diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c35ee06e86b..b57123e50ee 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -27,12 +27,12 @@ overrides:
   cookie@<0.8.0: ^0.7.0
   svelte: ^5.55.7
   '@tootallnate/once@<2.0.1': 2.0.1
-  brace-expansion@>=5.0.0 <6.0.0: ^5.0.9
+  brace-expansion@>=5.0.0 <6.0.0: ^5.0.12
   sharp@>=0.34.0 <0.36.0: ^0.35.4
   react-router@<8.3.0: ^8.3.0
   '@sveltejs/kit@<2.69.1': ^2.69.1
   '@hono/node-server@<3.0.0': ^2.0.10
-  fast-uri@<4.0.0: ^3.1.6
+  fast-uri@<4.0.0: ^3.1.8
   hono@<5.0.0: ^4.13.5
   dompurify@<4.0.0: ^3.4.13
   nanoid@<4.0.0: ^3.3.17
@@ -5841,8 +5841,8 @@ packages:
   bowser@2.14.1:
     resolution: {integrity: sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==}
 
-  brace-expansion@5.0.9:
-    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
+  brace-expansion@5.0.12:
+    resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
     engines: {node: 20 || >=22}
 
   bson@7.3.1:
@@ -6615,8 +6615,8 @@ packages:
   fast-string-width@3.0.2:
     resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
 
-  fast-uri@3.1.7:
-    resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==}
+  fast-uri@3.1.8:
+    resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
 
   fast-wrap-ansi@0.2.2:
     resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -11866,7 +11866,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.7
+      fast-uri: 3.1.8
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -12098,7 +12098,7 @@ snapshots:
 
   bowser@2.14.1: {}
 
-  brace-expansion@5.0.9:
+  brace-expansion@5.0.12:
     dependencies:
       balanced-match: 4.0.4
 
@@ -12924,7 +12924,7 @@ snapshots:
     dependencies:
       fast-string-truncated-width: 3.0.3
 
-  fast-uri@3.1.7: {}
+  fast-uri@3.1.8: {}
 
   fast-wrap-ansi@0.2.2:
     dependencies:
@@ -14376,11 +14376,11 @@ snapshots:
 
   minimatch@10.2.3:
     dependencies:
-      brace-expansion: 5.0.9
+      brace-expansion: 5.0.12
 
   minimatch@10.2.6:
     dependencies:
-      brace-expansion: 5.0.9
+      brace-expansion: 5.0.12
 
   minimist@1.2.8: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 1b01e30f390..3ad74a32822 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -297,7 +297,12 @@ overrides:
   # declaration is now in the selector's scope and the lockfile records ^2.0.10 as its
   # specifier — the resolved version is unchanged at 2.0.12, because the ^2.0.10 target
   # floats to the newest 2.x (measured, #6095).
-  'brace-expansion@>=5.0.0 <6.0.0': '^5.0.9'
+  # brace-expansion, 2026-09-30 (#20769): three MORE advisories, GHSA-6j4f-fj2g-mc7p,
+  # GHSA-qhr7-859c-m2p7 and GHSA-q2hr-2g5m-vwhr, fixed in 5.0.12 — target lifted from
+  # ^5.0.9, selector stays at the <6.0.0 major boundary. This floor keeps THIS
+  # workspace's resolution from re-locking 5.0.9; overrides do not reach downstream
+  # installs, so a consumer's own brace-expansion copy is theirs to lift.
+  'brace-expansion@>=5.0.0 <6.0.0': '^5.0.12'
   'sharp@>=0.34.0 <0.36.0': '^0.35.4'
   'react-router@<8.3.0': '^8.3.0'
   '@sveltejs/kit@<2.69.1': '^2.69.1'
@@ -313,6 +318,11 @@ overrides:
   #     high each), fixed in 3.1.6 — target lifted from ^3.1.5, selector stays
   #     at the 4.0.0 boundary. ajv@8.20.0's ^3.0.1 already admits 3.1.6, so
   #     this is a dedupe onto the patched line, not a forced upgrade.
+  #     2026-09-30 (#20769): GHSA-hrr3-gc8f-f4qj, fixed in 3.1.8 — target lifted
+  #     from ^3.1.6, selector stays at the 4.0.0 boundary. ajv@8.20.0's ^3.0.1
+  #     admits 3.1.8, so this is again a dedupe onto the patched line. The floor
+  #     binds this workspace's resolution only; overrides do not reach downstream
+  #     installs.
   #   hono GHSA-8j4g-w8fx-2239 (5.3) — the one entry here that is NOT
   #     transitive-only: two versions resolved, 4.12.32 from our own packages
   #     and 4.12.33 pulled by @modelcontextprotocol/sdk. The override moves the
@@ -340,7 +350,7 @@ overrides:
   #     The declared ranges go to ^4.13.5 in lockstep for the downstream-install
   #     reason above; the @objectstack/hono PEER range stays ^4.12.8, unchanged,
   #     for the reason above it.
-  'fast-uri@<4.0.0': '^3.1.6'
+  'fast-uri@<4.0.0': '^3.1.8'
   'hono@<5.0.0': '^4.13.5'
   # OSV 2026-08-07 (#6407) — transitive-only, and the same "it has a fix, so
   # take the fix" disposition as the batch above: