "^3.3.6",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
     "node_modules/node-domexception": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",

package.json

@@ -69,5 +69,11 @@
     "tailwindcss": "^4",
     "typescript": "^6",
     "vitest": "^4.1.6"
+  },
+  "overrides": {
+    "postcss": "^8.5.10",
+    "ip-address": "^10.1.1",
+    "fast-uri": "^3.1.2",
+    "hono": "^4.12.18"
   }
 }