The indexer image installed @subql/node and the @polkadot -> @pezkuwi aliases
with an unlocked npm install, and the build cache kept the layer from the day
it was first built: the indexers ran @pezkuwi/wasm-crypto 7.5.17/7.5.18, the
build whose ed25519 and secp256k1 are stubs, plus vm2 3.9.19 (the mapping
sandbox, 54 advisories). No lockfile meant Dependabot never saw that tree.
- docker/indexer holds the image's package.json and package-lock.json:
@subql/node 6.4.6 as today, @pezkuwi 16.5.39 / 14.0.26 / 7.5.21, overrides
for vm2 3.12.2, uuid 11 and package-json 7 (got 11). The Dockerfile runs
npm ci on Node 24 (Node 20 is out of support).
- The pruned-state patch stops the build when a pattern matches nothing,
instead of reporting success with the fallback missing.
- CI builds the indexer image and runs the crypto smoke test inside it
through the @polkadot aliases, the way subql-node loads them.
- The root yarn.lock, which the host installs as root on every deploy to run
subql codegen/build, moves the advisory ranges forward with targeted
resolutions and @pezkuwi/braces. Left: elliptic (low, via ethers 5 in
@subql/cli) and sprintf-js (moderate, via jest's argparse 1); neither has
a fixed release.
The indexer lockfile still held wasm-crypto 7.5.17, which implements
only sr25519 and hashing; ed25519, secp256k1, derivation and VRF throw.
The bots move from 7.5.20 to 7.5.21, the same outputs on a crate set
without known advisories.
yarn.lock: transitive bumps within declared ranges for @babel/core, ajv,
axios (1.x), bn.js, body-parser, brace-expansion, browserslist, defu,
dottie, fast-uri, flatted, follow-redirects, form-data, h3, handlebars,
ip-address, js-yaml, lodash, minimatch, moment, path-to-regexp, picomatch,
qs, simple-git, tar, ws, yaml and @modelcontextprotocol/sdk where in range.
noter/package-lock.json: bn.js 5.2.2 -> 5.2.5, ws 8.19.0 -> 8.22.0.
scripts/python_scripts and scripts/update_projects_description.sh are
removed rather than patched (27 alerts on requirements.txt). They came in
with the initial commit from the Nova project and were never changed: they
call SubQuery's managed service (api.subquery.network) and write
descriptions for the "nova-wallet" organisation. Nothing in CI, package.json
or the other scripts calls them, and our indexers are self-hosted.
Left for upstream SubQuery releases, all build/codegen tooling rather than
the indexer runtime: axios 0.27 via @subql/network-clients, ws 8.18 and
elliptic via its ethers 5, serialize-javascript 6 via terser-webpack-plugin,
uuid 8 via @subql/x-sequelize, tmp via @inquirer/editor, got 9 via
update-notifier.
Checked: yarn install --immutable; subql codegen and build succeed for
pezkuwi.yaml, pezkuwi-assethub.yaml and pezkuwi-governance.yaml.
Replace npm aliases (@polkadot -> @pezkuwi) with direct @pezkuwi package
imports. Add tsconfig path mappings to redirect @polkadot type references
from @subql/types to @pezkuwi equivalents, enabling proper type resolution
without installing @polkadot packages. Remove Polkadot ecosystem swap/bridge
integrations (HydraDx, AssetConversion) as they're incompatible with Pezkuwi.
Satoshi Qazi Muhammed