Skip to main content

Dependency Hardening (Snyk CI Gate)

Version: 1.0.0 Date: 2026-07-15

Goal: CI runs snyk test on the full lockfile; all reported issues must be resolved, not dismissed as preexisting.

Solution: Bump OpenTelemetry stack, NestJS, ethers, and pin patched transitive versions via npm overrides.

Packages addressed:

  • OpenTelemetry — sdk-node@0.220, exporter-trace-otlp-proto@0.219, resources@2; main.ts migrated to resourceFromAttributes + ATTR_SERVICE_NAME
  • NestJS 11.1.28, ethers@6.17, joi@17.13.4
  • Overrides — @grpc/grpc-js, protobufjs, multer, body-parser, form-data, brace-expansion, ws, qs, lodash, tough-cookie

Files Modified:

  • package.json - Direct upgrades + overrides
  • package-lock.json - Lockfile refresh
  • src/main.ts - OpenTelemetry resource API migration