fix(deps): patch ws (HIGH) and python aiohttp/idna advisories

- ws via pnpm-workspace.yaml overrides: >=7.0.0<7.5.11 -> 7.5.11, >=8.0.0<8.21.0 -> 8.21.0
  (CVE-2026-48779 HIGH; also clears CVE-2026-45736 ws<8.20.1)
- python aiohttp>=3.14.1, idna>=3.15 via [tool.uv] override
- uuid 11.1.0->11.1.1 already pinned (unchanged)

js-yaml 3.15.0 (CVE-2026-53550, MEDIUM) deferred: blocked by repo minimumReleaseAge (10d) until ~2026-07-07.

Author: FJ-Riveros

pnpm-lock.yaml

@@ -28,6 +28,8 @@ overrides:
   "brace-expansion@>=4.0.0 <5.0.6": "5.0.6"
   "ip-address@<=10.1.0": "10.1.1"
   "uuid@11.1.0": "11.1.1"
+  "ws@>=7.0.0 <7.5.11": "7.5.11"
+  "ws@>=8.0.0 <8.21.0": "8.21.0"
   "plain-crypto-js@4.2.1": "0.0.0-security"
   "lodash": ">=4.18.1"
   "bn.js": ">=5.2.3"

pnpm-workspace.yaml

@@ -22,9 +22,10 @@ dev = [
 [tool.uv]
 exclude-newer = "10 days"
 override-dependencies = [
-    "aiohttp>=3.13.4",
+    "aiohttp>=3.14.1",  # CVE-2026-34993, CVE-2026-47265, CVE-2026-54273/54274/54276/54277/54278
     "Pygments>=2.20.0",
     "urllib3>=2.7.0",
+    "idna>=3.15",  # CVE-2026-45409
 ]
 
 [tool.ruff]