fix: update vulnerable dependencies and tolerate thin mainnet DEX liquidity

[decofe]

Why

New advisories for axios, brace-expansion, @grpc/grpc-js, dompurify, fast-uri, hono and ip-address make pnpm audit fail on main (30 findings). That breaks the Verify / Checks job on every open PR, and the release workflow runs the same audit gate before publishing.

What

• Raise the existing security overrides in pnpm-workspace.yaml to the first patched versions:
  • @grpc/grpc-js 1.14.5
  • axios 1.20.0
  • brace-expansion 1.1.21 / 2.1.7 / 5.0.12
  • dompurify 3.4.16
  • fast-uri 3.1.8
  • hono 4.13.7
  • ip-address 10.7.1
• Raise the hono catalog floor to ^4.13.7 so the root importer resolves the patched version too.
• Remove the version-pinned minimumReleaseAgeExclude entries for the old override targets. All the new targets were published more than 24 hours ago, so they don't need exclusions.
• Refresh the lockfile. Direct dependencies and publishing logic are unchanged.

Also included: mainnet autoSwap test

This PR also carries the test fix from #858. The audit fix and the test fix each clear the other PR's red check, so they're combined here to land together.

relay.localnet.test.ts > mainnet autoSwap with USDC.e → PathUSD runs against live mainnet. Mainnet stablecoin DEX liquidity for USDC.e → PathUSD is currently too thin for the test's 0.5 PathUSD swap (the quote reverts with InsufficientLiquidity; 0.001 still quotes). The test now:

• swaps 0.001 PathUSD instead of 0.5
• skips with a reason if the DEX can't quote that amount

The relay assertions are unchanged.

Validation

• pnpm audit: exits 0 (the 2 remaining findings are already in auditConfig.ignoreGhsas)
• pnpm install --frozen-lockfile, pnpm -w build, pnpm -w check, tsc -b: passed
• playgrounds/wagmi build: passed
• Mainnet autoSwap test, run alone against mainnet: passes at 0.001, skips at 0.5

Prompted by: @brendanjryan

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
accounts-site	Ready	Preview	Oct 1, 2026 8:34pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hono@​4.13.5 ⏵ 4.13.7	+1	+2	+1

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/tempoxyz/accounts@857

commit: f5bf8fb

[github-actions]

Worker	Preview
Wagmi	https://4c6c5a6d-accounts-wagmi.porto.workers.dev

[github-actions]

Worker	Preview
Playground	https://b5b12548-accounts-playground.porto.workers.dev

[github-actions]

Worker	Preview
Wagmi	https://3c442046-accounts-wagmi.porto.workers.dev

[github-actions]

Worker	Preview
Playground	https://694b3fd9-accounts-playground.porto.workers.dev