fix(deps): resolver vulnerabilidades de pnpm audit (overrides)

[iicc1]

Resumen

Resuelve las vulnerabilidades de pnpm audit (13 → 0) mediante overrides, sin cambios en las dependencias declaradas. Todas eran transitivas del árbol de Docusaurus.

Cambios de seguridad

Se añaden overrides en pnpm-workspace.yaml (la ubicación que lee pnpm 11; el campo pnpm de package.json ya no se lee):

Paquete	Parcheado a	Severidad
shell-quote	1.8.4	Critical (escape de newlines / command injection)
serialize-javascript	7.0.5	High (RCE + DoS)
lodash	4.18.1	High (code injection vía _.template + prototype pollution)
joi	18.2.1	Moderate (RangeError no capturado)
ajv	8.20.0	Moderate (ReDoS)
js-yaml	4.1.1	Moderate (prototype pollution)
yaml	1.10.3	Moderate (stack overflow)
ws	8.21.0	Moderate (memory disclosure)
uuid	11.1.1	Moderate
qs	6.15.2	Moderate (DoS)

Los selectores son por rango, de modo que los consumidores de otros majors quedan intactos (js-yaml 3.x, ajv 6.x, ws 7.x sin tocar).

Verificación

• pnpm audit → 0 vulnerabilidades.
• pnpm build (docusaurus) → SUCCESS (los warnings de "broken anchors" son pre-existentes, idénticos a la base).
• pnpm smoke:test (vitest) → 32/32 OK, incluidos los guards que vigilan el major de Docusaurus.

Nota

Como develop ya iba por delante de main, este PR incluye también un commit previo no relacionado con seguridad: chore: update sui json-rpc to graphql (toca docs/public-nodes/public-endpoints.md).

🤖 Generated with Claude Code

[kilo-code-bot]

WARNING: The Joi override installs a Node 20-only package

package.json still declares support for Node >=18.0, but [email protected] declares engines: {node: '>= 20'} in the updated lockfile. Anyone installing this project on Node 18 with strict engine checks enabled will fail dependency installation, and without strict checks Docusaurus will run against a transitive version outside the declared Node support. Either raise the project engine to Node 20 or choose a patched Joi version that supports Node 18.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

This PR updates the Sui public endpoint documentation from JSON-RPC to GraphQL and adds pnpm overrides/lockfile updates to resolve vulnerable transitive Docusaurus dependencies.

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
pnpm-workspace.yaml	10	Joi override resolves to a Node 20-only package while the project declares Node >=18 support

Fix these issues in Kilo Cloud

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
—	—	None

Files Reviewed (4 files)

• docs/public-nodes/public-endpoints.md - 0 issues
• pnpm-workspace.yaml - 1 issue
• pnpm-lock.yaml - 0 issues
• package.json - context reviewed

---

_{Reviewed by gpt-5.5-2026-04-23 · 273,447 tokens}