Update vulnerable interface dependencies

docs/dependency-security-updates.md

@@ -0,0 +1,102 @@
+# Dependency security maintenance — 2026-10-30
+
+This update addresses registry advisories in the interface's browser, build, test,
+and code-generation dependencies. It is not an exhaustive application or protocol
+security audit. Source review of dependency consumers did not establish a working
+production exploit; that does not make the remaining advisory matches harmless.
+
+## Audit result
+
+Run with the checked-in Yarn release:
+
+```sh
+node .yarn/releases/yarn-4.5.0.cjs npm audit --all --recursive --json
+```
+
+| Registry severity | Before | After |
+| --- | ---: | ---: |
+| Critical | 6 | 0 |
+| High | 70 | 5 |
+| Moderate | 62 | 6 |
+| Low | 10 | 1 |
+| Total | 148 | 12 |
+
+Counts are Yarn advisory/version matches with numeric advisory IDs; deprecation
+notices are excluded. They include development dependencies and are not counts of
+independently confirmed application vulnerabilities. Registry results can change.
+
+## Included updates
+
+- Vite 6.4.5, Vitest 4.1.12, and React plugin 4.7.0 replace vulnerable build/test
+  versions. Vitest uses the same patched Vite 6 release through a scoped resolution.
+- Lodash 4.18.1, PostCSS 8.5.32, and React Router DOM 6.30.6 update direct consumers.
+  Router 6 still has two advisories; see the migration recommendations below.
+- Compatible lockfile refreshes update affected transitive dependencies, including
+  archive, process, cryptographic, HTTP, and parsing helpers. GraphQL schema and
+  merge helpers are refreshed together to preserve codegen compatibility.
+- Remove unused `@netlify/functions`, `@privy-io/wagmi`, and
+  `@privy-io/wagmi-connector`. The site publishes static assets and uses its own
+  Privy connector; no imports or configured handlers use these packages.
+
+The additional resolutions address parent-package pins without replacing unrelated
+major versions throughout the tree:
+
+| Resolution | Reason |
+| --- | --- |
+| `brace-expansion` 2.1.7 | Raise the existing resolution to a patched version. |
+| `node-gyp` 11.5.0 | Replace Yarn's injected old native build helper and its vulnerable tar dependency; retain Node 20 compatibility. |
+| `@graphql-codegen/plugin-helpers/lodash` | Parent's tilde range otherwise retains vulnerable Lodash. |
+| `@ardatan/relay-compiler/immutable` | Patch the existing Immutable 3 consumer. |
+| `styled-components/postcss` | Replace the parent's exact vulnerable PostCSS pin. |
+| `@tailwindcss/typography/postcss-selector-parser` | Replace the parent's exact vulnerable parser pin. |
+| `viem/ws`, `engine.io-client/ws` | Patch pinned WebSocket 8 consumers while preserving WebSocket 7 consumers. |
+
+Revisit these resolutions when upgrading the parent packages; remove them when
+normal upstream ranges resolve to supported patched versions.
+
+## Recommended follow-up upgrades
+
+1. **Wallet dependencies:** upgrade Privy, wagmi/connectors, WalletConnect/Reown,
+   and their compatible viem/ox versions together. Current candidates include
+   Privy 3.51.0 and wagmi 3.7.9; this requires wallet-flow regression testing.
+   Remaining matches include
+   [decode-uri-component denial of service](https://github.com/advisories/GHSA-qr28-fpjm-wq7f),
+   [uuid buffer bounds](https://github.com/advisories/GHSA-w5hq-g745-h8pq), and
+   [Zod collection validation](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5).
+   Update `@wagmi/cli` alongside its Zod consumer. Do not force Zod 4 or a new
+   uuid major into packages expecting older APIs.
+2. **GraphQL codegen:** migrate the CLI and client preset together (current
+   candidates: CLI 7.4.6 and client preset 6.2.3), then verify generated output.
+   The existing CLI retains `@graphql-tools/utils` 10.11.0 with
+   [mergeDeep](https://github.com/advisories/GHSA-7mx3-vvmw-hjmv) and
+   [mergeIncrementalResult](https://github.com/advisories/GHSA-c4qx-w738-7hr3)
+   prototype-pollution advisories. Its interactive editor chain also retains
+   [tmp path traversal](https://github.com/advisories/GHSA-ph9p-34f9-6g65).
+   These are developer/CI tooling paths; a production-browser exploit was not established.
+3. **React Router 7.18 or later:** plan a routing migration for the remaining
+   [backslash redirect](https://github.com/advisories/GHSA-wrjc-x8rr-h8h6) and
+   [SSR hydration](https://github.com/advisories/GHSA-337j-9hxr-rhxg) advisories.
+   This application uses BrowserRouter, not SSR; reviewed navigation did not
+   establish an attacker-controlled redirect path.
+
+Two MetaMask advisory matches reference the historical
+[debug 4.4.2 incident](https://github.com/advisories/GHSA-qj3p-xc97-xw74).
+The resulting lockfile selects debug 4.3.6, 4.4.1, and 4.4.3, not 4.4.2. Those
+package-level matches alone are not evidence that this checkout contains the
+malicious release. Keep the wallet-stack upgrade on the follow-up list.
+
+## Validation and limits
+
+- Immutable Yarn installation, all 108 tests, and the production build pass.
+- A minimal offline GraphQL schema/query generates successfully. Live generation
+  succeeds for the Pinto and Exchange schemas. The cache endpoint returns an
+  internal-server error and the pintostalk endpoint returns an indexing error on
+  both the baseline and updated tree, so full generation cannot currently pass.
+- TypeScript reports the same 15 pre-existing diagnostics as the baseline.
+- Local browser smoke testing covers loading Silo data and rendering the wallet
+  selection dialog. No wallet signing, authenticated flows, or transactions were tested.
+- The main checkout and the separate Silo-value fix are outside this change.
+
+The follow-up versions are migration candidates, not versions validated by this
+PR. Re-audit after each parent upgrade and test actual wallet/codegen behavior
+before removing overrides or treating an advisory as resolved.

