chore: dependency pinning and auditing

[danielbate]

• Closes Dependency Pinning & Auditing #3448

Summary

• Pins dependency version
• Audits releases

Checklist

• All changes are covered by tests (or not applicable)
• All changes are documented (or not applicable)
• I reviewed the entire PR myself (preferably, on GH UI)
• I described all Breaking Changes (or there's none)

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
fuels-template	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Dec 16, 2024 4:47pm
ts-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Dec 16, 2024 4:47pm
ts-docs-api	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Dec 16, 2024 4:47pm

[codspeed-hq]

CodSpeed Performance Report

Merging #3449 will degrade performances by 19.93%

_{Comparing db/chore/dep-pinning-audit (bc3d6f5) with master (41c72fb)}

Summary

❌ 1 regressions
✅ 17 untouched benchmarks

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Benchmarks breakdown

	Benchmark	master	db/chore/dep-pinning-audit	Change
❌	should successfully conduct a custom transfer between wallets (x20 times)	50.3 ms	62.8 ms	-19.93%

[maschad]

Dependabot already alerts us of existing vulnerabilities in our dependencies, so I don't believe this CI check is necessary.

Also I'm not sure if dependency pinning serves as a defence against upgrading to malicious software:

1. We already commit our lockfile, and so pnpm will install the same versions of the dependency. So if a vulnerability is discovered in an audit, we should actually upgrade to the patched version as opposed to keeping the dependency pinned at a particular version.

2. Even pinned versions can become compromised retroactively - an attacker could gain access to the package registry account and replace the package content while keeping the same version number - we could explore using provenance logs for npm packages in such a case, but not many deps provide them unfortunately. That being said It still may be worthwhile to run pnpm audit signatures in the future.

[danielbate]

@maschad neither of these changes were intended as full-proof solutions, but merely mitigation. Agreed deps can be retroactively compromised and we commit our lock file.

Pinning dependencies does mitigate risk of us upgrading to a compromised version, which I believe is a more common risk.

Good point on the audit, with pinning in place we would only be upgrading from dependabot, so it would be redundant.

[danielbate]

Okay I'm taking the approvals as agreement. Will hold off till after this weeks release window and then will merge, as I'll resolve the audit issues over the holiday period.

[github-actions]

Coverage Report:

Lines	Branches	Functions	Statements
76.33%(+0%)	69.84%(+0%)	74.2%(+0%)	76.34%(+0%)

Changed Files:

Coverage values did not change👌.