Harden dependency audit baseline

[knzeng-e]

Outcome

This PR hardens the current dependency/audit baseline without changing Dotify runtime behavior or the Product DevNet SDK pins.

Issue and context

Refs #85 for Product SDK compatibility evidence. This is a maintenance slice before deeper blockchain payment work: reduce safe audit exposure now, and make the remaining SDK/toolchain drift explicit so it does not hide behind app feature PRs.

Architecture and key concepts

The change is intentionally split by surface:

• web: fixes the vulnerable brace-expansion override and refreshes safe lockfile versions already allowed by package ranges.
• services/api: refreshes Fastify/viem/transitive lockfile versions inside declared ranges, bringing the backend audit to zero.
• contracts/evm: refreshes Hardhat 2-line dev-tooling lockfile versions, while leaving the Hardhat 3 migration out of scope.
• docs: records the exact dependency snapshot, latest official npm versions checked on 2026-08-25, residual audit findings, and why Product SDK/PAPI and Hardhat 3 upgrades are dedicated follow-ups.

No environment variables, hosted settings, contract addresses, CORS origins, or deploy commands change.

How it works

The frontend build still uses the pinned Product DevNet SDK baseline: @parity/product-sdk 0.20.1, host 0.15.1, statement-store 0.6.2, descriptors 0.8.0, and polkadot-api 1.23.3. This PR only applies safe patch/minor lock updates around that baseline and documents the newer official versions.

The API keeps the same package ranges but resolves to patched transitive packages such as fast-uri 3.1.6, find-my-way 9.9.0, ws 8.21.0, and viem 2.55.19.

The contracts package remains on Hardhat 2.29.1. Forced audit remediation points to Hardhat 3 and newer plugin majors, so that migration is intentionally deferred.

Design decisions and tradeoffs

• Did not run npm audit fix --force: it would move Product/PAPI and Hardhat paths through breaking changes with direct impact on Product Mobile, CDM/PAPI, and contract tooling.
• Did not upgrade React, Vite, TypeScript, or PAPI majors here: those are broad compatibility migrations.
• Did update docs because the previous Product SDK snapshot was stale and the residual audit risk matters for the next payment/runtime work.
• Did not update docs/index.html: no public capability, product positioning, or public roadmap promise changed.

Security, failure, and operations

This reduces known vulnerable transitive packages where npm can do so safely. The PR does not claim a clean web audit: deepmerge-ts and nanoid remain through Product/PAPI runtime dependencies and need a dedicated SDK compatibility pass. The contracts package is clean for --omit=dev, but full audit still reports Hardhat 2 dev-tooling findings.

Operational docs now point to docs/operations/dependency-security-status.md as the evidence snapshot for this pass.

Review guide

Suggested order:

1. web/package.json and web/package-lock.json: verify the only package.json change is brace-expansion 5.0.9 and lockfile updates stay inside declared ranges.
2. services/api/package-lock.json: verify this is a lockfile-only remediation and no env contract changes.
3. contracts/evm/package-lock.json: verify it stays on Hardhat 2 and does not introduce a forced major migration.
4. docs/operations/dependency-security-status.md: verify the residual risks and deferred migrations are honest.
5. Product docs: verify the pinned-vs-latest Product SDK wording matches the current compatibility doctrine.

Verify carefully:

• No Product SDK major/minor pin was changed accidentally.
• No deployment config or env variable meaning changed.
• The residual audit failures are not described as solved.
• The deferred SDK work remains a compatibility task, not a blocker for standalone first sound.

Validation

Evidence	What it proves
npm audit --audit-level=moderate in services/api	Backend API audit is clean.
npm audit --omit=dev --audit-level=moderate in contracts/evm	Contract package has no production/runtime audit findings.
npm run test in services/api	Key delivery, catalog, CORS, TURN, auth, uploads, signatures, and readiness still pass.
npm run build in services/api	API TypeScript build still passes.
npm run lint in web	Web lint passes with the 3 known React hook warnings.
npm run test:unit in web	324 frontend unit tests pass.
npm run build in web	Standard Vite build passes with known chunk/protectedAudio warnings.
npm run build:product-devnet in web	Product build passes; bootstrap refresh skipped because catalog fetch failed and kept the existing snapshot.
npm run test:e2e -- e2e/classic-unlock.spec.ts e2e/artist-publish.spec.ts in web	Critical Classic unlock and artist publish flows still pass.
npm test in contracts/evm	53 contract/tooling tests pass on the updated Hardhat 2 lockfile.

Known limitations and follow-ups

• Web full audit still reports 25 high-severity findings through Product/PAPI runtime dependencies. Next: Product SDK/PAPI compatibility branch.
• Contracts full audit still reports 24 findings through Hardhat 2 dev-tooling. Next: Hardhat 3 migration branch.
• React 19, Vite 8, TypeScript 7, and PAPI 3 remain deferred migrations.

Pre-PR alignment check

• Dependency / SDK currency: checked npm latest versions on 2026-08-25 and recorded drift in docs.
• Improvement flags: Product SDK/PAPI migration, Hardhat 3 migration, and bundle chunking remain follow-ups.
• Philosophical alignment: this work protects the invisible trust layer without adding wallet friction, changing room behavior, or weakening artist-owned access boundaries.

Metadata checklist

• Backlog issue referenced where applicable: [Product SDK][P1] Prove Product host compatibility before integration #85
• Operational documentation updated
• No env/config value changed
• Validation evidence included
• Residual risks stated explicitly

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dcac16b127

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the public page with the revised SDK roadmap

This changes the active Product roadmap by documenting newer SDK versions and deferring their upgrade to a dedicated compatibility task, but docs/index.html is absent from the commit. The public-facing roadmap therefore does not reflect the revised compatibility gate; update its Adaptive Product/current-gate narrative in the same change.

AGENTS.md reference: AGENTS.md:L50-L55

Useful? React with 👍 / 👎.

[knzeng-e]

reviewed