Upgrade next to 15.5.28 (clears 2 critical RCE advisories plus the SSRF,
middleware-bypass and cache-poisoning set), sharp to 0.35.5, sass,
@typescript-eslint/*, eslint-config-next and react-icons within their
current majors. Add pnpm overrides to force patched transitives
(js-yaml, flatted, brace-expansion, minimatch, postcss).
Audit goes from 63 advisories (2 critical, 38 high) to 1 high with no
upstream fix available.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>