chore: harden pnpm installs (#347)

* chore: harden pnpm installs

* chore: pin pnpm version in workflows

* chore: fix pnpm audit findings

* chore: fix pnpm audit findings

* chore: harden pnpm configuration

* chore: move pnpm config to workspace

* fix: include pnpm workspace config in docker build

Author: 0xJem

.dockerignore

@@ -3,6 +3,7 @@
 !hardhat.config.ts
 !package.json
 !pnpm-lock.yaml
+!pnpm-workspace.yaml
 !contracts
 !scripts
 !deployment/localhost

.gitignore

@@ -27,3 +27,5 @@ deployments/**/solcinputs
 # OpenZeppelin upgradeable files
 .openzeppelin/unknown-*.json
 /flatten
+
+.pnpm-store/

.npmrc

@@ -17,7 +17,8 @@ RUN mkdir -p /opt
 WORKDIR /opt
 COPY package.json .
 COPY pnpm-lock.yaml .
-RUN corepack enable
+COPY pnpm-workspace.yaml .
+RUN corepack enable && corepack prepare pnpm@10.33.0 --activate
 # Workaround for an issue with package manager and git
 RUN git config --global url."https://github.com/".insteadOf ssh://git@github.com/ && \
     git config --global url."https://".insteadOf git://

Dockerfile

@@ -80,180 +80,11 @@
     "url": "https://github.com/OlympusDAO/olympus-contracts/issues"
   },
   "homepage": "https://github.com/OlympusDAO/olympus-contracts#readme",
-  "packageManager": "pnpm@10.33.0",
   "engines": {
     "node": ">=22",
-    "pnpm": "10.33.0",
+    "pnpm": ">=10.33.0",
     "npm": "use-pnpm",
     "yarn": "use-pnpm"
   },
-  "pnpm": {
-    "overrides": {
-      "ajv": "^8.18.0",
-      "ajv@<6.14.0": "^6.14.0",
-      "ajv@>=7.0.0-alpha.0 <8.18.0": "^8.18.0",
-      "ansi-regex": "^4.1.1",
-      "ansi-regex@>=3.0.0 <3.0.1": "^3.0.1",
-      "ansi-regex@>=4.0.0 <4.1.1": "^4.1.1",
-      "async": "^2.6.4",
-      "async@>=2.0.0 <2.6.4": "^2.6.4",
-      "axios": "^1.15.0",
-      "axios@<0.30.0": "^1.15.0",
-      "axios@<=0.30.2": "^1.15.0",
-      "axios@>=0.8.1 <0.28.0": "^1.15.0",
-      "babel-traverse": "6.26.0",
-      "base-x": "^3.0.11",
-      "base-x@<=3.0.10": "^3.0.11",
-      "bn.js": "^5.2.3",
-      "bn.js@<4.12.3": "^4.12.3",
-      "bn.js@>=5.0.0 <5.2.3": "^5.2.3",
-      "body-parser": "^1.20.3",
-      "body-parser@<1.20.3": "^1.20.3",
-      "brace-expansion": "^2.0.3",
-      "brace-expansion@<1.1.13": "^1.1.13",
-      "brace-expansion@>=1.0.0 <=1.1.11": "^1.1.12",
-      "brace-expansion@>=2.0.0 <2.0.3": "^2.0.3",
-      "brace-expansion@>=2.0.0 <=2.0.1": "^2.0.2",
-      "braces": "^3.0.3",
-      "braces@<3.0.3": "^3.0.3",
-      "browserify-sign": "^4.2.2",
-      "browserify-sign@>=2.6.0 <=4.2.1": "^4.2.2",
-      "cipher-base": "^1.0.5",
