chore: patch dependency advisories and drop bun.lock

[marc0olo]

Clears all 24 open Dependabot alerts (1 critical, 13 high, 8 moderate, 2 low) and supersedes #275 and #283.

Dependency updates

vite → ^7.3.5, vitest → ^4.1.11 (the two direct-dep advisories), plus pnpm.overrides entries for the 21 transitive ones. pnpm audit is clean afterwards.

Also drops the minimumReleaseAgeExclude: [vite] entry, which was annotated "remove after 2026-04-16" — vite 7.3.5 is well past the 7-day threshold.

Why bun.lock is removed

Three of the four controls added in #263 are pnpm-only — pnpm.overrides, minimumReleaseAge, onlyBuiltDependencies. Bun reads none of them, so bun.lock was resolving a second dependency graph that silently bypassed the hardening:

pnpm.overrides target	pnpm-lock.yaml	bun.lock
brace-expansion@>=1 <2 → ^1.1.13	1.1.13	1.1.12
brace-expansion@>=2 <2.0.3 → ^2.0.3	2.0.3	2.0.2
picomatch@>=2 <3 → ^2.3.2	2.3.2	2.3.1
picomatch@>=4 <4.0.4 → 4.0.4	4.0.4	4.0.3
yaml@>=2 <2.8.3 → 2.8.3	2.8.3	2.8.2

It also can't be kept current: Dependabot supports bun for version updates but not security updates, so every security PR updated package.json + pnpm-lock.yaml only, leaving bun.lock stale and failing the required bun i --frozen-lockfile step. That's what sank both #275 and #283, and it would sink every future one.

e2e_test_bun now installs with pnpm and still runs setup, build, build:examples and test:examples under bun, so bun runtime coverage is unchanged. What's given up is coverage of bun's resolver — acceptable for a library whose consumers resolve it themselves, and whose published tarball depends only on @icp-sdk/core, bip39 and json-with-bigint (none flagged). Verified locally that bun run setup and bun run build work against the pnpm tree.

Consumer-facing bun support is untouched — docs/guides/using-bun.mdx still applies.

Docs

README.md and examples/README.md both told contributors to install with bun i. With bun.lock gone that resolves an ungoverned graph — the same problem this PR fixes — so both now install with pnpm, and bun is documented as a test runner over that install.

Both guides also omitted the pocket-ic download. .npmrc sets ignore-scripts=true, so the postinstall that fetches the binary never runs on a plain install; pnpm run setup is now an explicit step. Verified by deleting the binary: pnpm i does not restore it, pnpm run setup does. (Caught by Copilot review — the first revision of this PR had the same gap.)

The two CI badges pointed at test-nodejs.yml and test-bun.yml, neither of which exists; collapsed to the one real workflow. Happy to split the docs changes out if you'd rather keep the PR to dependencies.

Verified

• pnpm audit — 0 vulnerabilities
• pnpm i --frozen-lockfile — lockfile up to date
• pnpm test:pic — 65 passed
• pnpm format:check — clean
• bun run setup, bun run build — pass against the pnpm tree
• vitest list on the counter example collects under 4.1.11

Example e2e suites need the canister toolchain, so those run in CI.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

README setup documentation still has two unresolved issues involving PocketIC setup and pnpm instructions.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR patches dependency advisories, standardizes installs on pnpm, and retains Bun runtime testing.

Changes:

• Updates direct and transitive dependencies through pnpm overrides.
• Removes the stale bun.lock and updates Bun CI installation.
• Refreshes contributor setup instructions and workflow badges.

File summaries

File	Summary	Findings
README.md	Updates setup instructions and badges.	Nit (3 votes): Add the explicit PocketIC setup step before the Bun suite. Nit (2 votes): Update the linked examples/README.md to use pnpm instead of bun i.
pnpm-workspace.yaml	Removes the temporary Vite release-age exemption.	None.
pnpm-lock.yaml	Records patched dependency resolutions.	None.
package.json	Upgrades dependencies and adds pnpm overrides.	None.
.github/workflows/e2e-test-nodejs.yml	Installs dependencies with pnpm for Bun runtime tests.	None.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 4/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Outstanding documentation and dependency-rationale corrections must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

examples/README.md:43

• This instruction refers to commands “that follow,” but the build and test commands to be run with Bun are all above this paragraph and nothing follows it. As written, the guide still tells a Bun user to run the preceding pnpm commands; point the instruction at the commands above (or move it before them).

Dependencies are always installed with pnpm so that `pnpm.overrides` and the
release-age policy apply. To run the suites with [bun](https://bun.sh/) instead,
keep the `pnpm i` above and replace `pnpm` with `bun` in the commands that follow.

package.json:59

• The resolver comparison in the PR description is stale relative to this change: it says the pnpm graph uses brace-expansion 1.1.13/2.0.3 and overrides ^1.1.13/^2.0.3, but this file now uses ^1.1.16/^2.1.2 and the lockfile resolves 1.1.18/2.1.4. Please update that table so the security rationale accurately describes the graph being merged.

      "brace-expansion@>=1.0.0 <2.0.0": "^1.1.16",
      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",

• Files reviewed: 5/7 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 5/7 changed files
• Comments generated: 0 new
• Review effort level: Lite