Files
pezkuwi-subquery/package.json
Satoshi Qazi Muhammed c4f2bd943b Lock the indexer image and close the advisories in the build tooling
The indexer image installed @subql/node and the @polkadot -> @pezkuwi aliases
with an unlocked npm install, and the build cache kept the layer from the day
it was first built: the indexers ran @pezkuwi/wasm-crypto 7.5.17/7.5.18, the
build whose ed25519 and secp256k1 are stubs, plus vm2 3.9.19 (the mapping
sandbox, 54 advisories). No lockfile meant Dependabot never saw that tree.

- docker/indexer holds the image's package.json and package-lock.json:
  @subql/node 6.4.6 as today, @pezkuwi 16.5.39 / 14.0.26 / 7.5.21, overrides
  for vm2 3.12.2, uuid 11 and package-json 7 (got 11). The Dockerfile runs
  npm ci on Node 24 (Node 20 is out of support).
- The pruned-state patch stops the build when a pattern matches nothing,
  instead of reporting success with the fallback missing.
- CI builds the indexer image and runs the crypto smoke test inside it
  through the @polkadot aliases, the way subql-node loads them.
- The root yarn.lock, which the host installs as root on every deploy to run
  subql codegen/build, moves the advisory ranges forward with targeted
  resolutions and @pezkuwi/braces. Left: elliptic (low, via ethers 5 in
  @subql/cli) and sprintf-js (moderate, via jest's argparse 1); neither has
  a fixed release.
2026-10-12 17:14:07 +04:00

60 lines
1.9 KiB
JSON

{
"name": "subquery-pezkuwi",
"version": "1.0.0",
"packageManager": "yarn@4.12.0",
"description": "Pezkuwi SubQuery - Staking, governance, NominationPools, transfers indexer for PezWallet",
"main": "dist/index.js",
"scripts": {
"build": "./node_modules/.bin/subql build",
"start:docker": "docker-compose pull && docker-compose up --remove-orphans",
"codegen": "./node_modules/.bin/subql codegen",
"validate": "./node_modules/.bin/subql validate",
"local-publish": "cd ./scripts && ./local-publish.sh"
},
"files": [
"dist",
"schema.graphql",
"pezkuwi.yaml",
"pezkuwi-assethub.yaml",
"pezkuwi-governance.yaml"
],
"author": "Pezkuwi Team",
"license": "Apache-2.0",
"dependencies": {
"@pezkuwi/api": "^16.5.39",
"@pezkuwi/api-augment": "^16.5.39",
"@pezkuwi/api-derive": "^16.5.39",
"@pezkuwi/keyring": "^14.0.26",
"@pezkuwi/types": "^16.5.39",
"@pezkuwi/types-augment": "^16.5.39",
"@pezkuwi/types-codec": "^16.5.39",
"@pezkuwi/types-create": "^16.5.39",
"@pezkuwi/util": "^14.0.26",
"@pezkuwi/util-crypto": "^14.0.26",
"lodash": "^4.17.21"
},
"devDependencies": {
"@subql/cli": "^6.6.3",
"@subql/common-substrate": "^4.5.5",
"@subql/types": "^3.15.0",
"@types/jest": "^29.5.1",
"jest": "^29.5.0",
"prettier": "3.1.0",
"ts-jest": "^29.1.0",
"ts-node": "^10.9.1",
"typescript": "^5.2.2"
},
"resolutions": {
"ipfs-unixfs": "6.0.6",
"@modelcontextprotocol/sdk@npm:1.24.3": "npm:^1.31.0",
"axios@npm:^0.27.2": "npm:^0.34.0",
"braces@npm:^3.0.3": "npm:@pezkuwi/braces@^3.0.4",
"package-json@npm:^6.3.0": "npm:^7.0.0",
"serialize-javascript@npm:^6.0.2": "npm:^7.0.5",
"simple-git@npm:^3.28.0": "npm:^4.0.1",
"tmp@npm:^0.0.33": "npm:^0.2.6",
"uuid@npm:^8.3.2": "npm:^11.1.1",
"ws@npm:8.18.0": "npm:^8.21.0"
}
}