chore(deps): drop unused wallet kit, closing 74 of 76 advisories

[tiamo]

Closes the Dependabot backlog. Alerts are computed on the default branch, so they stay
open until this reaches main.

Result

pnpm audit: 66 → 0

	before	after
critical	1	0
high	27	0
moderate	36	0
low	2	0

Dependabot alerts: 76 → 2 (both remaining are Rust, see below).

What changed

@creit.tech/stellar-wallets-kit removed from client-sdk and farms-sdk.
It was declared in both manifests but imported nowhere. client-sdk/src/services/swap.ts
says why:

"Minimal interface that executeSwap needs from the wallet kit. We don't pull in
@creit.tech/stellar-wallets-kit here to keep the SDK's dependency surface narrow —
TransactionHelper.signAndSend is the only consumer and it just needs a
signTransaction callable."

The SDK already takes a structural SigningKit interface. The manifest entries were
leftovers. Dropping them removed 520 transitive packages (pnpm-lock.yaml: 1840 → 870
entries) and closed 61 alerts, including elliptic GHSA-848j-6mx2-7j84, for which no
patched version exists — removing the source was the only available fix.

This supersedes #201, which bumped the same dependency; it is now closed.

tests/fuzz/Cargo.lock deleted. tests/fuzz is a member of the root workspace
(members = [..., "tests/fuzz"]), so cargo metadata --manifest-path tests/fuzz/Cargo.toml
reports workspace_root = repo root — the nested lockfile was never read. It had not been
touched since June 2025 and still pinned soroban-sdk 22.0.8 against a manifest requiring
^25.0.0. 10 alerts.

pnpm-workspace.yaml — added overrides.postcss: ^8.5.23 for the last dev-only chain
(@antfu/eslint-config → @vue/compiler-sfc → postcss → nanoid); pruned 11 allowBuilds
and 4 trustPolicyExclude entries whose packages no longer resolve.

Side effect: @stellar/stellar-sdk unified from three ranges (^14.4.0, ^14.1.1,
^14.1.1) to ^14.6.1.

Verified

• pnpm audit — 0 vulnerabilities
• pnpm install --frozen-lockfile — clean
• cargo nextest run --workspace --lib — 320 passed, 1 skipped
• cargo check -p lending-fuzz --all-targets — builds without its lockfile
• tsc --noEmit — clean in client-sdk (the package that held the kit) and cli
• eslint clean on every file touched

Not fixed here

Two Rust alerts remain and cannot move inside soroban-sdk ^25: soroban-env-common 25.2.2
declares stellar-xdr =25.0.0 exactly.

• chore(deps-dev): bump @types/node from 22.15.30 to 24.0.0 #6 stellar-xdr GHSA-x57h-xx53-v53w (medium)
• chore(deps-dev): bump @types/node from 22.15.30 to 24.0.0 #7 soroban-env-host GHSA-pm4j-7r4q-ccg8 (low)

Both need soroban-sdk ≥ 26, which rebuilds every wasm and implies an on-chain redeploy.
That is blocked upstream regardless: sep-40-oracle 1.4.0 requires soroban-sdk ^25.0.1
and soroban-fixed-point-math 1.5.0 requires ^25. script3/soroban-fixed-point-math#11
("Upgrade to Soroban SDK 27") is open; script3/sep-40-oracle has no p27 branch yet.

Worth noting separately: mainnet is on protocol 27 while we compile against SDK 25.

Unrelated pre-existing issues spotted

• vitest is not installed and never was (0 entries in the lockfile at any commit), so
  pnpm test has always failed. One test file exists: client-sdk/src/utils/pool-status.test.ts.
• packages/sdk/* fail declaration emit under TypeScript 6 with TS5011 (rootDir must
  be set explicitly), so consumers of the link: bindings cannot typecheck from a clean tree.

[Copilot]

🟢 Approval recommended

The removed dependency is not imported anywhere (only referenced in a comment), the fuzz crate is a confirmed workspace member, and the workspace override aligns with the resolved lockfile versions.

Pull request overview

This PR reduces the dependency/security surface by removing an unused wallet-kit dependency and tightening workspace-level pnpm policies, with the goal of clearing the Dependabot and pnpm audit vulnerability backlog.

Changes:

• Removed @creit.tech/stellar-wallets-kit from client-sdk and farms-sdk manifests and unified @stellar/stellar-sdk to ^14.6.1 across packages touched.
• Deleted tests/fuzz/Cargo.lock (the fuzz crate is a workspace member, so the root lockfile governs resolution).
• Added a workspace override to keep postcss on a patched 8.5.x line and pruned pnpm policy exceptions that no longer apply.

File summaries

File	Description
tests/fuzz/Cargo.lock	Removes the nested lockfile for the fuzz workspace member.
pnpm-workspace.yaml	Adds a postcss override and prunes trust/build policy exceptions.
packages/farms-sdk/package.json	Drops unused wallet-kit dependency; bumps @stellar/stellar-sdk range; formatting cleanup.
packages/client-sdk/package.json	Drops unused wallet-kit dependency; bumps @stellar/stellar-sdk range; formatting cleanup.
packages/cli/package.json	Unifies @stellar/stellar-sdk version and bumps tsx patch.
package.json	Updates dev tooling versions and unifies root @stellar/stellar-sdk range.

Review details

• Files reviewed: 5/7 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.