Clear the Dependabot alerts

[clement-ux]

Summary

Dependabot alerts were just enabled on this repo, and the scan found 128 open alerts. This PR fixes 127 of them without touching any contract source. The remaining one has no fix published upstream.

The Talos actions image runs pnpm install --frozen-lockfile without --prod, so dev dependencies ship in the image too. That is why the runtime and dev-tooling fixes go in together.

Group	Alerts	Fix
axios 1.4.0 (only used by tasks/merkl.js)	52	Bump to 1.20.0. This also lifts form-data and follow-redirects.
npm @openzeppelin/contracts 4.4.2 and @chainlink/contracts-ccip 1.2.1 (which pulled OZ 3.4.2 / 4.3.3, OZ upgradeable 4.7.3 and @eth-optimism/*)	26	Removed. Nothing in JS imports them, and Foundry compiles against the soldeer copies in dependencies/ (see remappings and libs in foundry.toml). Our contracts don't import any of the affected OZ modules (ECDSA, Governor, SignatureChecker, ERC165Checker, MerkleProof, Base64, TransparentUpgradeableProxy).
Runtime transitive deps: elliptic (the critical one, used by ethers v5 signing), ws, bn.js, js-yaml, qs, fast-xml-builder	23	pnpm overrides in pnpm-workspace.yaml.
Dev tooling (mocha, eslint, solhint, upgrades-core): fast-uri, brace-expansion, minimatch, serialize-javascript, lodash, nanoid, picomatch, flatted, plus ajv, diff and pbkdf2 flagged by pnpm audit	26	pnpm overrides.

How the overrides work:

• Each override selector only matches the vulnerable range and lifts it to the first patched release of the same major, so nothing else moves.
• ws is overridden by parent package. A bare ws@<range> selector also rewrote isows' ws: "*" peer range and caused an unmet-peer warning.
• serialize-javascript is the one major bump (6 → 7, for mocha only). Its RCE fix was never backported to 6.x; 7.x keeps the same API and needs Node ≥ 20.
• Every target version is older than our 7-day minimumReleaseAge.

Left open (no upstream fix):

• elliptic GHSA-848j-6mx2-7j84 (low, "risky primitive", affects all versions ≤ 6.6.1). Alert Remove IViewVault and IViewMinMaxOracle interfaces #402 can be dismissed as "no fix available".
• braces ≤ 3.0.3 is reported by pnpm audit only, and no patched release exists.

Result

• pnpm audit: 135 advisories → 2. These are the two with no upstream fix above.
• Dependabot: 128 alerts → 1 expected after merge. This is computed by matching every open alert's vulnerable range against the new lockfile.
• Lockfile: −270 net lines.

Testing

• pnpm install --frozen-lockfile passes.
• make build-contracts and make build-scripts pass.
• pnpm test:tasks (75), pnpm test:scripts and pnpm test:layouts pass.
• pnpm lint (eslint + solhint), pnpm typecheck and prettier pass.
• The Talos catalog loads 35 actions.
• ethers 5.7.2 with elliptic 6.6.1: signing and recovering a type-2 transaction, a personal message and EIP-712 typed data all work.
• axios 1.20.0: the real tasks/merkl.js request (api.merkl.xyz/v4/users/…/rewards) returns 200.
• @aws-sdk/client-kms, @lodestar/config and the @safe-global kits all load.

Follow-ups

• Once this is merged, OriginProtocol/origin-dollar#3018 (removing Snyk) can land, since Dependabot now covers dependencies.
• Not done here: the Talos image could install with --prod and move what it needs into dependencies. That would take the dev tooling out of the signing container altogether.

🤖 Generated with Claude Code