[adrienlacombe]

Fixes all six open Dependabot alerts.

Alert	Package	Severity	Path	Fix
#265	zod	high	wallet-standard → ox	4.4.3 → 4.6.7, in-range lockfile update
#266	deepmerge	low	docs → vocs → @vanilla-extract/css	No patched release. @vanilla-extract/css 1.21.3 (in range) uses deepmerge-ts, so deepmerge leaves the tree
#260, #261, #262	toml	high	docs → vocs / remark-mdx-frontmatter	Existing override raised to ^5.0.1
#267	@hono/node-server	medium	docs → vocs	Override to ^2.1.3. vocs asks for ^1.19 and there's no patched 1.x

Notes

• Overrides. Only toml and @hono/node-server need overrides, because their fixes are outside vocs's declared ranges. Neither appears in a peer spec, so the version-selector keys are safe. zod is in a multi-range peer spec (abitype: ^3.22.0 || ^4.0.0), so it was bumped in range instead of overridden.
• @hono/node-server 2.x. vocs 1.4.1 only imports serve from it, in vocs preview. That export is unchanged in 2.x. vocs build doesn't use it.
• toml 5. Still exports parse from a CommonJS entry, which is all vocs and remark-mdx-frontmatter use. It needs Node >= 20; the repo requires >= 22.
• No changeset. Only the lockfile and workspace overrides change. No published package's declared dependencies change; zod reaches consumers through ox's own ^4.4.3 range.

Verification

• pnpm format:check, pnpm build (packages and docs site), pnpm typecheck and pnpm lint:check all pass.
• pnpm test: all 50 tests pass (wallets 1, wallet-standard 26, virtual-wallet 5, discovery 18).
• vocs preview on @hono/node-server 2.1.5 serves / and /getting-started with 200.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues block the dependency updates targeting Dependabot security alerts.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Updates transitive dependencies to address six Dependabot security alerts across the docs site and wallet-standard dependency tree.

Changes:

• Adds an @hono/node-server override and raises the existing toml override to patched versions.
• Updates zod and @vanilla-extract/css within existing dependency ranges, removing deepmerge from the lockfile.

File	Description
pnpm-workspace.yaml	Defines and documents security overrides for docs dependencies.
pnpm-lock.yaml	Records updated versions and their transitive dependency resolutions.

_{Review effort: Balanced}