Pin exact dependency versions for critical packages

[sshdopey]

What

All dependencies use caret ranges (^). A compromised or buggy minor version could be silently pulled in during bun install.

Why

Supply-chain attacks often target popular packages with malicious minor/patch releases. Pinning critical packages prevents silent upgrades.

Scope

• Pin @stellar/stellar-sdk to exact version
• Pin express to exact version
• Pin security-sensitive packages to exact versions
• Document the pinning strategy

Acceptance Criteria

• Critical packages pinned to exact versions in package.json
• bun.lock reflects pinned versions
• Documentation explains which packages are pinned and why

Technical Context

• package.json:12-16 — dependencies with caret ranges
• @stellar/stellar-sdk, express, dotenv are critical
• bun.lock ensures reproducibility regardless

[franklin251861-killer]

@franklin251861-killer has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would like to work on this issue, assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @franklin251861-killer to this issue.

[xeexco]

@xeexco has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi! I’m a full-stack developer with a strong blockchain background. I’d love to handle this issue and can deliver a clean, reliable solution. Kindly assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @xeexco to this issue.

[Olayiwola2904]

@Olayiwola2904 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’ve gone through the issue and understand the requirements. I can work on it and meet the expected criteria.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Olayiwola2904 to this issue.

[drips-wave]

Congratulations, @Olayiwola2904! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Olayiwola2904: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