osv-scanner reported 13 high or critical advisories in pnpm-lock.yaml on
main. This moves every one that has a fixed release onto it:

- @modelcontextprotocol/sdk 1.29.0 -> 1.32.0 (server, GHSA-22jm-h49p-29qw)
- dompurify 3.4.16 -> 3.4.17 (web, GHSA-cg2g-xh64-v4q7)
- sharp 0.35.4 -> 0.35.5 (marketing and scripts, GHSA-wq5f-xc86-pv6w)
- seroval 1.5.4 -> 1.7.0 (TanStack Router, GHSA-p6vx-979v-rg4c)
- shell-quote 1.10.0 -> 1.12.0 (react-devtools-core, GHSA-pqg4-j6r4-53mv)
- proxy-addr 2.0.7 -> 2.0.8 (express, GHSA-jqcg-44mw-7w3h)
- source-map-js 1.2.1 -> 1.2.2 (magicast, GHSA-68fv-2mgg-jv7q)
- path-to-regexp 6.1.0 -> 6.3.0 (@vercel/routing-utils, GHSA-9wv6-86v2-598j)

The transitive bumps stay inside their parents' ranges. The exception is
@vercel/routing-utils, which pins path-to-regexp 6.1.0 exactly, so it gets
an override.

Still open: braces, node-forge and http-cache-semantics have no fixed
release, and uuid 7.0.3 under Expo's xcode needs a major bump.

Done with Claude Opus 5.5 in Claude Code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>