[seunlanlege]

Summary

The indexer's package.json had nine @subql packages, four @polkadot packages and typescript on latest, and most other dependencies on caret ranges. A latest specifier resolves to whatever npm tags as latest on the day the lockfile is refreshed. @subql/common@5.8.3 was briefly tagged latest on 2026-10-05 and carried a credential-stealing payload (StepSecurity advisory).

• Every indexer dependency is pinned to the version sdk/pnpm-lock.yaml already resolved, so the installed tree does not change. The workspace:* link to @hyperbridge/sdk stays.
• The release tarball's package.json, written by publish-indexer.yml, is pinned to the same six versions. Deployments install it with npm install and no lockfile, so its caret ranges resolved fresh on every deploy.
• The note is sdk/packages/indexer/docs/ai/changelog/2026-10-22-indexer-dependencies-are-pinned.md.

CI's pnpm

Ten workflow steps asked pnpm/action-setup for pnpm 11, the newest 11.x release. They now ask for 11.0.0, the version sdk/package.json names in packageManager.

Since pnpm 11.28.7 came out on 2026-10-21, every pnpm install in those workflows failed with High-risk trust downgrade for "@pnpm/exe@11.0.0". The newer pnpm downloads the packageManager version to switch to it, and that download now goes through the workspace's trustPolicy: no-downgrade. @pnpm/exe@11.0.0 has provenance where earlier releases had a trusted publisher, so the check refuses it. With the exact version installed, pnpm never switches.

This also unblocks publish-sdk, publish-core and publish-simplex, which would have failed the same way on their next release. The note is docs/ai/changelog/2026-10-22-ci-pnpm-matches-packagemanager.md.

lz-endpoint build

Touching test-lz-endpoint.yml ran the lz-endpoint job, which had been failing to compile since #994 (2026-06-25). #994 made HyperApp.quote non-view so it could CALL fee oracles that price by simulating a swap. HyperbridgeLzEndpoint.quote overrides LayerZero's view quote and called it, which no longer compiles.

The endpoint now reads the host's fee oracle through its own view interface, as it did before #994. HyperApp.quote is unchanged for its other callers.

Because LayerZero requires a view quote, a native-fee quote reverts where the host's oracle is a Uniswap V3 wrapper (Ethereum, Polygon) or V4 wrapper (Arbitrum, Base). That was already true before #994. Fee-token quotes work on every chain, and BSC's PancakeSwap V2 oracle also quotes natively. The lz-endpoint README now says so.

Exposure

The latest release, v3.8.7, does not contain 5.8.3:

• Its build installed from the frozen lockfile, which resolves @subql/common to 5.8.2.
• Neither release tarball contains any of the advisory's indicators.
• The node images it deploys, polytopelabs/subql-node-ethereum:v6.5.0 and polytopelabs/subql-node-substrate:v6.4.9-0, were pushed on 2026-09-23 and ship 5.8.2.

No lockfile on main resolves 5.8.3.

Validation

• pnpm install --frozen-lockfile --lockfile-only passes with pnpm 11.0.0, and fails when a specifier is deliberately mismatched.
• pnpm 11.28.7 reproduces the trust-downgrade failure locally on the same tree.
• The lockfile diff touches only specifier: lines.
• Every changed workflow parses, and publish-indexer.yml's embedded package.json is valid JSON.
• lz-endpoint: forge build and all 23 tests pass on a current mainnet fork with solc 0.8.37.
• Against the live hosts, a scratch fork test (not committed) showed the native-fee quote reverting on Ethereum, Arbitrum, Base and Polygon and succeeding on BSC. Fee-token quotes succeeded on all five.