Clear the Dependabot alerts

[clement-ux]

Summary

Fixes 59 of the 61 open Dependabot alerts on arm-oeth, with no contract or task code changes. This is the same approach as OriginProtocol/origin-dollar#3020.

All 61 alerts are on dev dependencies. However, the Talos actions image runs pnpm install --frozen-lockfile without --prod, so they all ship in the container that signs ARM transactions. Most of them come from Hardhat 2, which runs every ARM action. The latest 2.x release (2.29.1) still pins the same old transitive versions, so bumping Hardhat does not help.

Package	Alerts	Pulled by	Fix
axios 1.14.0	24 (+ form-data)	direct	^1.20.0
undici 5.29.0 (+ @fastify/busboy 2.1.1)	10	hardhat	hardhat>undici → ^6.28.1. All fixes exist only in 6.x. See below.
adm-zip 0.4.16	4	hardhat	^0.6.1
immutable 4.3.8	2	hardhat	^4.3.9
ws 7.5.10 / 8.17.1 / 8.18.0	2	hardhat, ethers, @ethersproject/providers	^7.5.11 / ^8.21.0, scoped by parent
tmp 0.0.33	2	solc	^0.2.6
cookie 0.4.2	1	@sentry/node (Hardhat telemetry)	^0.7.0
js-yaml, fast-xml-builder, follow-redirects, brace-expansion, serialize-javascript	13	eslint, mocha, solc, aws-sdk	first patched release; serialize-javascript 6 → 7 for mocha

pbkdf2 (from ethereum-cryptography) is also lifted to 3.1.7. Only pnpm audit flags it.

The one change to watch: undici 6 under Hardhat 2. undici is Hardhat 2's HTTP client, so it carries every RPC call of every ARM action. The 9 undici advisories (request smuggling, CRLF and header injection, response splitting) are only fixed in 6.x. I checked:

• a mainnet read through Hardhat (hardhat snap --arm WETH), which reads ARM state and calls the Kyber API;
• a write sent through Hardhat's HTTP provider to an anvil fork (hardhat collectFees --arm Lido, impersonated): the transaction was sent, mined and logged;
• hardhat compile --force.

If you'd rather keep undici 5, drop the single hardhat>undici line. That leaves 10 alerts open.

Left open (2):

• Fix storage variable gap #89 uuid 8.3.2 (medium). The bug is in v3/v5/v6 with a caller-supplied buffer; Hardhat only uses v4. The fix is in 11.x. Dismiss as "vulnerable code not used".
• Adjust 1Inch prices by 10 bps infra fee #60 elliptic 6.6.1 (low, GHSA-848j-6mx2-7j84). No patched release exists. Dismiss as "no fix available".

Result

• Dependabot: 61 → 2 expected after merge. This is computed by matching each open alert's vulnerable range against the new lockfile.
• pnpm audit: 3 left (uuid and elliptic above, plus braces ≤ 3.0.3, which has no patched release).
• Every target version is older than the repo's 7-day minimumReleaseAge.

Testing

• pnpm install --frozen-lockfile and pnpm lint pass.
• hardhat compile --force, hardhat snap --network mainnet --arm WETH and hardhat collectFees --network local --arm Lido (anvil fork) all pass.
• The Talos catalog dump (NODE_PATH=node_modules/.pnpm/node_modules node dump-actions-catalog.cjs, as in dockerfile-actions) produces 151 entries.
• pnpm prettier:check (src/abis/OriginARMV1.json) and pnpm typecheck (missing @types/node) fail the same way on main. This PR doesn't change either.

🤖 Generated with Claude Code