Dependency override register

Tayho treats root dependency overrides as temporary, security-qualified controls. An override may be removed only after every direct owner has published a non-vulnerable compatible constraint and the frozen lockfile, workspace suite, Ponder runtime qualification, and four production image scans remain green without it.

Package	Exact version	Upstream owner	Reason and removal gate
`@hono/node-server`	`1.19.14`	Ponder	Ponder `0.17.0` pins an advisory-affected release. Remove when Ponder consumes at least this version and its startup qualification passes.
`drizzle-orm`	`0.45.2`	Ponder	Fixes `GHSA-gpj5-g38j-94v9`; the keeper already uses this line. Remove when Ponder no longer pins `0.41.0`.
`esbuild`	`0.28.1`	Drizzle Kit	Removes advisory-affected `0.18.20` and the old Go binary from the lockfile. Remove when Drizzle Kit drops `@esbuild-kit/esm-loader` or its helper adopts a safe esbuild.
`fast-json-patch`	`3.1.1`	Ponder transitive tooling	Removes the advisory-affected `2.x` line. Remove after its upstream constraint is safe.
`kysely`	`0.28.17`	Ponder	Earliest release containing all three Kysely advisory fixes while retaining Ponder’s required exports. Remove when Ponder supports a fixed release directly.
`vite`	`8.1.5`	Ponder	Ponder pins advisory-affected Vite `5.4.21`; the frontend is already on Vite `8.x`. Remove when Ponder adopts a safe Vite line.
`vite-node`	`6.0.0`	Ponder	Keeps Ponder’s loader paired with the qualified Vite `8.x` runtime. Remove together with the Vite override.

Qualification commands:

bun install --frozen-lockfile
bun test deploy/qualification/dependency-security.test.ts
bun test apps/indexer/test/runtime-qualification.test.ts
bun run --cwd apps/keeper db:check
bun run --cwd apps/frontend build

The release workflow additionally rebuilds and scans the keeper, indexer, API, and market-data images with pinned Grype. Do not add ignore rules to compensate for an override regression. The root package.json and frozen bun.lock are authoritative. Update this register in the same change as any override addition, version change, or removal.

​Dependency override register

Dependency override register