deps: merge main dependency bumps into pnpm branch

Merge origin/main and refresh the pnpm lockfile with updates
from Dependabot: @babel/core, vite, dompurify, shell-quote,
js-yaml, and i18next-fs-backend.

Exempt js-yaml@4.3.0 from minimumReleaseAge until it matures.

Author: mrTuomoK

apps/events-helsinki/package.json

@@ -154,7 +154,7 @@
     "sync-directory": "6.0.5",
     "testcafe": "^3.7.4",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vite-plugin-css-injected-by-js": "3.5.2",
     "vitest": "4.1.2",
     "vitest-axe": "0.1.0",

apps/hobbies-helsinki/package.json

@@ -154,7 +154,7 @@
     "sync-directory": "6.0.5",
     "testcafe": "^3.7.4",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vite-plugin-css-injected-by-js": "3.5.2",
     "vitest": "4.1.2",
     "vitest-axe": "0.1.0",

apps/sports-helsinki/package.json

@@ -162,7 +162,7 @@
     "sync-directory": "6.0.5",
     "testcafe": "^3.7.4",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vite-plugin-css-injected-by-js": "3.5.2",
     "vitest": "4.1.2",
     "vitest-axe": "0.1.0",

package.json

@@ -91,7 +91,7 @@
     "react-dom": "18.3.1"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.5",
+    "@babel/core": "^7.29.6",
     "@commitlint/cli": "^19.8.1",
     "@commitlint/config-conventional": "^19.8.1",
     "@events-helsinki/eslint-config-bases": "workspace:^",
@@ -127,7 +127,7 @@
     "picocolors": "1.1.1",
     "prettier": "^3.6.2",
     "rimraf": "6.0.1",
-    "shell-quote": "1.8.3",
+    "shell-quote": "1.8.4",
     "ts-loader": "9.5.2",
     "ts-node": "10.9.2",
     "typescript": "5.8.3",

packages/components/package.json

@@ -88,7 +88,7 @@
     "sanitize-html": "^2.17.0"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.5",
+    "@babel/core": "^7.29.6",
     "@babel/preset-env": "^7.28.5",
     "@babel/preset-react": "7.27.1",
     "@babel/preset-typescript": "7.27.1",
@@ -128,7 +128,7 @@
     "crypto-browserify": "3.12.1",
     "csstype": "3.1.3",
     "dequal": "2.0.3",
-    "dompurify": "3.4.0",
+    "dompurify": "3.4.11",
     "esbuild": "0.28.1",
     "esbuild-sass-plugin": "3.7.0",
     "eslint": "9.39.4",
@@ -154,7 +154,7 @@
     "tsconfig-paths-webpack-plugin": "4.2.0",
     "tsup": "^8.0.0",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vitest": "4.1.2",
     "vitest-axe": "0.1.0",
     "vitest-indexeddb": "0.0.0",

packages/graphql-proxy-server/package.json

@@ -68,7 +68,7 @@
     "ts-loader": "9.5.2",
     "ts-node": "10.9.2",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vitest": "4.1.2",
     "vitest-sonar-reporter": "2.0.4",
     "webpack": "5.104.1",

pnpm-lock.yaml

@@ -5,10 +5,13 @@ packages:
 
 # Only install package versions published at least 7 days ago (City of Helsinki org default)
 minimumReleaseAge: 10080
+# Security/dependabot bumps that lag behind the 7-day gate (see main yarn.lock)
+minimumReleaseAgeExclude:
+  - js-yaml@4.3.0
 
 # Moved from package.json (pnpm 11.5+ reads overrides here only)
 overrides:
-  '@babel/core': ^7.28.5
+  '@babel/core': ^7.29.6
   '@babel/runtime': ^7.28.4
   '@testing-library/dom': ^10.4.0
   '@tootallnate/once': ^3.0.1
@@ -37,6 +40,7 @@ overrides:
   underscore: '>=1.13.8'
   typescript: 5.8.3
   ws: ^8.13.3
+  js-yaml: 4.3.0
 
 allowBuilds:
   '@apollo/protobufjs': true

pnpm-workspace.yaml

@@ -63,7 +63,7 @@
     "tsconfig-paths-webpack-plugin": "4.2.0",
     "tsx": "4.20.3",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vitest": "4.1.2",
     "vitest-sonar-reporter": "2.0.4",
     "webpack": "5.104.1",

proxies/events-graphql-proxy/package.json

@@ -64,7 +64,7 @@
     "tsconfig-paths-webpack-plugin": "4.2.0",
     "tsx": "4.20.3",
     "typescript": "5.8.3",
-    "vite": "8.0.6",
+    "vite": "8.0.16",
     "vitest": "4.1.2",
     "vitest-sonar-reporter": "2.0.4",
     "webpack": "5.104.1",