package.json

@@ -21,11 +21,8 @@
   },
   "dependencies": {
     "@hookform/resolvers": "^3.9.0",
-    "@netlify/functions": "^2.8.1",
     "@number-flow/react": "^0.5.9",
     "@privy-io/react-auth": "^3.6.0",
-    "@privy-io/wagmi": "^2.0.2",
-    "@privy-io/wagmi-connector": "^0.1.13",
     "@radix-ui/react-accordion": "^1.2.3",
     "@radix-ui/react-checkbox": "^1.1.2",
     "@radix-ui/react-collapsible": "^1.1.1",
@@ -75,15 +72,15 @@
     "jotai": "^2.10.2",
     "jotai-immer": "^0.4.1",
     "lightweight-charts": "^5.0.3",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.1",
     "luxon": "^3.5.0",
     "react": "^18.3.1",
     "react-day-picker": "^9.6.4",
     "react-dom": "^18.3.1",
     "react-helmet-async": "^2.0.5",
     "react-hook-form": "^7.52.1",
     "react-markdown": "^10.1.0",
-    "react-router-dom": "6.25.1",
+    "react-router-dom": "6.30.6",
     "react-window": "^1.8.11",
     "sonner": "^1.5.0",
     "tailwind-merge": "2.6.0",
@@ -107,25 +104,33 @@
     "@types/react-dom": "^18.3.7",
     "@types/react-window": "^1.8.8",
     "@types/three": "^0.169.0",
-    "@vitejs/plugin-react": "^4.6.0",
+    "@vitejs/plugin-react": "^4.7.0",
     "@wagmi/cli": "2.3.1",
     "autoprefixer": "10.4.21",
     "husky": "^9.1.7",
-    "postcss": "8.4.39",
+    "postcss": "8.5.32",
     "tailwindcss": "3.4.17",
     "ts-node": "^10.9.2",
     "tslib": "^2.6.3",
     "typescript": "5.5.3",
-    "vite": "^5.4.19",
-    "vitest": "^3.2.4"
+    "vite": "^6.4.5",
+    "vitest": "^4.1.12"
   },
   "resolutions": {
     "@babel/runtime": "^7.26.10",
-    "brace-expansion": "^2.0.2",
+    "brace-expansion": "^2.1.7",
     "micromatch": "^4.0.8",
     "cross-spawn": "7.0.6",
     "viem": "^2.33.1",
-    "ox": "^0.8.1"
+    "ox": "^0.8.1",
+    "vitest/vite": "^6.4.5",
+    "node-gyp": "11.5.0",
+    "@graphql-codegen/plugin-helpers/lodash": "^4.18.1",
+    "@ardatan/relay-compiler/immutable": "^3.8.4",
+    "styled-components/postcss": "8.5.32",
+    "@tailwindcss/typography/postcss-selector-parser": "^6.1.5",
+    "viem/ws": "^8.21.0",
+    "engine.io-client/ws": "^8.21.0"
   },
   "packageManager": "yarn@4.5.0"
 }

