chore: harden dependency supply chain and add security policy

.github/workflows/e2e-test-nodejs.yml

@@ -15,6 +15,9 @@ jobs:
       - name: Setup PNPM
         uses: dfinity/ci-tools/actions/setup-pnpm@afeee4fbdc0683a88ec5a74ed7f59a2ce0e833ad # main
 
+      - name: Setup
+        run: pnpm run setup
+
       - name: Test
         run: pnpm test:pic
 
@@ -31,6 +34,9 @@ jobs:
       - name: Setup PNPM
         uses: dfinity/ci-tools/actions/setup-pnpm@afeee4fbdc0683a88ec5a74ed7f59a2ce0e833ad # main
 
+      - name: Setup
+        run: pnpm run setup
+
       - name: Setup Canister Toolchain
         uses: ./.github/actions/setup-canister-toolchain
         with:
@@ -64,6 +70,9 @@ jobs:
         shell: bash
         run: bun i --frozen-lockfile
 
+      - name: Setup
+        run: bun run setup
+
       - name: Setup Canister Toolchain
         uses: ./.github/actions/setup-canister-toolchain
         with:

.npmrc

@@ -0,0 +1 @@
+ignore-scripts=true

SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+DFINITY takes the security of our software products seriously, which includes all source code repositories under the [DFINITY](https://github.com/dfinity) GitHub organization.
+
+> [!IMPORTANT]
+> [DFINITY Foundation](https://dfinity.org) has an [Internet Computer (ICP) Bug Bounty program](https://dfinity.org/bug-bounty/) that rewards researchers for finding and reporting vulnerabilities in the Internet Computer. Please check the scope and eligibility criteria outlined in the policy to see if the vulnerability you found qualifies for a reward.
+
+## How to report a vulnerability
+
+We appreciate your help in keeping our projects secure.
+If you believe you have found a security vulnerability in any of our repositories, please report it responsibly to us as described below:
+
+1. **Do not disclose the vulnerability publicly.** Public disclosure could be exploited by attackers before it can be fixed.
+2. **Send an email to securitybugs@dfinity.org.** Please include the following information in your email:
+   - A description of the vulnerability
+   - Steps to reproduce the vulnerability
+   - Risk rating of the vulnerability
+   - Any other relevant information
+
+We will respond to your report within 72 hours and work with you to fix the vulnerability as soon as possible.
+
+### Security Updates
+
+We are committed to fixing security vulnerabilities in a timely manner. Once a security vulnerability is reported, we will:
+
+- Investigate the report and confirm the vulnerability.
+- Develop a fix for the vulnerability.
+- Release a new version of the project that includes the fix.
+- Announce the security fix in the project's release notes.
+
+## Preferred Language
+
+We prefer all communications to be in English.
+
+## Disclaimer
+
+This security policy is subject to change at any time.

package.json

@@ -31,7 +31,8 @@
     "generate:test-canister": "icp-bindgen --did-file packages/pic/tests/test-canister/test_canister.did --out-dir packages/pic/tests/test-canister --actor-disabled --force",
     "build:examples": "./scripts/build-examples.sh",
     "test:examples": "./scripts/test-examples.sh",
-    "postinstall": "tar -xvf examples/nns_proxy/tests/state/nns_state.tar.xz -C examples/nns_proxy/tests/state"
+    "postinstall": "tar -xvf examples/nns_proxy/tests/state/nns_state.tar.xz -C examples/nns_proxy/tests/state",
+    "setup": "node packages/pic/postinstall.mjs && pnpm run postinstall"
   },
   "devDependencies": {
     "@icp-sdk/bindgen": "^0.2.3",
@@ -47,6 +48,17 @@
     "prettier": "3.8.1",
     "ts-node": "^10.9.2",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "vite": "^7.3.2",
+    "vitest": "^4.1.0",
+    "yaml": "^2.8.3"
+  },
+  "pnpm": {
+    "overrides": {
+      "picomatch@>=2.0.0 <3.0.0": "^2.3.2",
+      "picomatch@>=4.0.0 <4.0.4": "4.0.4",
+      "brace-expansion@>=1.0.0 <2.0.0": "^1.1.13",
+      "brace-expansion@>=2.0.0 <2.0.3": "^2.0.3",
+      "yaml@>=2.0.0 <2.8.3": "2.8.3"
+    }
   }
 }