chore(deps): resolve 16 of 17 dependency advisories

- next 16.2.6 -> 16.2.11 (4 advisories)
- xlsx: npm's newest (0.18.5) is unpatched; switch to SheetJS's official
  0.20.3 distribution, which the advisories require (same API, no code change)
- override floors for postcss, js-yaml, esbuild, @babel/core, sharp
- brace-expansion deliberately NOT overridden: its 1.x line (minimatch 3.x
  inside eslint) has no patched release and forcing 5.x crashes eslint's
  config-array. Residual advisory is dev-tooling only, no runtime exposure.

pnpm audit: 17 -> 1. typecheck/lint/build green on Next 16.2.11.

package.json

@@ -32,7 +32,7 @@
     "date-fns": "^4.3.0",
     "date-fns-tz": "^3.2.0",
     "lucide-react": "^0.546.0",
-    "next": "^16.2.6",
+    "next": "^16.2.11",
     "next-intl": "^4.12.0",
     "next-themes": "^0.4.6",
     "radix-ui": "^1.4.3",
@@ -42,7 +42,7 @@
     "recharts": "^3.10.0",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
-    "xlsx": "^0.18.5",
+    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "zod": "^4.4.3"
   },
   "devDependencies": {

pnpm-workspace.yaml

@@ -6,4 +6,16 @@ allowBuilds:
   unrs-resolver: true
 
 overrides:
-  postcss: 8.5.15
+  # Security overrides for transitive deps (advisory-patched floors, not exact
+  # pins, so future patches are picked up automatically). Re-check with
+  # `pnpm audit` when bumping next/eslint.
+  postcss: ">=8.5.18"
+  # NOTE: brace-expansion is deliberately NOT overridden. minimatch 3.x (inside
+  # @eslint/eslintrc) needs the 1.x line, which has no patched release; forcing
+  # it to 5.x crashes eslint's config-array (verified). The residual advisory is
+  # dev-tooling only (glob DoS while linting) with no runtime exposure, so the
+  # working linter wins. Revisit when eslint drops minimatch 3.x.
+  js-yaml: ">=4.3.0"
+  esbuild: ">=0.28.1"
+  "@babel/core": ">=7.29.1"
+  sharp: ">=0.35.0"