fix: pin exact dependency versions for critical packages

[Olayiwola2904]

Overview

This PR pins critical dependencies to exact versions in package.json so that bun install cannot silently pull in compromised or buggy minor/patch releases. The affected packages are @stellar/stellar-sdk, express, and dotenv, plus other security-sensitive dependencies, and the pinning strategy is documented for future maintenance.

Related Issue

Closes the dependency-pinning bounty issue

Changes

🔒 Exact Dependency Pinning

• [MODIFY] package.json

  • Pin @stellar/stellar-sdk, express, and dotenv to exact versions.
  • Remove caret (^) ranges from all critical dependencies.
  • Ensure security-sensitive packages use exact version strings.

• [MODIFY] bun.lock / package-lock.json

  • Regenerate lockfiles after pinning to keep resolutions in sync with package.json.

• [ADD] docs/adr/004-dependency-pinning.md

  • Document the pinning strategy, the list of pinned packages, and the rationale.
  • Explain the review/update process for security patches.

• [MODIFY] SECURITY.md

  • Add dependency-pinning policy and supply-chain risk guidance.

• [MODIFY] README.md

  • Note that critical dependencies are pinned to exact versions.

Verification Results

npm install
✅ Critical deps pinned: @stellar/stellar-sdk, express, dotenv
✅ bun.lock regenerated and in sync with package.json
✅ docs/adr/004-dependency-pinning.md added
✅ SECURITY.md updated with pinning policy

Acceptance Criteria	Status
Critical packages pinned to exact versions in package.json	✅ @stellar/stellar-sdk, express, and dotenv now use exact versions
bun.lock reflects pinned versions	✅ Regenerated after pinning
Documentation explains which packages are pinned and why	✅ docs/adr/004-dependency-pinning.md + SECURITY.md
Security-sensitive packages pinned	✅ All critical dependencies are pinned, with no ^ ranges remaining

Closes #537

[drips-wave]

@Olayiwola2904 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits