diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 3484298..0783a95 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -5,12 +5,12 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  cross-spawn@<6.0.6: '>=6.0.6'
+  cross-spawn@<6.0.6: ^6.0.6
   minimatch@<3.1.4: '>=3.1.4 <4'
-  minimatch@>=9.0.0 <9.0.7: <11
-  lodash@<4.17.24: '>=4.17.24'
-  brace-expansion@<1.1.13: <6
-  tmp@<0.2.6: '>=0.2.6'
+  minimatch@>=9.0.0 <9.0.7: ^9.0.7
+  lodash@<4.17.24: ^4.17.24
+  brace-expansion@<1.1.13: ^1.1.18
+  tmp@<0.2.6: ^0.2.6
   nanoid@<3.3.18: '>=3.3.18 <4'
   js-yaml@<4.3.1: '>=4.3.1 <5'
   fast-uri@<3.1.5: '>=3.1.5 <4'
@@ -998,6 +998,9 @@ packages:
     resolution: {integrity: sha512-x0K50QvKQ97fdEz2kPehIerj+YTeptKF9hyYkKf6egnwmMWAkADiO0QCzSp0R5xN8FTZgYaBfSaue46Ej62nMg==}
     engines: {node: 20 || >=22}
 
+  brace-expansion@1.1.18:
+    resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==}
+
   brace-expansion@2.1.4:
     resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==}
 
@@ -1046,6 +1049,9 @@ packages:
   color-name@1.1.4:
     resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
 
+  concat-map@0.0.1:
+    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
+
   conventional-changelog-angular@9.4.0:
     resolution: {integrity: sha512-HdxRxuS8bBXVIuo4V82gvSwAXT0vYQUizrjs/izmPg5JdDstr8v8I5hduGL3iQbG+o310dUDxC4+LetuS5hu9w==}
     engines: {node: '>=22'}
@@ -2823,6 +2829,11 @@ snapshots:
     dependencies:
       jackspeak: 4.2.3
 
+  brace-expansion@1.1.18:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
   brace-expansion@2.1.4:
     dependencies:
       balanced-match: 1.0.2
@@ -2865,6 +2876,8 @@ snapshots:
 
   color-name@1.1.4: {}
 
+  concat-map@0.0.1: {}
+
   conventional-changelog-angular@9.4.0:
     dependencies:
       '@conventional-changelog/template': 1.4.0
@@ -3301,7 +3314,7 @@ snapshots:
 
   minimatch@3.1.5:
     dependencies:
-      brace-expansion: 5.0.7
+      brace-expansion: 1.1.18
 
   minimatch@7.4.9:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 2b6c4e9..52d74cd 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -5,13 +5,18 @@ allowBuilds:
   # size-limit's estimator. `@swc/core`, `core-js` and `unrs-resolver` left with jest
   # and eslint; nothing in the tree pulls them any more.
   esbuild: true
+# All overrides below are deliberately bounded within the major they patch — a
+# selector clears a vulnerable range, and the target stays inside that same
+# major (or, for a pre-1.0 package, the equivalent minor) so clearing an
+# advisory can never silently carry the tree across a major it wasn't asked
+# to move to.
 overrides:
-  cross-spawn@<6.0.6: '>=6.0.6'
+  cross-spawn@<6.0.6: '^6.0.6'
   minimatch@<3.1.4: '>=3.1.4 <4'
-  minimatch@>=9.0.0 <9.0.7: '<11'
-  lodash@<4.17.24: '>=4.17.24'
-  brace-expansion@<1.1.13: '<6'
-  tmp@<0.2.6: '>=0.2.6'
+  minimatch@>=9.0.0 <9.0.7: '^9.0.7'
+  lodash@<4.17.24: '^4.17.24'
+  brace-expansion@<1.1.13: '^1.1.18'
+  tmp@<0.2.6: '^0.2.6'
   # Dev-tree advisories with no upgrade path: every parent is already on its latest
   # release, so bumping a direct dependency reaches none of them. `path-equal` declares no
   # runtime dependencies, so none of this ships to consumers — Dependabot's `runtime`