diff --git a/.github/workflows/js.yaml b/.github/workflows/js.yaml
index 2a4959522..f8fe9bb9d 100644
--- a/.github/workflows/js.yaml
+++ b/.github/workflows/js.yaml
@@ -87,8 +87,6 @@ jobs:
 
       - run: pnpm run license:check
 
-      - run: pnpm audit
-
   packages:
     name: Package archives
     runs-on: ubuntu-latest
diff --git a/js/docs/development.md b/js/docs/development.md
index 31580b72c..b584c3cb6 100644
--- a/js/docs/development.md
+++ b/js/docs/development.md
@@ -193,9 +193,9 @@ and on release tags. Each job installs the official Node.js build from
 `js/.node-version` and fails unless `typeof Temporal` is `object`. The jobs
 cover build, both type-check lanes, generated migrations (compared with
 River's sources), API reports, TypeDoc, README snippets, the 0.1 fixture, lint,
-formatting, licenses, `pnpm audit`, packed archives and examples, unit tests on
-Node 26.0.0 and the current Node 26 release, and integration tests on
-PostgreSQL 14 through 18.
+formatting, licenses, packed archives and examples, unit tests on Node 26.0.0
+and the current Node 26 release, and integration tests on PostgreSQL 14
+through 18.
 
 Unit tests compare cron schedules and snooze counting with goldens recorded
 from River Go in `src/testdata`, the same values the Rust port checks in its
diff --git a/js/package.json b/js/package.json
index cfed1b4bc..b6daf50cf 100644
--- a/js/package.json
+++ b/js/package.json
@@ -110,7 +110,9 @@
     "overrides": {
       "deepmerge-ts": "8.0.1",
       "mysql2": "3.24.4",
-      "nanoid": "3.3.18"
+      "nanoid": "3.3.18",
+      "postcss-selector-parser": "7.1.6",
+      "source-map-js": "1.2.2"
     }
   },
   "keywords": [
diff --git a/js/pnpm-lock.yaml b/js/pnpm-lock.yaml
index 043b83c30..1c841c76d 100644
--- a/js/pnpm-lock.yaml
+++ b/js/pnpm-lock.yaml
@@ -8,6 +8,8 @@ overrides:
   deepmerge-ts: 8.0.1
   mysql2: 3.24.4
   nanoid: 3.3.18
+  postcss-selector-parser: 7.1.6
+  source-map-js: 1.2.2
 
 importers:
 
@@ -2370,8 +2372,8 @@ packages:
   pkg-types@2.3.1:
     resolution: {integrity: sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==}
 
-  postcss-selector-parser@7.1.5:
-    resolution: {integrity: sha512-KvvtD7SrlBP7dlgkBghEE3r84CABm5SmV2aNcG4oCA+qDnJ/tvKonFVvwWAyyWUEwxuNawdfEAZKP9zM3oZ2Uw==}
+  postcss-selector-parser@7.1.6:
+    resolution: {integrity: sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==}
     engines: {node: '>=4'}
 
   postcss@8.5.25:
@@ -2591,8 +2593,8 @@ packages:
   sonic-boom@4.2.1:
     resolution: {integrity: sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==}
 
-  source-map-js@1.2.1:
-    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+  source-map-js@1.2.2:
+    resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
     engines: {node: '>=0.10.0'}
 
   spdx-compare@1.0.0:
@@ -3236,7 +3238,7 @@ snapshots:
 
   '@npmcli/query@5.0.0':
     dependencies:
-      postcss-selector-parser: 7.1.5
+      postcss-selector-parser: 7.1.6
 
   '@npmcli/redact@4.0.0': {}
 
@@ -4626,7 +4628,7 @@ snapshots:
     dependencies:
       '@babel/parser': 7.29.9
       '@babel/types': 7.29.8
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   make-dir@4.0.0:
     dependencies:
@@ -5009,7 +5011,7 @@ snapshots:
       exsolve: 1.0.8
       pathe: 2.0.3
 
-  postcss-selector-parser@7.1.5:
+  postcss-selector-parser@7.1.6:
     dependencies:
       cssesc: 3.0.0
       util-deprecate: 1.0.2
@@ -5018,7 +5020,7 @@ snapshots:
     dependencies:
       nanoid: 3.3.18
       picocolors: 1.1.1
-      source-map-js: 1.2.1
+      source-map-js: 1.2.2
 
   postgres-array@2.0.0: {}
 
@@ -5208,7 +5210,7 @@ snapshots:
     dependencies:
       atomic-sleep: 1.0.0
 
-  source-map-js@1.2.1: {}
+  source-map-js@1.2.2: {}
 
   spdx-compare@1.0.0:
     dependencies: