replace retired pnpm audit with OSV-Scanner gate

.github/workflows/test.yml

@@ -49,8 +49,12 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - name: Audit
-        run: pnpm audit --audit-level high
+      - name: Audit dependencies (OSV-Scanner)
+        uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
+        with:
+          scan-args: |-
+            --config=osv-scanner.toml
+            --lockfile=pnpm-lock.yaml
 
   complete:
     if: always()

Makefile

@@ -10,6 +10,9 @@ FACILITATOR_TAG ?= x402-stellar-facilitator:$(LABEL)
 SERVER_TAG      ?= x402-stellar-server:$(LABEL)
 CLIENT_TAG      ?= x402-stellar-client:$(LABEL)
 
+# Pinned to match the OSV-Scanner version used in CI (.github/workflows/test.yml)
+OSV_SCANNER_IMAGE ?= ghcr.io/google/osv-scanner:v2.3.8
+
 help: ## Show this help message
 	@echo 'Usage: make [target]'
 	@echo ''
@@ -43,8 +46,9 @@ typecheck: ## Type check the project
 test: ## Run tests
 	pnpm test
 
-audit: ## Check dependencies for high/critical vulnerabilities
-	pnpm audit --audit-level high
+audit: ## Scan dependencies for known vulnerabilities (OSV-Scanner, mirrors CI)
+	$(SUDO) docker run --rm -v "$(CURDIR):/src" -w /src $(OSV_SCANNER_IMAGE) \
+		--config=osv-scanner.toml --lockfile=pnpm-lock.yaml
 
 check: install format lint typecheck test audit build ## Install, run all checks (format, lint, typecheck, test, audit), and build
 

osv-scanner.toml

@@ -0,0 +1,29 @@
+# OSV-Scanner configuration
+# Docs: https://google.github.io/osv-scanner/configuration/
+#
+# The CI "Audit dependencies (OSV-Scanner)" step blocks on ANY known
+# vulnerability in pnpm-lock.yaml, regardless of severity. Use this file to
+# silence advisories that are non-actionable for us (no fix available, not
+# reachable, false positive, etc.) so the gate stays meaningful.
+#
+# Prefer ignoring specific advisory IDs over lowering the whole gate. Always
+# give a reason, and set ignoreUntil so ignores get periodically re-reviewed
+# rather than lingering forever.
+
+[[IgnoredVulns]]
+id = "GHSA-848j-6mx2-7j84"          # elliptic ECDSA leading-zero signature flaw
+ignoreUntil = 2026-10-01            # re-evaluate; no upstream fix as of 2026-07
+reason = "No fixed version exists (6.6.1 is latest). Transitive only, via browserify-sign / create-ecdh / secp256k1 / tiny-secp256k1 pulled in by wallet SDKs. Re-check for a patched release."
+
+# --- Example: ignore a specific advisory ---
+# [[IgnoredVulns]]
+# id = "GHSA-xxxx-xxxx-xxxx"        # GHSA or OSV/CVE id from the scan output
+# ignoreUntil = 2026-10-01          # optional; re-evaluate after this date
+# reason = "No upstream fix yet; vulnerable code path is not reachable from our usage."
+
+# --- Example: override / ignore all vulns for a single package ---
+# [[PackageOverrides]]
+# name = "some-package"
+# ecosystem = "npm"
+# vulnerability.ignore = true
+# reason = "Transitive dev-only dependency; not shipped."

package.json

@@ -20,8 +20,9 @@
     "overrides": {
       "typescript": "^5.9.3",
       "axios": "^1.16.1",
+      "esbuild": "^0.28.1",
       "form-data": "^4.0.6",
-      "protobufjs": "^7.5.6",
+      "protobufjs": "^7.6.3",
       "uuid": "^14.0.0",
       "ws@8": "^8.21.0"
     }