chore: patch vulnerable dependencies

Upgrade next to 15.5.28 (clears 2 critical RCE advisories plus the SSRF,
middleware-bypass and cache-poisoning set), sharp to 0.35.5, sass,
@typescript-eslint/*, eslint-config-next and react-icons within their
current majors. Add pnpm overrides to force patched transitives
(js-yaml, flatted, brace-expansion, minimatch, postcss).

Audit goes from 63 advisories (2 critical, 38 high) to 1 high with no
upstream fix available.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

package.json

@@ -17,27 +17,27 @@
     "animejs": "^3.2.2",
     "aos": "^2.3.4",
     "eslint": "8.57.1",
-    "eslint-config-next": "15.5.12",
+    "eslint-config-next": "15.5.28",
-    "next": "^15.5.12",
+    "next": "^15.5.28",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
-    "react-icons": "^5.5.0",
+    "react-icons": "^5.7.0",
     "react-transition-group": "^4.4.5",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.5",
     "typescript": "5.9.3"
   },
   "devDependencies": {
-    "@next/eslint-plugin-next": "^15.5.12",
+    "@next/eslint-plugin-next": "^15.5.28",
-    "@types/aos": "^3.0.7",
+    "@types/aos": "^3.0.8",
     "@types/node": "^20.19.33",
     "@types/react": "^18.3.28",
     "@types/react-dom": "^18.3.7",
     "@types/react-transition-group": "^4.4.12",
-    "@typescript-eslint/eslint-plugin": "^8.56.0",
+    "@typescript-eslint/eslint-plugin": "^8.72.0",
-    "@typescript-eslint/parser": "^8.56.0",
+    "@typescript-eslint/parser": "^8.72.0",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^5.2.0",
-    "sass": "^1.97.3"
+    "sass": "^1.105.2"
   },
   "engines": {
     "node": ">=18.0.0",
@@ -45,7 +45,11 @@
   },
   "pnpm": {
     "overrides": {
-      "minimatch": ">=10.2.1"
+      "js-yaml": ">=4.3.2",
+      "flatted": ">=3.4.2",
+      "brace-expansion": ">=5.0.12",
+      "minimatch": ">=10.2.3",
+      "postcss": ">=8.5.23"
     }
   }
 }