build(deps): update dependencies and patch advisories

- bump actions/checkout to v7 and actions/setup-node to v7
- bump next to 16.2.10, react and react-dom to 19.2.7
- bump eslint-config-next to 16.2.10, tailwindcss and
  @tailwindcss/postcss to 4.3.3, eslint to 9.39.5
- override @babel/core, js-yaml, and postcss to patched versions
- move pnpm build allowlist to pnpm-workspace.yaml

web/.github/workflows/deploy.yml

@@ -18,11 +18,11 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'pnpm'

web/package.json

@@ -10,17 +10,14 @@
     "lint": "eslint"
   },
   "dependencies": {
-    "next": "16.2.6",
-    "react": "19.2.6",
-    "react-dom": "19.2.6"
+    "next": "16.2.10",
+    "react": "19.2.7",
+    "react-dom": "19.2.7"
   },
   "devDependencies": {
-    "@tailwindcss/postcss": "^4",
+    "@tailwindcss/postcss": "^4.3.3",
     "eslint": "^9",
-    "eslint-config-next": "16.2.6",
-    "tailwindcss": "^4"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": ["sharp", "unrs-resolver"]
+    "eslint-config-next": "16.2.10",
+    "tailwindcss": "^4.3.3"
   }
 }

web/pnpm-workspace.yaml

@@ -0,0 +1,8 @@
+allowBuilds:
+  sharp: true
+  unrs-resolver: true
+
+overrides:
+  '@babel/core': '^7.29.7'
+  js-yaml: '^4.3.0'
+  postcss: '>=8.5.16'