Harden dependency audit baseline - #124

Outcome

This PR hardens the current dependency/audit baseline without changing Dotify runtime behavior or the Product DevNet SDK pins.

Issue and context

Refs #85 for Product SDK compatibility evidence. This is a maintenance slice before deeper blockchain payment work: reduce safe audit exposure now, and make the remaining SDK/toolchain drift explicit so it does not hide behind app feature PRs.

Architecture and key concepts

The change is intentionally split by surface:

• web: fixes the vulnerable brace-expansion override and refreshes safe lockfile versions already allowed by package ranges.
• services/api: refreshes Fastify/viem/transitive lockfile versions inside declared ranges, bringing the backend audit to zero.
• contracts/evm: refreshes Hardhat 2-line dev-tooling lockfile versions, while leaving the Hardhat 3 migration out of scope.
• docs: records the exact dependency snapshot, latest official npm versions checked on 2026-08-25, residual audit findings, and why Product SDK/PAPI and Hardhat 3 upgrades are dedicated follow-ups.

No environment variables, hosted settings, contract addresses, CORS origins, or deploy commands change.

How it works

The frontend build still uses the pinned Product DevNet SDK baseline: @parity/product-sdk 0.20.1, host 0.15.1, statement-store 0.6.2, descriptors 0.8.0, and polkadot-api 1.23.3. This PR only applies safe patch/minor lock updates around that baseline and documents the newer official versions.

The API keeps the same package ranges but resolves to patched transitive packages such as fast-uri 3.1.6, find-my-way 9.9.0, ws 8.21.0, and viem 2.55.19.

The contracts package remains on Hardhat 2.29.1. Forced audit remediation points to Hardhat 3 and newer plugin majors, so that migration is intentionally deferred.

Design decisions and tradeoffs

• Did not run npm audit fix --force: it would move Product/PAPI and Hardhat paths through breaking changes with direct impact on Product Mobile, CDM/PAPI, and contract tooling.
• Did not upgrade React, Vite, TypeScript, or PAPI majors here: those are broad compatibility migrations.
• Did update docs because the previous Product SDK snapshot was stale and the residual audit risk matters for the next payment/runtime work.
• Did not update docs/index.html: no public capability, product positioning, or public roadmap promise changed.

Security, failure, and operations

This reduces known vulnerable transitive packages where npm can do so safely. The PR does not claim a clean web audit: deepmerge-ts and nanoid remain through Product/PAPI runtime dependencies and need a dedicated SDK compatibility pass. The contracts package is clean for --omit=dev, but full audit still reports Hardhat 2 dev-tooling findings.

Operational docs now point to docs/operations/dependency-security-status.md as the evidence snapshot for this pass.

Review guide

Suggested order:

1. web/package.json and web/package-lock.json: verify the only package.json change is brace-expansion 5.0.9 and lockfile updates stay inside declared ranges.
2. services/api/package-lock.json: verify this is a lockfile-only remediation and no env contract changes.
3. contracts/evm/package-lock.json: verify it stays on Hardhat 2 and does not introduce a forced major migration.
4. docs/operations/dependency-security-status.md: verify the residual risks and deferred migrations are honest.
5. Product docs: verify the pinned-vs-latest Product SDK wording matches the current compatibility doctrine.

Verify carefully:

• No Product SDK major/minor pin was changed accidentally.
• No deployment config or env variable meaning changed.
• The residual audit failures are not described as solved.
• The deferred SDK work remains a compatibility task, not a blocker for standalone first sound.

Validation

Known limitations and follow-ups

• Web full audit still reports 25 high-severity findings through Product/PAPI runtime dependencies. Next: Product SDK/PAPI compatibility branch.
• Contracts full audit still reports 24 findings through Hardhat 2 dev-tooling. Next: Hardhat 3 migration branch.
• React 19, Vite 8, TypeScript 7, and PAPI 3 remain deferred migrations.

Pre-PR alignment check

• Dependency / SDK currency: checked npm latest versions on 2026-08-25 and recorded drift in docs.
• Improvement flags: Product SDK/PAPI migration, Hardhat 3 migration, and bundle chunking remain follow-ups.
• Philosophical alignment: this work protects the invisible trust layer without adding wallet friction, changing room behavior, or weakening artist-owned access boundaries.

Metadata checklist

• Backlog issue referenced where applicable: [Product SDK][P1] Prove Product host compatibility before integration #85
• Operational documentation updated
• No env/config value changed
• Validation evidence included
• Residual risks stated explicitly