[Chore] Patch vulnerable runtime dependencies

[roomote-roomote]

Created by Roomote. Follow up by mentioning @roomote-roomote or in the web UI.

What changed

• Updated Hono from 4.12.27 to 4.12.34 across the API, worker, and BullMQ services.
• Updated the shared dependency resolution to undici 7.29.0, ip-address 10.3.1, fast-uri 3.1.5, PostCSS 8.5.23, and the patched brace-expansion lines 1.1.18, 2.1.4, and 5.0.9.
• Refreshed the pnpm lockfile while leaving the workspace's minimum-release-age policy unchanged.

Why this change was made

The previous dependency graph contained 15 known vulnerabilities, including network-boundary bypasses, request parsing and cache disclosure issues, denial-of-service risks, and unsafe source-map loading.

Impact

There is no intended user-facing behavior change. Running services and web builds now resolve the patched dependency versions, while keeping the update limited to the affected security bundle.

Frozen installs use the committed patched resolutions without bypassing the release-age policy. Dependency operations that force re-resolution may temporarily reject these releases until they pass the existing maturation window.

The frozen install, static checks, affected service test suites, production web build, and live API health check pass. The full test run reached 2,712 passing web tests but hit unrelated five-second timeouts under sandbox load; the timed-out files passed when rerun with a larger timeout.

[roomote-community]

No code issues found. See task

• package.json:143 The brace-expansion@<1.1.17 override still resolves 1.1.17, but the current advisory affects all versions below 1.1.18. Update this selector and target version so the PR does not leave @bull-board/hono's production dependency vulnerable.
• package.json:145 The 5.x brace-expansion override still leaves 5.0.8 in the production graph, while the current advisory is patched only in 5.0.9 or newer. Extend the override to force the patched release for the Sentry/Fastify path.

_{Reviewed e63c08f}

[roomote-roomote]

Removed the dependency-specific minimum-release-age exclusions and kept the patched versions pinned only in the lockfile. Frozen installation and repository checks pass with the existing release-age policy unchanged. See task · Commit 3fd8c5c

[roomote-roomote]

Updated the 1.x and 5.x brace-expansion overrides to 1.1.18 and 5.0.9, removing both vulnerable resolutions identified by review while retaining 2.1.4 for the patched 2.x line. See task · Commit e63c08f