fix: clear critical vitest advisory and add security audit gate

.github/workflows/ci.yml

@@ -35,6 +35,21 @@ jobs:
         if: github.event_name == 'pull_request'
         run: pnpm test:fuzz:sample
 
+  security-audit:
+    name: Security audit (fail on unapproved critical advisories)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm audit:ci
+
   entrypoints:
     name: Package entry point smoke tests
     runs-on: ubuntu-latest

package.json

@@ -70,7 +70,9 @@
     "test:heap-leak": "node --expose-gc ./node_modules/vitest/vitest.mjs run test/leaks/heap-snapshot.test.ts --pool=threads",
     "size": "size-limit",
     "api:check": "api-extractor run --config api-extractor.json && api-extractor run --config api-extractor-evm.json && api-extractor run --config api-extractor-stellar.json && api-extractor run --config api-extractor-solana.json && api-extractor run --config api-extractor-ckb.json && api-extractor run --config api-extractor-vault.json",
-    "pack:check": "node scripts/release/verify-pack.mjs"
+    "pack:check": "node scripts/release/verify-pack.mjs",
+    "audit": "pnpm audit",
+    "audit:ci": "node scripts/security-audit.mjs"
   },
   "size-limit": [
     {
@@ -180,6 +182,6 @@
     "tsup": "^8.4.0",
     "typedoc": "^0.28.19",
     "typescript": "^5.7.0",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.6"
   }
 }

packages/codemod/package.json

@@ -29,6 +29,6 @@
     "@types/node": "^20.19.43",
     "tsup": "^8.4.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.6"
   }
 }

packages/sdk-agent/package.json

@@ -26,6 +26,6 @@
   "devDependencies": {
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.6"
   }
 }

packages/sdk-react/package.json

@@ -37,7 +37,7 @@
     "@types/react-dom": "^18.0.0",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.0.0",
+    "vitest": "^3.2.6",
     "@testing-library/react": "^14.0.0",
     "@testing-library/jest-dom": "^6.0.0",
     "jsdom": "^24.0.0"

packages/sdk-solid/package.json

@@ -37,6 +37,6 @@
     "tsup": "^8.4.0",
     "typescript": "^5.7.0",
     "vite-plugin-solid": "^2.11.0",
-    "vitest": "^3.1.0"
+    "vitest": "^3.2.6"
   }
 }

packages/sdk-svelte/package.json

@@ -37,7 +37,7 @@
     "svelte": "^5.0.0",
     "tsup": "^8.4.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.1.0",
+    "vitest": "^3.2.6",
     "@sveltejs/vite-plugin-svelte": "^5.0.0",
     "svelte-check": "^4.0.0"
   }

packages/sdk-vue/package.json

@@ -30,7 +30,7 @@
   "devDependencies": {
     "tsup": "^8.4.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.1.0",
+    "vitest": "^3.2.6",
     "@vue/test-utils": "^2.4.0",
     "jsdom": "^25.0.0"
   },