chore(ui): update dependency body-parser to v2.4.0 [security]

ui/pnpm-workspace.yaml

@@ -1,6 +1,3 @@
-# pnpm 11+ workspace config. .npmrc is auth/registry only; everything else lives here.
-# Reference: https://pnpm.io/supply-chain-security
-
 packages: []
 
 # Refuse to install on Node/pnpm outside the `engines` block in package.json.
@@ -109,7 +106,7 @@ overrides:
   # radar diagram DoS.
   "mermaid": "11.16.1"
   # body-parser (via express): invalid `limit` silently disabled size enforcement.
-  "body-parser": "2.3.0"
+  "body-parser": "2.4.0"
   # proxy-addr (via @modelcontextprotocol/sdk > express): GHSA-jqcg-44mw-7w3h
   # (critical), a short IPv4-mapped IPv6 trust subnet trusts every client, so
   # `req.ip` returns a spoofed X-Forwarded-For. 2.0.8 (2026-09-15) clears the
@@ -165,3 +162,6 @@ trustPolicyExclude:
 
 # Block transitive dependencies from using exotic specifiers (git URLs, tarballs).
 blockExoticSubdeps: true
+minimumReleaseAgeExclude:
+  # Renovate security update: body-parser@2.4.0
+  - body-parser@2.4.0