Pin @asyncapi/specs to 6.11.1 (supply chain attack in 6.11.2) (#816)

* Pin @asyncapi/specs to 6.11.1 via overrides

@asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (published 2026-07-14) contain
malware (asyncapi/spec-json-schemas#656). @stoplight/spectral-rulesets
declares ^6.8.0 on it, so any fresh resolution pulls the compromised
version while it remains tagged latest on npm. Pin the transitive
dependency to the last clean release — via pnpm.overrides for pnpm and a
top-level overrides field for npm/Bun — and bump the patch version.

Note: overrides only apply at the root of an install, so this protects
builds of this repo, not consumers of the published package; their
protection is npm removing the malicious versions.

* Update @geonovum/standards-checker to 1.1.5

Picks up the release that pins @asyncapi/specs to 6.11.1
(Geonovum/standards-checker#67). The re-resolved subtree keeps
@asyncapi/specs at 6.11.1 under this repo's own overrides pin.

Author: joostfarla

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonovum/ogc-checker",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "packageManager": "pnpm@10.33.0",
   "license": "EUPL-1.2",
   "repository": {
@@ -31,7 +31,7 @@
   },
   "prettier": "@geonovum/standards-checker/prettier",
   "dependencies": {
-    "@geonovum/standards-checker": "^1.1.4",
+    "@geonovum/standards-checker": "^1.1.5",
     "luxon": "^3.7.2",
     "ramda": "^0.32.0",
     "react": "^19.2.7",
@@ -47,5 +47,13 @@
     "typescript": "^6.0.3",
     "vite": "^8.1.4",
     "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "@asyncapi/specs": "6.11.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "@asyncapi/specs": "6.11.1"
+    }
   }
 }