src/generated/gql/exchange/graphql.ts

@@ -1312,6 +1312,23 @@ export enum ImplementationOrderBy {
   wells = 'wells'
 }
 
+/**
+ * The severity level of a log entry.
+ * Log levels are ordered from most to least severe: CRITICAL > ERROR > WARNING > INFO > DEBUG
+ */
+export enum LogLevel {
+  /** Critical errors that require immediate attention */
+  CRITICAL = 'CRITICAL',
+  /** Detailed diagnostic information for debugging */
+  DEBUG = 'DEBUG',
+  /** Error conditions that indicate a failure */
+  ERROR = 'ERROR',
+  /** Informational messages about normal operations */
+  INFO = 'INFO',
+  /** Warning conditions that may require attention */
+  WARNING = 'WARNING'
+}
+
 /** Defines the order direction, either ascending or descending */
 export enum OrderDirection {
   asc = 'asc',
@@ -1360,6 +1377,8 @@ export enum PumpOrderBy {
 
 export type Query = {
   __typename?: 'Query';
+  /** Query execution logs emitted by the subgraph during indexing. Results are sorted by timestamp in descending order (newest first). */
+  _logs: Array<Log>;
   /** Access to subgraph metadata */
   _meta?: Maybe<Meta>;
   aquifer?: Maybe<Aquifer>;
@@ -1397,6 +1416,17 @@ export type Query = {
 };
 
 
+export type QueryLogsArgs = {
+  first?: InputMaybe<Scalars['Int']['input']>;
+  from?: InputMaybe<Scalars['String']['input']>;
+  level?: InputMaybe<LogLevel>;
+  orderDirection?: InputMaybe<OrderDirection>;
+  search?: InputMaybe<Scalars['String']['input']>;
+  skip?: InputMaybe<Scalars['Int']['input']>;
+  to?: InputMaybe<Scalars['String']['input']>;
+};
+
+
 export type QueryMetaArgs = {
   block?: InputMaybe<BlockHeight>;
 };
@@ -3946,6 +3976,54 @@ export type Block = {
   timestamp?: Maybe<Scalars['Int']['output']>;
 };
 
+/**
+ * A key-value pair of additional data associated with a log entry.
+ * These correspond to arguments passed to the log function in the subgraph code.
+ */
+export type LogArgument = {
+  __typename?: '_LogArgument_';
+  /** The parameter name */
+  key: Scalars['String']['output'];
+  /** The parameter value, serialized as a string */
+  value: Scalars['String']['output'];
+};
+
+/**
+ * Source code location metadata for a log entry.
+ * Indicates where in the subgraph's AssemblyScript code the log statement was executed.
+ */
+export type LogMeta = {
+  __typename?: '_LogMeta_';
+  /** The column number in the source file */
+  column: Scalars['Int']['output'];
+  /** The line number in the source file */
+  line: Scalars['Int']['output'];
+  /** The module or file path where the log was emitted */
+  module: Scalars['String']['output'];
+};
+
+/**
+ * A log entry emitted by a subgraph during indexing.
+ * Logs can be generated by the subgraph's AssemblyScript code using the `log.*` functions.
+ */
+export type Log = {
+  __typename?: '_Log_';
+  /** Additional structured data passed to the log function as key-value pairs */
+  arguments: Array<LogArgument>;
+  /** Unique identifier for this log entry */
+  id: Scalars['String']['output'];
+  /** The severity level of the log entry */
+  level: LogLevel;
+  /** Metadata about the source location in the subgraph code where the log was emitted */
+  meta: LogMeta;
+  /** The deployment hash of the subgraph that emitted this log */
+  subgraphId: Scalars['String']['output'];
+  /** The log message text */
+  text: Scalars['String']['output'];
+  /** The timestamp when the log was emitted, in RFC3339 format (e.g., '2024-01-15T10:30:00Z') */
+  timestamp: Scalars['String']['output'];
+};
+
 /** The type for the top-level _meta field */
 export type Meta = {
   __typename?: '_Meta_';

src/generated/gql/pinto/graphql.ts

@@ -1793,6 +1793,23 @@ export enum FarmerBalanceOrderBy {
   walletBalance = 'walletBalance'
 }
 
