chore(security): fix npm audit vulnerabilities via pnpm overrides

Ran `pnpm audit --fix`, which added pnpm.overrides pinning vulnerable
transitive dependencies to patched versions, and regenerated the lockfile.

Reduces reported vulnerabilities from 222 to 10 (all 3 critical resolved:
form-data, Next.js middleware auth bypass, shell-quote). Covers the
outstanding Dependabot advisories (next, vite, eslint, path-to-regexp).

The 10 remaining are dev/build-tooling transitives (js-yaml, minimatch,
picomatch, ajv, yaml via changesets/turbo/eslint) whose only fix would be
blanket major-version overrides of shared build deps; not bundled in the
published react-use-intercom package.

Core library build and tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: devrnt

package.json

@@ -33,5 +33,145 @@
     "turbo": "^2.4.0",
     "typescript": "^5.7.3",
     "typescript-eslint": "^8.23.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "next@>=0.9.9 <13.4.20-canary.13": ">=13.4.20-canary.13",
+      "next@>=13.4.0 <14.1.1": ">=14.1.1",
+      "next@>=13.4.0 <13.5.1": ">=13.5.1",
+      "zod@<=3.22.2": ">=3.22.3",
+      "next@>=13.3.1 <13.5.0": ">=13.5.0",
+      "next@>=10.0.0 <14.2.7": ">=14.2.7",
+      "next@>=13.0.0 <13.5.8": ">=13.5.8",
+      "esbuild@<=0.24.2": ">=0.25.0",
+      "cookie@<0.7.0": ">=0.7.0",
+      "@babel/runtime@<7.26.10": ">=7.26.10",
+      "@babel/helpers@<7.26.10": ">=7.26.10",
+      "base-x@<=3.0.10": ">=3.0.11",
+      "path-to-regexp@<0.1.12": ">=0.1.12",
+      "brace-expansion@>=1.0.0 <=1.1.11": ">=1.1.12",
+      "brace-expansion@>=2.0.0 <=2.0.1": ">=2.0.2",
+      "next@>=13.0 <14.2.30": ">=14.2.30",
+      "@eslint/plugin-kit@<0.3.4": ">=0.3.4",
+      "on-headers@<1.1.0": ">=1.1.0",
+      "next@>=0.9.9 <14.2.31": ">=14.2.31",
+      "vite@<=5.4.19": ">=5.4.20",
+      "vite@>=6.0.0 <=6.3.5": ">=6.3.6",
+      "next@>=9.5.5 <14.2.15": ">=14.2.15",
+      "next@>=0.9.9 <14.2.32": ">=14.2.32",
+      "next@>=0.9.9 <14.2.24": ">=14.2.24",
+      "vite@>=4.5.3 <5.0.0": ">=5.4.21",
+      "vite@>=6.0.0 <=6.4.0": ">=6.4.1",
+      "tar-fs@>=2.0.0 <2.1.4": ">=2.1.4",
+      "tar-fs@>=3.0.0 <3.1.1": ">=3.1.1",
+      "tmp@<=0.2.3": ">=0.2.4",
+      "form-data@>=4.0.0 <4.0.4": ">=4.0.4",
+      "tar-fs@>=3.0.0 <3.0.9": ">=3.0.9",
+      "tar-fs@>=2.0.0 <2.1.3": ">=2.1.3",
+      "postcss@<8.4.31": ">=8.4.31",
+      "glob@>=10.2.0 <10.5.0": ">=10.5.0",
+      "axios@>=1.0.0 <1.8.2": ">=1.8.2",
+      "next@>=13.3.0 <14.2.34": ">=14.2.34",
+      "next@>=13.3.1-canary.0 <14.2.35": ">=14.2.35",
+      "axios@>=1.0.0 <1.12.0": ">=1.12.0",
+      "next@>=10.0.0 <15.5.10": ">=15.5.10",
+      "next@>=13.0.0 <15.0.8": ">=15.0.8",
+      "js-yaml@<3.14.2": ">=3.14.2",
+      "js-yaml@>=4.0.0 <4.1.1": ">=4.1.1",
+      "semver@>=7.0.0 <7.5.2": ">=7.5.2",
+      "webpack@>=5.49.0 <=5.104.0": ">=5.104.1",
+      "webpack@>=5.49.0 <5.104.0": ">=5.104.0",
+      "qs@>=6.7.0 <=6.14.1": ">=6.14.2",
+      "minimatch@<3.1.3": ">=3.1.3",
+      "minimatch@>=5.0.0 <5.1.7": ">=5.1.7",
+      "minimatch@>=9.0.0 <9.0.6": ">=9.0.6",
+      "rollup@>=4.0.0 <4.59.0": ">=4.59.0",
+      "rollup@>=3.0.0 <3.30.0": ">=3.30.0",
+      "minimatch@>=5.0.0 <5.1.8": ">=5.1.8",
+      "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
+      "minimatch@<3.1.4": ">=3.1.4",
+      "serialize-javascript@<=7.0.2": ">=7.0.3",
+      "next@>=13.0.0 <13.5.9": ">=13.5.9",
+      "ajv@<6.14.0": ">=6.14.0",
