Document a dependency update cadence and a lockfile policy

[Otaiki1]

Context

The repo pins exact versions in several places (react 19.2.7, vite 8.1.3, poseidon-bls12381 1.0.2) and uses carets in others (@stellar/stellar-sdk ^16.2.0 in two workspaces,
^16.0.1 in a third — already a version skew across workspaces). scripts/check-stellar-sdk-version.mjs
exists to police that one dependency specifically, which suggests the problem has bitten before.

A dependency audit runbook was written; a cadence and a policy were not.

Where to build it

• CONTRIBUTING.md or a new docs/dependencies.md.
• scripts/check-stellar-sdk-version.mjs — the existing guard.
• The four package.json files and contracts/Cargo.toml.

What to do

• Write down which dependencies are pinned exactly and why — poseidon-bls12381 and its circom twin must move together and are correctly pinned; state that reasoning.
• Resolve the @stellar/stellar-sdk skew between app (^16.0.1) and the others (^16.2.0).
• Define a cadence (monthly npm audit + cargo audit, quarterly minor bumps) and who does it.
• Note that this repo runs no CI, so updates are verified by just verify locally before merge.

Acceptance criteria

• Every workspace agrees on the Stellar SDK version range.
• The pinning rationale for the crypto dependencies is written down.

[Gbotemi-ojo]

@Gbotemi-ojo has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Kindly assign this task to me maintainer,i would fix this bug and conflict free

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Gbotemi-ojo to this issue.

[believetimothy]

@believetimothy has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I can fix this issue.
Please assign me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @believetimothy to this issue.

[drips-wave]

Congratulations, @Gbotemi-ojo! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Gbotemi-ojo: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