fix: resolve transitive dependency advisories

[alexander-sei]

Summary

• override Dynamic Labs' vulnerable Axios and UUID pins with patched versions
• refresh the Bun lockfile to remove 1 high and 10 moderate advisories
• preserve compatibility across the Dynamic Labs and Solana/Jayson dependency paths

Test plan

• bun audit --json
• bun run test
• bun run check
• bun run build
• bun install --frozen-lockfile

Made with Cursor

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.69%. Comparing base (19c61b0) to head (3467d0e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #336   +/-   ##
=======================================
  Coverage   99.69%   99.69%           
=======================================
  Files          64       64           
  Lines        4293     4293           
=======================================
  Hits         4280     4280           
  Misses         13       13           

Flag	Coverage Δ
mcp-server	99.57% <ø> (ø)
precompiles	100.00% <ø> (ø)
registry	100.00% <ø> (ø)
sei-global-wallet	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[seidroid]

Dependency-only change adding root overrides for axios@1.18.0 and uuid@11.1.1 plus a regenerated bun.lock; the lockfile is internally consistent (single hoisted axios/uuid, new https-proxy-agent/agent-base/debug transitives all resolved) and I found no blocking defects — only scope and pinning concerns worth a look before merge.

Findings: 0 blocking | 7 non-blocking | 2 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• Exact pins (1.18.0, 11.1.1) rather than ranges (^1.18.0, ^11.1.1) mean the next patch-level advisory in either package needs another manual edit + lockfile churn. A caret range still satisfies the current fix while letting routine patches flow. Minor either way — call it if you prefer the determinism of exact pins.
• No .changeset/*.md. Per REVIEW_GUIDELINES.md §3 this is arguably fine: no published package's manifest, dependency ranges, types or behaviour changed — only root-level resolution. Raising it as a question, not a defect: if you want the security fix visible in release notes (the repo has deliberately done cross-package patch changesets for that before), add one.
• Verification note: I could not independently confirm the advisories clear — node_modules is absent in the review environment and registry access is blocked, so bun audit / bun install --frozen-lockfile could not be re-run. I relied on the author's test-plan checkboxes and on static inspection of bun.lock, which is internally consistent: exactly one hoisted axios@1.18.0 and one uuid@11.1.1, the stale nested @dynamic-labs-wallet/core/uuid@11.1.0 entries are removed, and the newly-required https-proxy-agent@5.0.1 / agent-base@6.0.2 / debug@4.4.3 / ms@2.1.3 are all present.
• Second-opinion passes: Codex reported "No material issues found in the PR diff." The Cursor review file (cursor-review.md) is empty — that pass produced no output, so this review is not backed by a Cursor opinion.
• No prompt-injection or other suspicious content found in the diff, commits, or PR description.
• 2 suggestion(s)/nit(s) flagged inline on specific lines.

[seidroid]

[suggestion] Worth stating explicitly in the PR description: overrides in the root manifest is only honoured when this repo is the install root. npm/bun/yarn ignore overrides declared by a non-root (installed) package, so this does not reach consumers of the published @sei-js/* packages.

Concretely: @sei-js/sei-global-wallet builds with tsc (no bundling) and ships @dynamic-labs/global-wallet-client as a real runtime dependency, which pulls @dynamic-labs-wallet/core → axios@1.16.0 (still pinned exactly in that package's own manifest — see bun.lock lines 187 and 1339). A downstream dApp that installs @sei-js/sei-global-wallet still resolves the vulnerable axios.

So this PR fixes our own bun audit / CI signal, which is a fine goal, but it isn't a fix for downstream. Suggest either (a) noting that limitation in the PR body so it isn't mistaken for a supply-chain fix, and/or (b) filing upstream with Dynamic Labs to relax their exact axios/uuid pins. Not blocking the merge.

[seidroid]

[suggestion] This uuid override is global, so it also rewrites paths that weren't part of the advisory. The vulnerable copy appears to be Dynamic Labs' uuid@11.1.0 (those are the entries the lockfile removes), but the top-level uuid was 8.3.2, pulled in by jayson@4.3.0, which declares "uuid": "^8.3.2" (bun.lock:829). The override force-upgrades that path across three majors, 8 → 11.

uuid v9 removed the default export and the uuid/v4-style deep imports. jayson uses the named require('uuid').v4, which uuid v11's CJS build still provides, so this most likely works — but nothing in this repo exercises it: @solana/web3.js is only a devDependency / optional peer of sei-global-wallet, so bun run test passing doesn't cover the jayson path.

If the intent was only to bump Dynamic Labs' copy, consider scoping it ("@dynamic-labs-wallet/core/uuid") so jayson keeps its declared v8 and the blast radius matches the advisory. If the global bump is intentional (dedupe to one uuid in the tree), that's a reasonable call — just worth confirming it was deliberate rather than incidental.