chore(deps): 7-day install quarantine, dependency updates, 46 → 2 advisories (1.1.3)

[AntoTG]

What this does

Three things, in order: turns on a 7-day install quarantine, updates dependencies, and patches what was left over with overrides.

pnpm audit goes from 46 advisories (14 high / 29 moderate / 3 low) down to 2 (1 high / 1 moderate), both inapplicable to this app. Dependabot currently reports 43 on main.

7-day quarantine

minimumReleaseAge: 10080 in pnpm-workspace.yaml: pnpm refuses any version published less than a week ago. Compromised releases are usually pulled from npm within hours, so this keeps them out of the lockfile entirely.

Verified in practice: viem 2.55.10 (4.1 days old) is held back and 2.55.8 (8.3 days) is installed instead; axios 1.19.0 (1 day) is held back, 1.18.1 goes in.

Expected side effect: pnpm outdated will list packages that are merely in quarantine, not unmaintained. That's documented next to the setting.

Requires pnpm >= 11.18.0

Enabling this forced a bump from pnpm 11.1.1. Earlier versions abort with ERR_PNPM_MISSING_TIME when resolving packages with large metadata documents (es-toolkit, @solana/*, vitest): they fetch the registry's abbreviated metadata, which omits the time field the age filter reads.

Both packageManager and the pnpm/action-setup pin in CI were bumped together so they can't drift apart. The Dockerfile already goes through corepack and picks it up on its own.

Overrides added

Override	Why
ws@>=8.0.0 <8.21.0 → ^8.21.1	Memory-exhaustion DoS from tiny fragments, plus uninitialized memory disclosure. Arrives via viem/walletconnect at 8.18.0. Scoped to the 8.x line so 7.5.13 stays put — it's already patched and @walletconnect/jsonrpc-ws-connection depends on it.
axios → ^1.18.1	Nine advisories against <1.18.0 (inherited proxy in the Node adapter, prototype pollution, runaway recursion in formDataToJSON). Reaches us through @coinbase/cdp-sdk.

@testing-library/jest-dom → 7.0.0

pnpm update had landed on 6.10.0, which npm deprecates as a minor carrying breaking changes. 7.0.0 needs Node >=22 and @testing-library/dom >=10 <11; we satisfy both (Node 24 in CI and Docker, dom 10.4.1).

What stays open, and why

• react-router — RSC-mode CSRF bypass. The fix is react-router 8, a major. This app is a plain SPA (BrowserRouter/Routes/Route, no RSC, no data router), so the vector doesn't exist here.
• uuid — missing bounds check in v3/v5/v6 when the caller supplies its own buf. Transitive through @metamask/utils; forcing uuid 11 breaks that chain, and nothing in the tree calls v3/v5/v6 with its own buffer.

wagmi stays on 2.19.5

Not by choice — it's the last release of the entire 2.x line (254 days old, published the same day as wagmi 3.0.0). RainbowKit 2.2.11 still peers on wagmi: ^2.9.0, has no 3.x branch or prerelease, and the upstream discussion has had no official answer since November 2025.

Worth keeping in mind: until RainbowKit migrates, every new advisory in that subtree will need a manual override — which is exactly what happened here with ws and axios. Getting out means replacing RainbowKit, not bumping a dependency.

Version

Bumps to 1.1.3. Patch release: no behaviour change, only the dependency and supply-chain work described above.

Note that package.json had drifted behind the tags — it still read 1.1.1 on main while v1.1.2 was already tagged and released back in June, hence 1.1.3. The string is consumed by vite.config.ts, which injects it as __APP_VERSION__ for the release link in the footer, so package.json is the only place it needs setting. That footer link will 404 until a v1.1.3 release is cut.

Verification

• pnpm typecheck — clean
• pnpm test — 64 tests across 6 files, all pass
• pnpm build — OK
• pnpm install --frozen-lockfile — stable

pnpm lint still reports its 18 pre-existing errors (10 no-explicit-any, the rest set-state-in-effect), non-blocking in CI. The workflow comment was updated from its stale count of 12.

🤖 Generated with Claude Code

[AntoTG]

@kilocode-bot

[kilo-code-bot]

To use Kilo from GitHub you first need to link your GitHub account to Kilo. Link your Kilo account to continue. After linking, mention me again in this issue or pull request.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• .github/workflows/ci.yml - pins CI to pnpm 11.18.0 and refreshes the lint-status note
• package.json - updates dependencies, pnpm metadata, and the release version to 1.1.3
• pnpm-lock.yaml - resolves the dependency updates and security overrides
• pnpm-workspace.yaml - adds the seven-day release quarantine plus ws and axios overrides

---

_{Reviewed by gpt-5.6-terra · Input: 190.8K · Output: 6.7K · Cached: 996.6K}