chore: patch dependency advisories and drop bun.lock

[marc0olo]

Stack of 4 — merge bottom to top. Review each layer against the one below it, not main.

→ 1. #284 — security fix: dependency advisories, bun.lock removal
    2. #285 — contributor setup docs
    3. #286 — consumer_install job, retires e2e_test_bun
    4. #288 — consumer install guidance

Repo installs are pnpm-only: pnpm.overrides, minimumReleaseAge and onlyBuiltDependencies are pnpm-only fields, so a second installer resolves a graph that bypasses them. Bun remains a supported consumer runtime, covered by consumer_install (bun) from layer 3.

Scoped to the security fix and the install-path change it forces. Pre-existing documentation gaps in README.md and examples/README.md, including the pnpm run setup step and the canister toolchain, are fixed in #285.

Clears all 24 open Dependabot alerts (1 critical, 13 high, 8 moderate, 2 low). Supersedes #275 and #283.

Bumps vite to ^7.3.5 and vitest to ^4.1.11, and extends pnpm.overrides to cover the 21 transitive advisories. Drops the minimumReleaseAgeExclude: [vite] entry, annotated for removal after 2026-04-16.

Removing bun.lock

pnpm.overrides, minimumReleaseAge and onlyBuiltDependencies are pnpm-only, so bun.lock resolved a second dependency graph that bypassed them. Against the overrides as they stood on main:

pnpm.overrides on main	pnpm-lock.yaml	bun.lock
brace-expansion@>=1 <2 → ^1.1.13	1.1.13	1.1.12
brace-expansion@>=2 <2.0.3 → ^2.0.3	2.0.3	2.0.2
picomatch@>=2 <3 → ^2.3.2	2.3.2	2.3.1
picomatch@>=4 <4.0.4 → 4.0.4	4.0.4	4.0.3
yaml@>=2 <2.8.3 → 2.8.3	2.8.3	2.8.2

This PR then raises several of those bounds to clear the open advisories, so the versions now resolved are brace-expansion 1.1.18 / 2.1.4, picomatch 2.3.2 / 4.0.4 and yaml 2.8.3.

Dependabot cannot keep bun.lock current either: bun is supported for version updates but not security updates, so security PRs updated package.json and pnpm-lock.yaml only, leaving it stale and failing bun i --frozen-lockfile.

e2e_test_bun now installs with pnpm and still builds and tests with bun. Contributor-facing commands move to pnpm to match, including the eight per-example READMEs.

Verified

pnpm audit clean · pnpm i --frozen-lockfile up to date · pnpm test:pic 65 passed · bun run build against the pnpm tree

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

README setup documentation still has two unresolved issues involving PocketIC setup and pnpm instructions.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR patches dependency advisories, standardizes installs on pnpm, and retains Bun runtime testing.

Changes:

• Updates direct and transitive dependencies through pnpm overrides.
• Removes the stale bun.lock and updates Bun CI installation.
• Refreshes contributor setup instructions and workflow badges.

File summaries

File	Summary	Findings
README.md	Updates setup instructions and badges.	Nit (3 votes): Add the explicit PocketIC setup step before the Bun suite. Nit (2 votes): Update the linked examples/README.md to use pnpm instead of bun i.
pnpm-workspace.yaml	Removes the temporary Vite release-age exemption.	None.
pnpm-lock.yaml	Records patched dependency resolutions.	None.
package.json	Upgrades dependencies and adds pnpm overrides.	None.
.github/workflows/e2e-test-nodejs.yml	Installs dependencies with pnpm for Bun runtime tests.	None.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 4/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Outstanding documentation and dependency-rationale corrections must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

examples/README.md:43

• This instruction refers to commands “that follow,” but the build and test commands to be run with Bun are all above this paragraph and nothing follows it. As written, the guide still tells a Bun user to run the preceding pnpm commands; point the instruction at the commands above (or move it before them).

Dependencies are always installed with pnpm so that `pnpm.overrides` and the
release-age policy apply. To run the suites with [bun](https://bun.sh/) instead,
keep the `pnpm i` above and replace `pnpm` with `bun` in the commands that follow.

package.json:59

• The resolver comparison in the PR description is stale relative to this change: it says the pnpm graph uses brace-expansion 1.1.13/2.0.3 and overrides ^1.1.13/^2.0.3, but this file now uses ^1.1.16/^2.1.2 and the lockfile resolves 1.1.18/2.1.4. Please update that table so the security rationale accurately describes the graph being merged.

      "brace-expansion@>=1.0.0 <2.0.0": "^1.1.16",
      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",

• Files reviewed: 5/7 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 5/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Documentation setup instructions omit required PocketIC and canister toolchain prerequisites.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

README.md:35

• Because .npmrc sets ignore-scripts=true, pnpm i does not run packages/pic/postinstall.mjs; a fresh checkout therefore has no packages/pic/pocket-ic, and the documented test setup fails until the explicit pnpm run setup script is run. Add that step after installation.

  pnpm i

examples/README.md:18

• pnpm build:examples invokes icp build in scripts/build-examples.sh, but this setup installs neither the ICP CLI nor mops; those tools are only provisioned by the CI-only setup-canister-toolchain action. A contributor following this guide on a fresh machine therefore reaches command not found before the examples build. Document or automate this toolchain prerequisite before this command.

  pnpm build:examples

• Files reviewed: 13/15 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The dependency, lockfile, CI, and documentation changes span multiple install paths and warrant final human review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 13/15 changed files
• Comments generated: 0 new
• Review effort level: Lite