Satisfy pnpm audit (#34568)

package.json

@@ -46,7 +46,7 @@
         "lodash": "^4.17.21",
         "mermaid": "^11.13.0",
         "minimist": "^1.2.6",
-        "nx": "23.1.0",
+        "nx": "catalog:",
         "oxfmt": "0.59.0",
         "oxlint": "^1.70.0",
         "oxlint-tsgolint": "^7.0.0",

packages/shared-components/src/@types/react-syntax-highlighter.d.ts

@@ -0,0 +1,9 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+*/
+
+// Temporary workaround until https://github.com/storybookjs/storybook/issues/35539 ships
+declare module "react-syntax-highlighter/dist/esm/prism-light";

pnpm-workspace.yaml

@@ -42,6 +42,8 @@ catalog:
     "@vitest/browser-playwright": 4.1.10
     "@vitejs/plugin-react": 6.0.4
     unplugin-dts: 1.0.1
+    # nx
+    nx: 23.1.0
 
 catalogs:
     ts6:
@@ -136,18 +138,32 @@ overrides:
     "@types/node": 25.9.3
     config-file-ts: 0.2.8-rc1
     node-abi: 4.33.0
-    "@types/pg-pool": 2.0.7
+
     # https://github.com/advisories/GHSA-6v5v-wf23-fmfq
     markdown-it: ^14.3.0
     axios@>1.0.0 <=1.16.1: ^1.16.1
     # https://github.com/advisories/GHSA-g7r4-m6w7-qqqr
     esbuild@<=0.27.4: 0.27.4
-    brace-expansion@>=5 <=5.0.5: ^5.0.6
-    ip-address@>=10 <10.1.1: ^10.1.1
+    # https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
+    # https://github.com/advisories/GHSA-mh99-v99m-4gvg
+    # https://github.com/advisories/GHSA-rgw5-rvv9-x895
+    brace-expansion@>=1 <1.1.18: ^1.1.18
+    # https://github.com/advisories/GHSA-rgw5-rvv9-x895
+    # https://github.com/advisories/GHSA-mh99-v99m-4gvg
+    brace-expansion@>=2 <2.1.4: ^2.1.4
+    # https://github.com/advisories/GHSA-rgw5-rvv9-x895
+    brace-expansion@>=5 <=5.0.5: ^5.0.9
+    # https://github.com/advisories/GHSA-mwp4-54f8-5fhr
+    ip-address@>=10 <10.1.1: ^10.3.1
     yaml@>=2 <2.8.3: ^2.8.4
     # https://github.com/advisories/GHSA-f38q-mgvj-vph7
-    protobufjs@7 <7.5.8: ^7.6.3
+    # https://github.com/advisories/GHSA-j3f2-48v5-ccww
+    protobufjs@7 <7.5.8: ^7.6.5
     "@protobufjs/utf8@1 <1.1.1": ^1.1.1
+    # https://github.com/advisories/GHSA-v3r7-h72x-cjcm
+    # https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
+    # https://github.com/advisories/GHSA-8xcm-r25x-g524
+    undici@6 <6.28.0: ^6.28.0
     # https://github.com/advisories/GHSA-vmh5-mc38-953g
     # https://github.com/advisories/GHSA-vxpw-j846-p89q
     # https://github.com/advisories/GHSA-hm92-r4w5-c3mj
@@ -155,14 +171,32 @@ overrides:
     # https://github.com/advisories/GHSA-pr7r-676h-xcf6
     # https://github.com/advisories/GHSA-35p6-xmwp-9g52
     # https://github.com/advisories/GHSA-g8m3-5g58-fq7m
-    undici@7 <7.28.0: ^7.28.0
+    # https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
+    undici@7 <7.28.0: ^7.29.0
+    # https://github.com/advisories/GHSA-m8rv-5g2x-5cg5
+    # https://github.com/advisories/GHSA-8xcm-r25x-g524
+    # https://github.com/advisories/GHSA-4cwx-7wf7-3272
+    undici@8 <8.9.0: ^8.9.0
     # https://github.com/advisories/GHSA-fx2h-pf6j-xcff
     # https://github.com/advisories/GHSA-4w7w-66w2-5vf9
     # https://github.com/advisories/GHSA-v6wh-96g9-6wx3
     # vitepress is the only consumer of vite <8; pin it to a patched vite 6 (it does not support vite 8).
     vitepress>vite: ^6.4.3
-    # Workaround for https://github.com/electron/electron/issues/51619
-    yauzl: "^3.3.1"
+    # https://github.com/advisories/GHSA-c2j3-45gr-mqc4
+    dompurify@3 <=3.4.11: ^3.4.12
+    # https://github.com/advisories/GHSA-v422-hmwv-36x6
+    body-parser@2 <2.3.0: ^2.3.0
+    # https://github.com/advisories/GHSA-g2r8-wvmj-jf5w
+    nx: "catalog:"
+    # https://github.com/advisories/GHSA-r292-9mhp-454m
+    tar@7 <=7.5.20: ^7.5.21
+    # https://github.com/advisories/GHSA-2p49-hgcm-8545
+    svgo@3 <3.3.4: ^3.3.4
+    # https://github.com/advisories/GHSA-2p49-hgcm-8545
+    svgo@4 <4.0.2: ^4.0.2
+    # https://github.com/advisories/GHSA-7p8r-x3mc-p8w7
+    fast-uri@3 <3.1.5: ^3.1.5
+
     # Convince api-extractor to use a newer Typescript version
     "unplugin-dts>typescript": "catalog:ts6"
     "@microsoft/api-extractor>typescript": "catalog:ts6"