fix(deps): remediate pnpm audit findings

[0xJem]

Summary

The dependency audit no longer reports the three high-severity brace-expansion and js-yaml vulnerabilities. Range-scoped overrides preserve compatibility for each affected dependency line, while an explicit empty allowBuilds map keeps pnpm 11's dependency-build policy default-deny.

Validation

• pnpm install --no-frozen-lockfile
• pnpm install --frozen-lockfile
• pnpm audit --audit-level moderate — no known vulnerabilities
• forge build
• pnpm run lint:check
• pnpm run test:unit — 3,954 tests passed
• coderabbit review --agent --base develop — 0 findings across the two changed files

Fork tests were not run because this worktree has no .env or ALCHEMY_API_KEY. The metrics report command exited successfully, but its existing Surya graph phase logged a caught TypeError.

Summary by CodeRabbit

• Chores
  • Updated package version policies to improve compatibility and security.
  • Refined handling for selected transitive dependencies without changing user-facing functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ec8331cf-7496-4418-8710-b075791a84bb

📥 Commits

Reviewing files that changed from the base of the PR and between 2519e32 and 46f685f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

Updates pnpm-workspace.yaml with an empty allowBuilds configuration and revised transitive dependency overrides for brace-expansion and js-yaml.

Changes

Dependency policy

Layer / File(s)	Summary
Workspace override configuration pnpm-workspace.yaml	Adds allowBuilds: {}, expands the brace-expansion override range, and changes the js-yaml override threshold to <4.3.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• OlympusDAO/olympus-v3#226: Updates pnpm dependency override and install-guard configuration.
• OlympusDAO/olympus-v3#291: Modifies the brace-expansion override ranges.
• OlympusDAO/olympus-v3#303: Modifies the js-yaml override range.

Suggested reviewers: zeroxnoodle

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the dependency override changes made to address pnpm audit findings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pnpm-audit-20260721

---

_{Comment @coderabbitai help to get the list of available commands.}

[0xJem]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.