🎯 Goal

• Reduce the security dependency override surface introduced while resolving Dependabot alerts.
• Keep only overrides that are actually needed after lockfile resolution.

🔧 Core Changes

• Remove unnecessary pnpm overrides for @babel/core, form-data, js-yaml, linkify-it, and markdown-it.
• Keep dompurify override because monaco-editor@0.55.1 pins dompurify to 3.2.7 exactly when the override is removed.
• Keep the existing esbuild override.

🤔 Key Decisions

• Verified that non-DOMPurify packages stay on patched versions through normal lockfile resolution.
• Avoided updating to unstable Monaco dev releases; stable monaco-editor@0.55.1 is currently the latest stable and still pins vulnerable DOMPurify.

🧪 Verification Guide

How to verify

1. Run npx -y pnpm@10.34.4 --dir backend/islands audit --audit-level=low.
2. Run npm audit --audit-level=low.
3. Run npm run islands:lint.
4. Run npm run islands:type-check.

Expected result

• Audits report no known vulnerabilities.
• Lint and type-check complete successfully.

✅ Checklist

• Lint completed
• Type-check completed
• Tests completed
• Documentation updated (if needed)