Overrides move undici to 7.29.0, postcss to 8.5.26, and nanoid to 3.3.18; SvelteKit updates in range to 2.70.2. The eleven undici acceptances in the Bun audit baseline are stale once undici is current, so they are removed.
Pin external actions, images, toolchains, native archives, and tvOS engine artifacts; enforce fail-closed CI checks and keep website privacy disclosures aligned with shipped behavior.