-      "cipher-base@<=1.0.4": "^1.0.5",
-      "cookie@<0.7.0": "^0.7.0",
-      "cookiejar": "^2.1.4",
-      "cookiejar@<2.1.4": "^2.1.4",
-      "cross-spawn": "^7.0.5",
-      "cross-spawn@<6.0.6": "^6.0.6",
-      "cross-spawn@>=7.0.0 <7.0.5": "^7.0.5",
-      "debug@>=3.2.0 <3.2.7": "^3.2.7",
-      "decode-uri-component": "^0.2.1",
-      "decode-uri-component@<0.2.1": "^0.2.1",
-      "diff": "5.2.2",
-      "diff@<3.5.1": "^3.5.1",
-      "diff@>=4.0.0 <4.0.4": "^4.0.4",
-      "diff@>=5.0.0 <5.2.2": "^5.2.2",
-      "elliptic": "^6.6.1",
-      "elliptic@<6.5.6": "^6.5.6",
-      "elliptic@<6.6.0": "^6.6.0",
-      "elliptic@<=6.6.0": "^6.6.1",
-      "elliptic@>=2.0.0 <=6.5.6": "^6.5.7",
-      "elliptic@>=4.0.0 <=6.5.6": "^6.5.7",
-      "elliptic@>=5.2.1 <=6.5.6": "^6.5.7",
-      "es5-ext@>=0.10.0 <0.10.63": "^0.10.63",
-      "express": "^4.19.2",
-      "express@<4.19.2": "^4.19.2",
-      "express@<4.20.0": "^4.20.0",
-      "flatted": "^3.4.2",
-      "flatted@<3.4.0": "^3.4.0",
-      "flatted@<=3.4.1": "^3.4.2",
-      "follow-redirects": "^1.16.0",
-      "follow-redirects@<1.14.7": "^1.14.7",
-      "follow-redirects@<1.14.8": "^1.14.8",
-      "follow-redirects@<1.15.4": "^1.16.0",
-      "follow-redirects@<=1.15.5": "^1.16.0",
-      "form-data": "^4.0.4",
-      "form-data@<2.5.4": "^2.5.4",
-      "form-data@>=3.0.0 <3.0.4": "^3.0.4",
-      "form-data@>=4.0.0 <4.0.4": "^4.0.4",
-      "get-func-name": "^2.0.1",
-      "get-func-name@<2.0.1": "^2.0.1",
-      "got": "^11.8.5",
-      "got@<11.8.5": "^11.8.5",
-      "handlebars": "^4.7.9",
-      "handlebars@>=4.0.0 <4.7.9": "^4.7.9",
-      "handlebars@>=4.0.0 <=4.7.8": "^4.7.9",
-      "handlebars@>=4.6.0 <=4.7.8": "^4.7.9",
-      "http-cache-semantics": "^4.1.1",
-      "http-cache-semantics@<4.1.1": "^4.1.1",
-      "immutable": "^4.3.8",
-      "immutable@>=4.0.0-rc.1 <4.3.8": "^4.3.8",
-      "js-yaml": "^4.1.1",
-      "js-yaml@<3.14.2": "^3.14.2",
-      "js-yaml@>=4.0.0 <4.1.1": "^4.1.1",
-      "json-schema": "^0.4.0",
-      "json-schema@<0.4.0": "^0.4.0",
-      "json5": "^1.0.2",
-      "json5@<1.0.2": "^1.0.2",
-      "lodash": "^4.18.0",
-      "lodash@<4.17.21": "^4.17.21",
-      "lodash@<=4.17.23": "^4.18.0",
-      "lodash@>=4.0.0 <4.17.21": "^4.17.21",
-      "lodash@>=4.0.0 <=4.17.22": "^4.17.23",
-      "lodash@>=4.0.0 <=4.17.23": "^4.18.0",
-      "marked": "^4.0.10",
-      "marked@<4.0.10": "^4.0.10",
-      "micromatch": "^4.0.8",
-      "micromatch@<4.0.8": "^4.0.8",
-      "min-document@<=2.19.0": "^2.19.1",
