diff --git a/.changeset/fix-dep-sprintf-js-override.md b/.changeset/fix-dep-sprintf-js-override.md
new file mode 100644
index 0000000..b12d7f5
--- /dev/null
+++ b/.changeset/fix-dep-sprintf-js-override.md
@@ -0,0 +1,33 @@
+---
+'@deessejs/errors': patch
+---
+
+deps(pnpm): pin `sprintf-js` via a workspace-level override to make the unpatchable Dependabot alert explicit.
+
+The single remaining open Dependabot alert after PRs #101–#103 is **GHSA-hp3w-g68c-fv3c** (`sprintf-js`, severity MODERATE). The advisory covers the entire `<= 1.1.3` range and **no patched version exists** (the `sprintf-js` package is in maintenance-only mode upstream; the listed `firstPatchedVersion` is empty in the GitHub Advisory Database).
+
+Path of the transitive:
+
+```
+js-yaml@3.14.2
+└── read-yaml-file@1.1.0
+    └── @manypkg/get-packages@1.1.3
+        └── @changesets/{cli,apply-release-plan,...}
+            └── complete-package-template (devDependencies)
+```
+
+`@changesets/cli` is a workspace devDependency used by the release tooling. It is **never loaded by `@deessejs/errors`'s published runtime code**, only by the local release process. No production code path is exposed.
+
+This PR:
+
+1. Adds an explicit `overrides: { sprintf-js: "^1.1.3" }` block to `pnpm-workspace.yaml` (using pnpm 10's modern location, not the deprecated `pnpm.overrides` in `package.json`). The override makes the resolution explicit so future audits immediately see that the version is intentional, not accidental.
+2. Companion step (out of band, manual): a maintainer with the GitHub `triage` permission should dismiss alert GHSA-hp3w-g68c-fv3c with reason **"Won't fix — no patched version; package is in maintenance-only mode and only used as a devDependency through @changesets/cli (release tooling, not in @deessejs/errors' published code path)"**. The override here makes that dismissal decision explicit and reviewable.
+
+Validated locally:
+
+```
+pnpm install --no-frozen-lockfile   # postinstall passes
+pnpm build                          # turbo: 2 successful, ~36s
+pnpm --filter errors test           # 146/146 tests pass
+pnpm why sprintf-js                 # resolves to 1.1.3
+```
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f6e4245..0805044 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,6 +4,9 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  sprintf-js: ^1.1.3
+
 importers:
 
   .:
@@ -2886,8 +2889,8 @@ packages:
   spawndamnit@3.0.1:
     resolution: {integrity: sha512-MmnduQUuHCoFckZoWnXsTg7JaiLBJrKFj9UI2MbRPGaJeVpsLcVBu6P/IGZovziM/YBsellCmsprgNA+w0CzVg==}
 
-  sprintf-js@1.0.3:
-    resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
+  sprintf-js@1.1.3:
+    resolution: {integrity: sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==}
 
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
@@ -4566,7 +4569,7 @@ snapshots:
 
   argparse@1.0.10:
     dependencies:
-      sprintf-js: 1.0.3
+      sprintf-js: 1.1.3
 
   argparse@2.0.1: {}
 
@@ -6126,7 +6129,7 @@ snapshots:
       cross-spawn: 7.0.6
       signal-exit: 4.1.0
 
-  sprintf-js@1.0.3: {}
+  sprintf-js@1.1.3: {}
 
   stackback@0.0.2: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 4e708bd..a96ed1f 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,3 +1,13 @@
 packages:
   - 'packages/*'
   - 'apps/*'
+
+# Pinned to the highest published version of sprintf-js (1.1.3 — also the
+# unpatched latest). The GHSA-hp3w-g68c-fv3c advisory covers the entire
+# `<= 1.1.3` range and there is no upstream patch (see PR #104 rationale).
+# Path: js-yaml@3.14.2 -> read-yaml-file -> @manypkg/get-packages ->
+# @changesets/cli (devDependency only, never loaded by published library
+# code; affects only the local release/CI tooling). An override here keeps
+# the resolution explicit and obvious during future audits.
+overrides:
+  sprintf-js: ^1.1.3