[Security] Pin axios >=1.18.0 and bump vulnerable dependencies

[mindsers]

Summary

pnpm audit --prod reports vulnerable transitive dependencies:

Package	Severity	Path	Fix
axios (< 1.18.0)	High ×3 (proxy/SSRF, DoS, prototype-pollution auth injection)	@googlemaps/google-maps-services-js > axios	Upgrade transitive axios ≥ 1.18.0
uuid (< 11.1.1)	Moderate	exceljs > uuid	Bump
yaml (< 2.8.3)	Moderate (DoS)	@inlang/paraglide-js > vite > yaml (build-time)	Bump
@hono/node-server (< 1.19.13)	Moderate (middleware bypass)	@prisma/client > prisma > @prisma/dev (dev/CLI)	Bump

The axios one matters most because google-maps-services-js runs server-side.

Remediation

• Add a pnpm.overrides pin ("axios": ">=1.18.0"), bump the others.
• Enable Dependabot / pnpm audit in CI.

Severity

Medium.

---

Source: internal security review (commit 0360e87, 2026-07-21).