chore(supply-chain): bump axios, immutable and nanoid past new advisories

[atepem]

main has been red since 2 Sept. Three high-severity advisories published against the production tree are not allowlisted, so every Dependency audit matrix entry fails — root and all eleven subgraphs. This unblocks main, and with it #124 and #125.

The three advisories

package	vulnerable	pinned to	advisory
axios	>=1.15.2 <1.18.0	1.18.0	1153178 (GHSA-gcfj-64vw-6mp9)
immutable	>=5.0.0-beta.1 <5.1.8	5.1.8	1164790 (GHSA-xvcm-6775-5m9r)
nanoid	>=4.0.0 <5.1.11	5.1.11	1153188 (GHSA-xwg4-73v4-xw9w)

All three have patched versions, so these are resolution bumps rather than allowlist entries.

Pinned to the minimal patched version of each rather than latest, to keep the change surface small for a security fix — axios is on 1.20.0 upstream and nanoid on 6.0.1 (a major), both further than the advisories require. Happy to take the newer ones instead if you'd prefer fewer future bumps.

The existing axios: 1.17.0 pin was correct when it was set; advisory 1153178 overtook it.

Scope

Resolutions added to all twelve package.json files, per the convention that they converge across the repo, and every lockfile regenerated. The diff touches only these three packages — verified by extracting every changed lockfile entry key.

Verification

Ran scripts/audit.mjs in each of the twelve CI matrix paths. All pass:

.                              PASS  OK (36 allowlisted)
subgraphs/autonolas            PASS  OK (58 allowlisted)
subgraphs/autonolas-base       PASS  OK (58 allowlisted)
subgraphs/babydegen-mode       PASS  OK (23 allowlisted)
subgraphs/marketplace          PASS  OK (36 allowlisted)
subgraphs/mech                 PASS  OK (30 allowlisted)
subgraphs/predict-omen         PASS  OK (35 allowlisted)
subgraphs/predict-polymarket   PASS  OK (36 allowlisted)
subgraphs/service-registry     PASS  OK (34 allowlisted)
subgraphs/staking              PASS  OK (35 allowlisted)
subgraphs/tokenomics           PASS  OK (23 allowlisted)
subgraphs/pearl-transactions   PASS  OK (22 allowlisted)

Two notes for review

Generated on Node 22, not 24. Root yarn install and yarn audit:prod both refuse to run below the engines: ">=24.0.0" gate, so I used --ignore-engines for the install and invoked scripts/audit.mjs directly. This is safe for yarn 1.x — its lockfiles are resolution-only, with none of the platform-specific entries npm's have — and the resulting diff confirms it. CI on Node 24 is still the authoritative check; worth a glance at the lockfile diff before merging.

59 expired allowlist entries, deliberately not touched here. Their review dates lapsed on 2026-08-06. They emit ::warning:: only and do not fail the build (scripts/audit.mjs exits 1 solely for unlisted high/critical), so refreshing or retiring them is a separate pass with its own judgement calls. Flagging it because the log is noisy with them and it's easy to mistake for the cause.

🤖 Generated with Claude Code