Bump top-level dependencies to resolve open Dependabot PRs

[Copilot]

Summary

Resolves the batch of ~29 open Dependabot PRs by bumping the relevant top-level (direct) packages instead of merging each individual transitive-dependency PR separately, since most of the flagged vulnerable/outdated transitive packages are pulled in by a handful of direct dependencies.

Changes

• packages/core: ws → ^8.21.3, mercurius → ^16.10.0
• packages/transactional-adapters/transactional-adapter-kysely: kysely → ^0.29.5
• packages/transactional-adapters/transactional-adapter-drizzle-orm: drizzle-orm → ^0.45.2
• packages/transactional-adapters/transactional-adapter-typeorm: typeorm (dev dep) → 1.1.0
• packages/transactional-adapters/transactional-adapter-mongodb & -mongoose: mongodb-memory-server → ^11.2.0
• docs: @docusaurus/core, @docusaurus/preset-classic, @docusaurus/module-type-aliases → ^3.10.2, react/react-dom → ^19.2.8
  • Docusaurus packages were updated using the exact command Docusaurus's own CLI update-notifier recommends for Yarn Berry projects (yarn up @docusaurus/core@latest @docusaurus/preset-classic@latest @docusaurus/module-type-aliases@latest), rather than by hand-editing version numbers.
• Remaining flagged transitive packages (postcss, svgo, flatted, joi, js-yaml, webpack-dev-server, http-proxy-middleware, launch-editor, shell-quote, @babel/core, @babel/plugin-transform-modules-systemjs, brace-expansion, picomatch, ip-address, websocket-driver, form-data, @protobufjs/utf8, ip, defu, yauzl, fast-uri, @fastify/static) were re-resolved to their patched versions within existing semver ranges via yarn up -R, requiring no manifest changes.

@nestjs/core/@nestjs/platform-fastify Dependabot PRs targeting 11.x were confirmed stale — the repo is already on @nestjs/core@12.0.1/@nestjs/platform-fastify@12.0.1.

Validation

• yarn build passes for all workspaces
• packages/core test suite: 217/217 passed
• Kysely / Drizzle-ORM / TypeORM adapter test suites: all passed
• Docs typecheck and build pass
• MongoDB/Mongoose adapter tests could not be fully exercised locally due to a sandbox network restriction blocking fastdl.mongodb.org (pre-existing environment limitation, unrelated to this change)