chore(deps): resolve 22 open Dependabot security alerts

[chtnnh]

Summary

Resolves all 22 open Dependabot security alerts:

• next → ^15.5.21 (multiple high/medium CVEs)
• drizzle-orm → ^0.45.2 (SQL injection fix in sql.identifier() / sql.as())
• Transitive overrides in pnpm-workspace.yaml: postcss ≥8.5.23, sharp ≥0.35.0, undici ≥7.29.0, esbuild ≥0.25.0

Supersedes Dependabot PR #5.

Test plan

• pnpm typecheck
• pnpm ci:quality
• pnpm test:unit (36 tests)
• pnpm ci:build
• CI green on PR (quality, build, unit, db, test, visual)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
together-web	Ready	Preview	Aug 7, 2026 6:46pm

[cursor]

PR Summary

Medium Risk
Touches the web framework, ORM, and image/HTTP tooling used in dev and production builds; behavior should be patch-level but warrants normal CI and smoke testing.

Overview
Addresses open Dependabot alerts by bumping direct dependencies and forcing minimum versions on vulnerable transitive packages.

apps/web upgrades Next to ^15.5.21 and drizzle-orm to ^0.45.2. packages/db aligns drizzle-orm to the same version (includes the SQL identifier/as injection fix).

pnpm-workspace.yaml adds workspace overrides so the lockfile resolves esbuild (≥0.25.0), postcss (≥8.5.23), sharp (≥0.35.0), and undici (≥7.29.0) across the monorepo. The lockfile refresh pulls in matching Next SWC packages, sharp 0.35.x, newer postcss/undici, and drops older esbuild 0.18.x from the tree where overrides apply.

^{Reviewed by Cursor Bugbot for commit 026afbf. Bugbot is set up for automated code reviews on this repo. Configure here.}