Dependency override register

Tayho treats root dependency overrides as temporary, security-qualified controls. An override may be removed only after every direct owner has published a non-vulnerable compatible constraint and the frozen lockfile, workspace suite, Ponder runtime qualification, and four production image scans remain green without it.

Package	Exact version	Upstream owner	Reason and removal gate
`@hono/node-server`	`1.19.14`	Ponder	Ponder `0.17.1` pins the latest `1.x` line. Hono `2.x` fails Ponder runtime qualification, so the Windows-only static-serving advisory is temporarily excepted in `osv-scanner.toml`. Remove when Ponder supports Hono `2.x`.
`drizzle-orm`	`0.45.2`	Ponder	Fixes `GHSA-gpj5-g38j-94v9`; the keeper already uses this line. Remove when Ponder no longer pins `0.41.0`.
`esbuild`	`0.28.1`	Drizzle Kit	Removes advisory-affected `0.18.20` and the old Go binary from the lockfile. Remove when Drizzle Kit drops `@esbuild-kit/esm-loader` or its helper adopts a safe esbuild.
`fast-json-patch`	`3.1.1`	Ponder transitive tooling	Removes the advisory-affected `2.x` line. Remove after its upstream constraint is safe.
`kysely`	`0.28.17`	Ponder	Earliest release containing all three Kysely advisory fixes while retaining Ponder’s required exports. Remove when Ponder supports a fixed release directly.
`vite`	`8.1.5`	Ponder	Ponder pins advisory-affected Vite `5.4.21`; the frontend is already on Vite `8.x`. Remove when Ponder adopts a safe Vite line.
`vite-node`	`6.0.0`	Ponder	Keeps Ponder’s loader paired with the qualified Vite `8.x` runtime. Remove together with the Vite override.

Qualification commands:

bun install --frozen-lockfile
bun test deploy/qualification/dependency-security.test.ts
bun test apps/indexer/test/runtime-qualification.test.ts
bun run --cwd apps/keeper db:check
bun run --cwd apps/frontend build

The release workflow additionally rebuilds and scans the keeper, indexer, API, and market-data images with pinned Grype. Do not add ignore rules to compensate for an override regression. The root package.json and frozen bun.lock are authoritative. Update this register in the same change as any override addition, version change, or removal.

Temporary OSV exceptions

osv-scanner.toml contains advisory-specific exceptions only when the latest direct upstream package still pins a vulnerable transitive version and Tayho does not expose the affected code path. Every exception has a reason and an expiry date. Package-wide or non-expiring exceptions are prohibited. As of 2026-07-24, Ponder 0.17.1 requires Hono Node Server 1.x and fails its runtime qualification under Hono 2.x. Mintlify 4.2.740 retains several advisory-affected packages solely in the repository documentation toolchain. These exceptions expire on 2026-08-31 and must be removed earlier when the respective latest upstream release resolves them.

​Dependency override register

​Temporary OSV exceptions

Dependency override register

Temporary OSV exceptions