chore(release): v1.1.1 - dependency updates and 7-day pnpm grace period

[AntoTG]

Release v1.1.1 — security patch

Patch bump per the versioning rules in .cursor/rules/project-overview.mdc (dependency bumps, no behaviour change).

Security

pnpm audit reported 5 advisories (3 high, 1 moderate, 1 low), all transitive. All are resolved — audit is now clean. This also clears the 4 Dependabot alerts currently open on main.

Package	Severity	Via	Advisory
ws	high — memory exhaustion DoS	viem	GHSA-96hv-2xvq-fx4p
ws	moderate — uninitialized memory disclosure	viem	GHSA-58qx-3vcg-4xpx
brace-expansion ×2	high — DoS (exponential expansion / OOM)	eslint, typescript-eslint	—
esbuild	low — arbitrary file read in dev server (Windows)	tsx	GHSA-g7r4-m6w7-qqqr

Dependency updates

• viem 2.48.11 → 2.55.8
• @grafana/grafana-foundation-sdk 0.0.12 → 0.0.18
• @typescript-eslint/{eslint-plugin,parser} 8.59.3 → 8.65.0
• eslint 10.3.0 → 10.7.0
• tsx 4.21.0 → 4.23.1 (esbuild 0.27.7 → 0.28.1)

viem 2.55.10 and eslint 10.8.0 were deliberately left out: the release-age policy below blocks them for being too recent. They will land on the next update pass.

Supply chain

• minimumReleaseAge raised from 3 to 7 days (10080 minutes) in pnpm-workspace.yaml.
• Dockerfile now copies pnpm-workspace.yaml into the build context, so the policy applies to image builds too — it previously did not.
• Dropped the pnpm.onlyBuiltDependencies field from package.json: pnpm 11 no longer reads it (it warned on every command) and the setting already lives in allowBuilds.

Grafana dashboard

SDK 0.0.18 started emitting its own timeseries options defaults with showLegend: false, which would have silently hidden the legend on all six timeseries panels. timeseriesPanel() now sets the legend explicitly. Verified with a key-order-normalized diff against the previous dashboard.json: the only change is the added options block, matching Grafana's own defaults.

Verification

• pnpm run test:all — 49 + 8 tests pass
• pnpm run lint — clean
• pnpm run grafana:build — committed dashboard matches generated output
• docker build — succeeds
• pnpm audit — no known vulnerabilities

After merge

Tag v1.1.1 on main to trigger the Docker Hub publish (stakely/stvaults-watcher:v1.1.1 + :latest).

🤖 Generated with Claude Code

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)

• Dockerfile
• grafana/dashboard.json
• package.json
• pnpm-lock.yaml
• pnpm-workspace.yaml
• src/grafana/panels.ts

---

_{Reviewed by gpt-5.6-terra · Input: 144.7K · Output: 6.5K · Cached: 965.4K}