fix(deps): bump vulnerable dependencies

[simeng-li]

Summary

Resolve the open pnpm audit / Dependabot findings. pnpm audit goes from 79 advisories to 3. None of the 3 is reachable from this repo; they are listed under "Not fixed" below. No published runtime dependency of @logto/rn changes.

What changed

• Direct bumps, same major version:
  • packages/rn: vitest ^3.1.1 → ^3.2.6 (resolves 3.2.7). Fixes critical GHSA-5xrq-8626-4rwp.
  • packages/rn-sample: @babel/core ^7.25.2 → ^7.29.6 (resolves 7.29.7). Fixes GHSA-4x5r-pxfx-6jf8.
• Root pnpm.overrides, normalized:
  • Overlapping entries for a package are merged into one entry per major version. Different majors stay separate (e.g. ws 6/7/8, brace-expansion 1/2/5, minimatch 3/9/10).
  • Every >= value is capped with ^, so an override can no longer jump a major.
  • Keys are sorted alphabetically.
• New or raised override floors:
  • @xmldom/xmldom 0.8.15
  • shell-quote 1.10.0
  • js-yaml 4.3.2
  • lodash 4.18.1
  • ws 7.5.13 and 8.22.0
  • node-forge 1.4.0
  • postcss 8.5.28
  • nanoid 3.3.19
  • fast-uri 3.1.8
  • browserslist 4.29.1
  • baseline-browser-mapping 2.11.26
  • @babel/plugin-transform-modules-systemjs 7.29.8
  • ajv 6.15.0
  • patch releases of minimatch, picomatch, brace-expansion, flatted, yaml, colord and postcss-selector-parser
• vite 5.4.21 → 6.4.3: a major bump, but vite is only used by vitest, and vitest 3.2 officially supports vite 6.

Reviewer notes

• The exact ajv 6.12.6 pins for eslint (eslint@8.57.1>ajv, @eslint/eslintrc@2.1.4>ajv) are replaced by ajv@<6.14.0: ^6.14.0. eslint stays on ajv 6 and gets the patched release.
• The old minimatch@>=9.0.0 <9.0.6: ">=9.0.6" was unbounded. It resolved @typescript-eslint/typescript-estree, which declares minimatch ^9.0.4, to minimatch 10. With the ^9.0.6 cap it gets 9.0.9 again.
• All target versions support Node 22.14. Release notes were checked for each bump; no breaking change affects APIs this repo uses.

Not fixed

• vitest / @vitest/mocker (GHSA-82fw-gwwq-j7x9, moderate)
  • The fix requires vitest 4; that will come in a follow-up PR.
  • Unauthenticated exploitation needs the public mockerPlugin/interceptorPlugin on a dev server. Tests here run in node mode with watch: false.
• uuid 7.0.3 (GHSA-w5hq-g745-h8pq, moderate)
  • The fix is uuid 11, four majors up. Expo's xcode dependency still requires uuid ^7.
  • The flaw is in v3/v5/v6 with a caller-supplied buffer, while xcode only calls uuid.v4(), so it is not reachable.

Testing

Tested locally

Checklist

• .changeset
• unit tests
• integration tests
• necessary TSDoc comments