Patch vulnerable transitive dependencies in the VitePress docs stack

[Copilot]

The repository was reporting security alerts from transitive packages pulled in by the docs build toolchain. This change narrows the remediation to dependency resolution, updating the affected packages without changing the site configuration or content.

• What changed

  • Added pnpm.overrides to force patched versions of vulnerable transitive dependencies used by vitepress.
  • Refreshed the lockfile so the resolved dependency graph matches the secure versions.

• Patched dependencies

  • mdast-util-to-hast → 13.2.1
  • picomatch → 4.0.4
  • postcss → 8.5.15
  • rollup → 4.61.1

• Why this shape

  • Keeps the change scoped to supply-chain remediation.
  • Avoids broader framework/plugin upgrades while clearing the current alerts.

• Example

  {
    "pnpm": {
      "overrides": {
        "mdast-util-to-hast": "13.2.1",
        "picomatch": "4.0.4",
        "postcss": "8.5.15",
        "rollup": "4.61.1"
      }
    }
  }

[fyyzkd]

这是来自QQ邮箱的假期自动回复邮件。你好，我最近正在休假中，无法亲自回复你的邮件。我将在假期结束后，尽快给你回复。

[qm13579]

这是来自QQ邮箱的假期自动回复邮件。   您好，我最近正在休假中，无法亲自回复您的邮件。我将在假期结束后，尽快给您回复。

[Litexplorer]

你好，我已收到你的邮件。

[Copilot]

Pull request overview

This PR addresses dependency security alerts in the VitePress-based docs toolchain by pinning patched versions of vulnerable transitive dependencies via pnpm overrides and updating the lockfile to reflect the remediated resolution graph.

Changes:

• Added pnpm.overrides in package.json to force patched versions of mdast-util-to-hast, picomatch, postcss, and rollup.
• Refreshed pnpm-lock.yaml so the resolved dependency graph aligns with the overrides (including updated rollup platform artifacts and related transitive bumps).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds pnpm.overrides to pin patched transitive dependency versions for the docs toolchain.
pnpm-lock.yaml	Updates the lockfile to match the override-enforced dependency graph (including rollup/postcss/picomatch/mdast-util-to-hast resolution updates).

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.