+      "ajv@>=7.0.0-alpha.0 <8.18.0": ">=8.18.0",
+      "qs@<6.14.1": ">=6.14.1",
+      "svgo@>=2.1.0 <2.8.1": ">=2.8.1",
+      "file-type@>=13.0.0 <21.3.1": ">=21.3.1",
+      "flatted@<3.4.0": ">=3.4.0",
+      "next@>=9.5.0 <15.5.13": ">=15.5.13",
+      "next@>=10.0.0 <15.5.14": ">=15.5.14",
+      "socket.io-parser@>=4.0.0 <4.2.6": ">=4.2.6",
+      "flatted@<=3.4.1": ">=3.4.2",
+      "path-to-regexp@<0.1.13": ">=0.1.13",
+      "brace-expansion@<1.1.13": ">=1.1.13",
+      "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3",
+      "picomatch@<2.3.2": ">=2.3.2",
+      "picomatch@>=4.0.0 <4.0.4": ">=4.0.4",
+      "yaml@>=1.0.0 <1.10.3": ">=1.10.3",
+      "yaml@>=2.0.0 <2.8.3": ">=2.8.3",
+      "lodash@>=4.0.0 <=4.17.23": ">=4.18.0",
+      "lodash@<=4.17.23": ">=4.18.0",
+      "vite@<=6.4.1": ">=6.4.2",
+      "vite@>=6.0.0 <=6.4.1": ">=6.4.2",
+      "next@>=13.0.0 <15.5.15": ">=15.5.15",
+      "@parcel/reporter-dev-server@>=1.6.1 <=2.16.3": ">=2.16.4",
+      "follow-redirects@<=1.15.11": ">=1.16.0",
+      "axios@>=1.0.0 <1.15.0": ">=1.15.0",
+      "postcss@<8.5.10": ">=8.5.10",
+      "immutable@<3.8.3": ">=3.8.3",
+      "axios@>=1.0.0 <1.15.1": ">=1.15.1",
+      "axios@>=1.0.0 <1.15.2": ">=1.15.2",
+      "axios@>=1.0.0 <=1.13.4": ">=1.13.5",
+      "fast-uri@<=3.1.0": ">=3.1.1",
+      "fast-uri@<=3.1.1": ">=3.1.2",
+      "next@>=13.0.0 <15.5.16": ">=15.5.16",
+      "next@>=12.2.0 <15.5.16": ">=15.5.16",
+      "next@>=13.4.0 <15.5.16": ">=15.5.16",
+      "next@>=13.4.6 <15.5.16": ">=15.5.16",
+      "next@>=10.0.0 <15.5.16": ">=15.5.16",
+      "next@>=13.4.13 <15.5.16": ">=15.5.16",
+      "next@>=14.2.0 <15.5.16": ">=15.5.16",
+      "ws@>=8.0.0 <8.20.1": ">=8.20.1",
+      "turbo@>=1.1.0 <2.9.14": ">=2.9.14",
+      "@tootallnate/once@<2.0.1": ">=2.0.1",
+      "serialize-javascript@>=5.0.0 <7.0.5": ">=7.0.5",
+      "uuid@<11.1.1": ">=11.1.1",
+      "qs@>=6.11.1 <=6.15.1": ">=6.15.2",
+      "vite@<=5.4.8": ">=5.4.9",
+      "@babel/plugin-transform-modules-systemjs@>=7.12.0 <=7.29.3": ">=7.29.4",
+      "lodash@>=4.0.0 <=4.17.22": ">=4.17.23",
+      "shell-quote@>=1.1.0 <=1.8.3": ">=1.8.4",
+      "axios@>=1.0.0 <1.16.0": ">=1.16.0",
+      "axios@>=1.7.0 <1.16.0": ">=1.16.0",
+      "tmp@<0.2.6": ">=0.2.6",
+      "joi@<17.13.4": ">=17.13.4",
+      "form-data@>=4.0.0 <4.0.6": ">=4.0.6",
+      "vite@<=6.4.2": ">=6.4.3",
+      "js-yaml@<3.15.0": ">=3.15.0",
+      "js-yaml@>=4.0.0 <=4.1.1": ">=4.2.0",
+      "turbo@<=2.9.13": ">=2.9.14",
+      "ws@>=8.0.0 <8.21.0": ">=8.21.0",
+      "@babel/core@<=7.29.0": ">=7.29.6",
+      "axios@>=1.0.0 <1.18.0": ">=1.18.0",
+      "brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2",
+      "brace-expansion@<1.1.16": ">=1.1.16",
+      "js-yaml@>=4.0.0 <4.3.0": ">=4.3.0",
+      "js-yaml@>=3.0.0 <3.15.0": ">=3.15.0",
+      "engine.io@>=4.1.0 <6.6.7": ">=6.6.7",
+      "shell-quote@<=1.8.4": ">=1.9.0",
+      "axios@>=1.7.0 <1.18.0": ">=1.18.0",
+      "body-parser@<1.20.6": ">=1.20.6",
+      "immutable@<4.3.9": ">=4.3.9",
+      "svgo@>=1.0.0 <2.8.3": ">=2.8.3",
+      "fast-uri@>=3.0.0 <=3.1.3": ">=3.1.4",
+      "sharp@<0.35.0": ">=0.35.0",
+      "next@>=13.0.0 <15.5.21": ">=15.5.21",
+      "next@>=14.1.1 <15.5.21": ">=15.5.21",
+      "next@>=12.0.0 <15.5.21": ">=15.5.21",
+      "postcss@<=8.5.11": ">=8.5.12",
+      "postcss@<=8.5.17": ">=8.5.18",
+      "brace-expansion@<=5.0.7": ">=5.0.8",
+      "fast-uri@>=3.0.0 <3.1.3": ">=3.1.3"
+    }
   }
 }