-      "minimatch": "^5.1.8",
-      "minimatch@<3.0.5": "^3.0.5",
-      "minimatch@<3.1.3": "^3.1.3",
-      "minimatch@<3.1.4": "^3.1.4",
-      "minimatch@>=5.0.0 <5.1.7": "^5.1.7",
-      "minimatch@>=5.0.0 <5.1.8": "^5.1.8",
-      "minimist": "^1.2.6",
-      "minimist@>=1.0.0 <1.2.6": "^1.2.6",
-      "node-fetch": "^2.6.7",
-      "node-fetch@<2.6.7": "^2.6.7",
-      "path-to-regexp": "^0.1.13",
-      "path-to-regexp@<0.1.10": "^0.1.10",
-      "path-to-regexp@<0.1.12": "^0.1.12",
-      "path-to-regexp@<0.1.13": "^0.1.13",
-      "pbkdf2": "^3.1.3",
-      "pbkdf2@>=1.0.0 <=3.1.2": "^3.1.3",
-      "pbkdf2@>=3.0.10 <=3.1.2": "^3.1.3",
-      "picomatch": "^4.0.4",
-      "picomatch@<2.3.2": "^2.3.2",
-      "picomatch@>=4.0.0 <4.0.4": "^4.0.4",
-      "qs": "^6.14.1",
-      "qs@<6.14.1": "^6.14.1",
-      "qs@>=6.10.0 <6.10.3": "^6.10.3",
-      "qs@>=6.5.0 <6.5.3": "^6.5.3",
-      "qs@>=6.7.0 <6.7.3": "^6.7.3",
-      "qs@>=6.7.0 <=6.14.1": "^6.14.2",
-      "request": "npm:@cypress/request@3.0.10",
-      "secp256k1": "^4.0.4",
-      "secp256k1@<=3.8.0": "^3.8.1",
-      "secp256k1@>=4.0.0 <4.0.4": "^4.0.4",
-      "semver": "^7.5.2",
-      "semver@>=2.0.0-alpha <5.7.2": "^5.7.2",
-      "semver@>=6.0.0 <6.3.1": "^6.3.1",
-      "semver@>=7.0.0 <7.5.2": "^7.5.2",
-      "send@<0.19.0": "^0.19.0",
-      "serialize-javascript": "^7.0.5",
-      "serialize-javascript@<7.0.5": "^7.0.5",
-      "serialize-javascript@<=7.0.2": "^7.0.3",
-      "serve-static@<1.16.0": "^1.16.0",
-      "sha.js": "^2.4.12",
-      "sha.js@<=2.4.11": "^2.4.12",
-      "shelljs": "^0.8.5",
-      "shelljs@<0.8.5": "^0.8.5",
-      "simple-get": "^2.8.2",
-      "simple-get@<2.8.2": "^2.8.2",
-      "tar": "^7.5.11",
-      "tar@<6.2.1": "^6.2.1",
-      "tar@<7.5.7": "^7.5.7",
-      "tar@<7.5.8": "^7.5.8",
-      "tar@<=7.5.10": "^7.5.11",
-      "tar@<=7.5.2": "^7.5.3",
-      "tar@<=7.5.3": "^7.5.4",
-      "tar@<=7.5.9": "^7.5.10",
-      "tmp@<=0.2.3": "^0.2.4",
-      "tough-cookie": "^4.1.3",
-      "tough-cookie@<4.1.3": "^4.1.3",
-      "underscore": "^1.13.8",
-      "underscore@<=1.13.7": "^1.13.8",
-      "underscore@>=1.3.2 <1.12.1": "^1.12.1",
-      "undici": "6.24.0",
-      "undici@<6.24.0": "6.24.0",
-      "word-wrap": "^1.2.4",
-      "word-wrap@<1.2.4": "^1.2.4",
-      "ws": "^7.5.10",
-      "ws@>=2.1.0 <5.2.4": "^5.2.4",
-      "ws@>=7.0.0 <7.5.10": "^7.5.10",
-      "yargs-parser": "^5.0.1",
-      "yargs-parser@<=5.0.0": "^5.0.1"
-    }
-  }
+  "packageManager": "pnpm@10.33.0"
 }