> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tayho.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Dependency override register

> Security-qualified root dependency overrides, owners, reasons, and removal gates.

# Dependency override register

Tayho treats root dependency overrides as temporary, security-qualified controls. An override may be removed only after every direct owner has published a non-vulnerable compatible constraint and the frozen lockfile, workspace suite, Ponder runtime qualification, and four production image scans remain green without it.

| Package             | Exact version | Upstream owner            | Reason and removal gate                                                                                                                                                   |
| ------------------- | ------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `@hono/node-server` | `1.19.14`     | Ponder                    | Ponder `0.17.0` pins an advisory-affected release. Remove when Ponder consumes at least this version and its startup qualification passes.                                |
| `drizzle-orm`       | `0.45.2`      | Ponder                    | Fixes `GHSA-gpj5-g38j-94v9`; the keeper already uses this line. Remove when Ponder no longer pins `0.41.0`.                                                               |
| `esbuild`           | `0.28.1`      | Drizzle Kit               | Removes advisory-affected `0.18.20` and the old Go binary from the lockfile. Remove when Drizzle Kit drops `@esbuild-kit/esm-loader` or its helper adopts a safe esbuild. |
| `fast-json-patch`   | `3.1.1`       | Ponder transitive tooling | Removes the advisory-affected `2.x` line. Remove after its upstream constraint is safe.                                                                                   |
| `kysely`            | `0.28.17`     | Ponder                    | Earliest release containing all three Kysely advisory fixes while retaining Ponder's required exports. Remove when Ponder supports a fixed release directly.              |
| `vite`              | `8.1.5`       | Ponder                    | Ponder pins advisory-affected Vite `5.4.21`; the frontend is already on Vite `8.x`. Remove when Ponder adopts a safe Vite line.                                           |
| `vite-node`         | `6.0.0`       | Ponder                    | Keeps Ponder's loader paired with the qualified Vite `8.x` runtime. Remove together with the Vite override.                                                               |

Qualification commands:

```sh theme={null}
bun install --frozen-lockfile
bun test deploy/qualification/dependency-security.test.ts
bun test apps/indexer/test/runtime-qualification.test.ts
bun run --cwd apps/keeper db:check
bun run --cwd apps/frontend build
```

The release workflow additionally rebuilds and scans the keeper, indexer, API, and market-data images with pinned Grype. Do not add ignore rules to compensate for an override regression.

The root `package.json` and frozen `bun.lock` are authoritative. Update this register in the same
change as any override addition, version change, or removal.