diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index fd4bbd27a..7f7e6d1dc 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -22,15 +22,6 @@ minimumReleaseAgeExclude:
   - '@turbo/*'                    # 2.9.14 — platform binaries co-published with turbo (scope rename from turbo-*), same OIDC provenance ✓
   - '@esbuild/*'                  # 0.28.1 — platform binaries co-published with esbuild in the same OIDC release, vetted 2026-06-16
   - '@next/*'                     # 16.2.11 — swc platform binaries + env co-published with next in the same OIDC release
-  - 'nanoid@3.3.18'               # 3.3.18 — GHSA-2v37-7h3g-55p8 / CVE-2026-67213 (high, infinite loop for zero-size custom generators); supersedes the 3.3.17 exemption, whose fix was incomplete (advisory range widened to <3.3.18 on 2026-08-13), vetted 2026-08-18: provenance ✓, publisher (OIDC, approver ai, unchanged from 3.3.17) ✓, tag+diff (async/index.native.js zero-size guard + default size, README docs line only) ✓, zero dependencies ✓, no install scripts ✓, integrity ✓
-  - 'dompurify@3.4.13'            # 3.4.13 — GHSA-55q2-fjhq-7xh7 (moderate, IN_PLACE hook-removal XSS), vetted 2026-08-11: publisher (cure53, unchanged) ✓, signed tag+diff (security fixes + regression tests; CI-only action bumps excluded from tarball) ✓, zero runtime dependencies ✓, integrity ✓ (no provenance, historically none)
-  - 'mermaid@11.16.1'             # 11.16.1 — GHSA-6x64-9x62-f2gx / GHSA-3rrr-jr9j-h3q3 / GHSA-2v8p-3f2j-5mp7 / GHSA-rhh3-jpg6-66xh (moderate) + GHSA-c4c3-pg64-4m4v (low, config prototype pollution), vetted 2026-08-06: provenance ✓, publisher (OIDC, release by aloisklink) ✓, tag+diff (PR #8022, styles/architecture/xychart/radar/config only) ✓, dependencies identical to 11.16.0 ✓, integrity ✓
-  - 'fast-uri@3.1.5'              # 3.1.5 — GHSA-7p8r-x3mc-p8w7 (high, host confusion via backslash in authority), vetted 2026-08-06: publisher (matteo.collina, unchanged) ✓, tag+diff (v3.1.5, index.js +37/-1 + 136 lines of security tests) ✓, zero dependencies ✓, integrity ✓ (no provenance, historically none for this package)
-  - 'hono@4.12.34'                # 4.12.34 — GHSA-8j4g-w8fx-2239 (moderate, ReDoS in CORS middleware via Access-Control-Request-Headers), vetted 2026-08-06: provenance ✓, publisher (OIDC, approver yusukebe) ✓, tag+diff (v4.12.34, src/middleware/cors/index.ts +1/-1 + test, via private security-fork merge) ✓, zero dependencies ✓, integrity ✓
-  - 'framer-motion@13.1.0'        # 13.1.0 — Motion v13 upgrade (drops v12's @emotion/is-prop-valid dynamic require behind Rspack's critical-dependency warning), vetted 2026-08-12: publisher (popmotion, unchanged since v12) ✓, upstream tag v13.1.0 ✓, deps unchanged (tslib, motion-dom, motion-utils) ✓, no install scripts ✓, integrity ✓ (no provenance, historically none)
-  - 'motion@13.1.0'               # 13.1.0 — wrapper package of framer-motion@13.1.0, vetted 2026-08-12: publisher (popmotion, unchanged since v12) ✓, upstream tag v13.1.0 ✓, deps (tslib, framer-motion) ✓, no install scripts ✓, integrity ✓ (no provenance, historically none)
-  - 'motion-dom@13.0.0'           # 13.0.0 — framer-motion@13.1.0 runtime dep, vetted 2026-08-12: publisher (popmotion, unchanged since v12) ✓, upstream tag v13.0.0 ✓, deps (motion-utils) ✓, no install scripts ✓, integrity ✓ (no provenance, historically none)
-  - 'motion-utils@13.0.0'         # 13.0.0 — framer-motion@13.1.0 runtime dep, vetted 2026-08-12: publisher (popmotion, unchanged since v12) ✓, upstream tag v13.0.0 ✓, zero dependencies ✓, no install scripts ✓, integrity ✓ (no provenance, historically none)
 # Refuse transitive git/tarball deps (pnpm 11 default; kept explicit for clarity)
 blockExoticSubdeps: true