fix(deps): take the fix for the four OSV advisories blocking every manifest PR

pnpm-workspace.yaml

@@ -295,3 +295,36 @@ overrides:
   #     `<3.3.17`, which would self-invalidate the day 3.3.17 is itself flagged
   #     (the undici 7.28.0 / brace-expansion 5.0.8 specimens, #4961 / #5032).
   'nanoid@<4.0.0': '^3.3.17'
+  # OSV 2026-09-02 (#14639) — four advisories, every one naming a fixed
+  # version, so this is the "take the fix" path osv-scanner.toml's own header
+  # describes and NOT an exemption; that ledger holds zero entries and the
+  # triage ruling is that it stays at zero.
+  #   @xmldom/xmldom GHSA-6gmq-8vp8-gcm6 (6.3 medium) — flagged on BOTH
+  #     resolved lines: 0.8.13 (fixed 0.8.15) and 0.9.11 (fixed 0.9.12). That
+  #     is why this needs TWO selectors and not one. A single lower-bounded
+  #     selector at the fixed 0.9.12 would drag the 0.8 consumers across a 0.x
+  #     MINOR — the compatibility boundary for a 0.x package — past every
+  #     range they declare. Measured dependents and their declared ranges:
+  #       0.8.13 <- @authenio/xml-encryption@2.0.2 (^0.8.6),
+  #                 samlify@2.13.1 (^0.8.11), xml-crypto@6.1.2 (^0.8.10)
+  #       0.9.11 <- @better-auth/sso@1.7.2 (^0.9.10)
+  #     Each of those ranges already admits its own fixed version, so both
+  #     entries are a dedupe onto the patched line rather than a forced
+  #     upgrade past what a dependent supports — the dompurify / nanoid shape
+  #     above, and the reason no dependent manifest has to move in lockstep.
+  #   qs GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx (6.3 medium each) — one
+  #     resolved line, 6.15.3, fixed 6.16.0. Dependents body-parser@2.3.0
+  #     (^6.15.2) and express@5.2.1 (^6.14.0) both admit it.
+  #   Transitive-only, like dompurify and nanoid above: no workspace manifest
+  #     declares either package, so there is no publishable declared range to
+  #     keep in lockstep and check-override-consistency.mjs lists both as
+  #     overrides it cannot cross-check against a declared range. That is
+  #     correct for this shape, and it is a report, never a failure.
+  #   Bounds sit at the compatibility boundary — 0.9.0 and 0.10.0 for the two
+  #     0.x lines, 7.0.0 for qs — per this block's header rule, never at the
+  #     fixed version itself, which would self-invalidate the day that version
+  #     is the one flagged (the undici 7.28.0 / brace-expansion 5.0.8
+  #     specimens, #4961 / #5032).
+  '@xmldom/xmldom@>=0.8.0 <0.9.0': '^0.8.15'
+  '@xmldom/xmldom@>=0.9.0 <0.10.0': '^0.9.12'
+  'qs@>=6.0.0 <7.0.0': '^6.16.0'