fix(deps): scope minimumReleaseAge excludes to patched versions

Replace bare package-name excludes with version-scoped disjunctions so only
the exact security-patched versions bypass minimumReleaseAge; every other
version still gets the 10-day age check. Overrides (the permanent pins) are
unchanged; only these excludes are temporary until the patches age out.

Author: FJ-Riveros

pnpm-workspace.yaml

@@ -9,11 +9,12 @@ minimumReleaseAge: 14400
 # TODO(2026-08-10): drop this once ip-address@10.4.0 clears minimumReleaseAge
 # (published 2026-07-31; 10-day gate ⇒ ~2026-08-10).
 minimumReleaseAgeExclude:
-  # TEMPORARY (~remove after 2026-08-20): package-name excludes are required —
-  # version-scoped excludes alone do not bypass minimumReleaseAge for these
-  # security pins on pnpm. Revisit once patched releases are >10 days old.
-  - js-yaml
-  - brace-expansion
+  # TEMPORARY excludes (~remove once these patched versions clear the 10-day age
+  # gate, ~2026-08-20): version-scoped so ONLY these exact security-patched
+  # versions bypass minimumReleaseAge — every other version still gets the age
+  # check. The `overrides` below are the permanent pins; only these are temporary.
+  - js-yaml@3.15.1 || 4.3.1 || 5.2.2
+  - brace-expansion@1.1.18 || 2.1.4 || 3.0.6 || 5.0.9
   - ip-address@10.4.0
 # Fail (don't silently downgrade) if a package's publisher trust level drops
 trustPolicy: no-downgrade