Pnpm

TIL: fix a dev-only Dependabot alert with a pnpm override

A plain pnpm update would not move a transitive dependency pinned by its parent. A one-line pnpm override did, and GitHub closed the alert.