+/**
+ * The severity level of a log entry.
+ * Log levels are ordered from most to least severe: CRITICAL > ERROR > WARNING > INFO > DEBUG
+ */
+export enum LogLevel {
+  /** Critical errors that require immediate attention */
+  CRITICAL = 'CRITICAL',
+  /** Detailed diagnostic information for debugging */
+  DEBUG = 'DEBUG',
+  /** Error conditions that indicate a failure */
+  ERROR = 'ERROR',
+  /** Informational messages about normal operations */
+  INFO = 'INFO',
+  /** Warning conditions that may require attention */
+  WARNING = 'WARNING'
+}
+
 /** Defines the order direction, either ascending or descending */
 export enum OrderDirection {
   asc = 'asc',
@@ -2968,6 +2985,8 @@ export enum PoolOrderBy {
 
 export type Query = {
   __typename?: 'Query';
+  /** Query execution logs emitted by the subgraph during indexing. Results are sorted by timestamp in descending order (newest first). */
+  _logs: Array<Log>;
   /** Access to subgraph metadata */
   _meta?: Maybe<Meta>;
   bean?: Maybe<Bean>;
@@ -3007,6 +3026,17 @@ export type Query = {
 };
 
 
+export type QueryLogsArgs = {
+  first?: InputMaybe<Scalars['Int']['input']>;
+  from?: InputMaybe<Scalars['String']['input']>;
+  level?: InputMaybe<LogLevel>;
+  orderDirection?: InputMaybe<OrderDirection>;
+  search?: InputMaybe<Scalars['String']['input']>;
+  skip?: InputMaybe<Scalars['Int']['input']>;
+  to?: InputMaybe<Scalars['String']['input']>;
+};
+
+
 export type QueryMetaArgs = {
   block?: InputMaybe<BlockHeight>;
 };
@@ -4432,6 +4462,54 @@ export type Block = {
   timestamp?: Maybe<Scalars['Int']['output']>;
 };
 
+/**
+ * A key-value pair of additional data associated with a log entry.
+ * These correspond to arguments passed to the log function in the subgraph code.
+ */
+export type LogArgument = {
+  __typename?: '_LogArgument_';
+  /** The parameter name */
+  key: Scalars['String']['output'];
+  /** The parameter value, serialized as a string */
+  value: Scalars['String']['output'];
+};
+
+/**
+ * Source code location metadata for a log entry.
+ * Indicates where in the subgraph's AssemblyScript code the log statement was executed.
+ */
+export type LogMeta = {
+  __typename?: '_LogMeta_';
+  /** The column number in the source file */
+  column: Scalars['Int']['output'];
+  /** The line number in the source file */
+  line: Scalars['Int']['output'];
+  /** The module or file path where the log was emitted */
+  module: Scalars['String']['output'];
+};
+
+/**
+ * A log entry emitted by a subgraph during indexing.
+ * Logs can be generated by the subgraph's AssemblyScript code using the `log.*` functions.
+ */
+export type Log = {
+  __typename?: '_Log_';
+  /** Additional structured data passed to the log function as key-value pairs */
+  arguments: Array<LogArgument>;
+  /** Unique identifier for this log entry */
+  id: Scalars['String']['output'];
+  /** The severity level of the log entry */
+  level: LogLevel;
+  /** Metadata about the source location in the subgraph code where the log was emitted */
+  meta: LogMeta;
+  /** The deployment hash of the subgraph that emitted this log */
+  subgraphId: Scalars['String']['output'];
+  /** The log message text */
+  text: Scalars['String']['output'];
+  /** The timestamp when the log was emitted, in RFC3339 format (e.g., '2024-01-15T10:30:00Z') */
+  timestamp: Scalars['String']['output'];
+};
+
 /** The type for the top-level _meta field */
 export type Meta = {
   __typename?: '_Meta_';