fix(PT9-1356): bump nx and vulnerable transitive dependencies to patched versions

[edvardg]

Change Summary

What does this PR change?
Remediates all 34 open High-severity Dependabot alerts. All fixes stay within their current majors; the needs-human-decision list is empty.

• package.json: nx cohort ^22.7.1 → ^22.7.7 (nx + @nx/devkit, eslint, js, vitest, workspace in lockstep; resolves 22.7.8) — fixes the Nx self-hosted remote-cache zip-slip (CVE-2026-71476)
• pnpm-workspace.yaml overrides extended (existing house style): vite 7.x → 7.3.6, axios → 1.18.1, ws 7.x/8.x → 7.5.13/8.21.3, undici 7.x/8.x → 7.29.0/8.10.0, fast-uri → 3.1.5, js-yaml 3.x/4.x → 3.15.1/4.3.1, brace-expansion 1.x/2.x/5.x → 1.1.18/2.1.4/5.0.8+, postcss → 8.5.26, immutable → 4.3.9, adm-zip → 0.6.0, form-data → 4.0.6, tmp → 0.2.7, @babel/plugin-transform-modules-systemjs → 7.29.8. The old axios@<=0.31.0 and undici@<6.24.0 keys had their floors raised to the same patched levels (those edges were already forced cross-major by pre-existing overrides).

Public-registry compliance: this is a public repo, so the lockfile was re-resolved using ONLY the public npm registry (the machine-level @1inch → npm.pkg.github.com scope mapping was explicitly bypassed for all installs). Verified: all @1inch/* packages resolve as public npmjs versions, and the lockfile diff introduces zero non-npmjs URLs (the only GitHub URLs are the pre-existing commit-pinned github: deps — @1inch/aqua, @1inch/swap-vm, forge-std).

One new pin worth knowing: tsdown@0.2.17>rolldown: 1.0.0-beta.13-commit.024b632 — swap-vm pins tsdown ^0.2.17, which depends on the rolldown@nightly dist-tag that no longer exists on npm; any lockfile re-resolution fails without this pin. It is byte-identical to the version the old lockfile already used (same integrity hash). Suggested follow-up: migrate swap-vm to the repo-standard tsdown.

Live alert list: open High alerts

Related Issue/Ticket:
PT9-1356

Testing & Verification

How was this tested?

• Unit tests
• Integration tests
• Manual testing (describe steps)
• Verified on staging

Steps:

• All installs ran with a public-only npm config; final pnpm install is a no-op ("Already up to date")
• Lockfile audit: every target resolves at or above its patched version; zero previously-vulnerable versions remain
• pnpm build (nx run-many) — 3/3 projects (aqua, sdk-core, swap-vm); pnpm lint:types — 3/3
• pnpm test — sdk-core 57/57, aqua 31/31, swap-vm 600/600 (688 total)
• Skipped: e2e targets and forge/contract builds
• New cosmetic warning: isows prints an unmet-peer notice for ws (artifact of pnpm rewriting its ws@* peer with the 7.x override value; ws 8.21.3 genuinely satisfies it, installs/tests unaffected)

Risk Assessment

Risk Level:

• Low - Minor changes, no operational impact
• Medium - Moderate changes, limited impact, standard rollback available
• High - Significant changes, potential operational impact, complex rollback

Risks & Impact

• Build toolchain (nx 22.7.8, vite 7.3.6) — minor-level bumps within majors; full build/typecheck/test matrix green
• SDK runtime deps (ws via ethers/viem, axios) — patch/minor bumps within majors; covered by 688 passing tests
• Lockfile registry provenance — now guaranteed public-npm-only, which is the correct state for a public repo

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud