security(deps): pin @asyncapi packages to non-compromised versions

[alexander-sei]

Summary

Hardens sei-js against the 2026-07-14 AsyncAPI npm supply-chain
compromise ("Miasma RAT", dropped via a post-install sync.js) by
pinning the affected @asyncapi/* packages to their latest
non-compromised versions through pnpm.overrides.

Background

During a ~4-hour window on 2026-07-14, these versions were malicious:

Package	Compromised	Latest safe (pinned)
@asyncapi/specs	6.11.2	6.11.1
@asyncapi/generator	3.3.1	3.3.0
@asyncapi/generator-helpers	1.1.1	1.1.0
@asyncapi/generator-components	0.7.1	1.0.0

How sei-js is exposed

sei-js has no direct @asyncapi dependency, but the mint (Mintlify)
docs CLI pulls it transitively:

mint → @asyncapi/parser@3.4.0 → @asyncapi/specs "^6.8.0"

That ^6.8.0 range floats, so a fresh install or lockfile
regeneration could have resolved the compromised 6.11.2. No
compromised version was ever actually in pnpm-lock.yaml (it was
pinned at 6.10.0), and the generator* packages are not in the tree
at all.

What changed

• package.json: added a pnpm.overrides block pinning the four
  packages above.
• pnpm-lock.yaml: @asyncapi/specs 6.10.0 → 6.11.1 (the only
  resolved version change) + the recorded overrides section.
• The generator* pins add no packages — they're defense-in-depth
  so the compromised releases can never enter the tree if AsyncAPI
  codegen is adopted later.
• Other deprecated: lines in the lockfile diff are registry metadata
  pnpm refreshed during the rewrite — no versions or integrity hashes
  changed.

Verification

• pnpm install --lockfile-only is idempotent (second run = no further
  changes) → --frozen-lockfile CI will pass.
• @asyncapi/specs now resolves to a single version, 6.11.1.
• No compromised version string exists anywhere in the lockfile.

Notes

• No changeset needed: the override affects only the workspace
  dev/CI install (docs tooling); it is not published into any package's
  metadata, so consumers of sei-js packages are unaffected.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: d2c1983

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

PR Summary

Low Risk
Dev/CI-only lockfile and override changes with no runtime or published package impact; reduces supply-chain risk rather than introducing new behavior.

Overview
Adds pnpm.overrides in the root package.json to pin four @asyncapi/* packages to last-known-safe releases after the 2026 AsyncAPI npm supply-chain incident, so installs cannot float into compromised versions.

The lockfile records those overrides and bumps the only resolved package in the tree—@asyncapi/specs (via mint → @asyncapi/parser)—from 6.10.0 to 6.11.1. Pins on @asyncapi/generator* are preventive; those packages are not currently in the dependency tree. Remaining lockfile churn is refreshed deprecated registry metadata, not version or integrity changes.

^{Reviewed by Cursor Bugbot for commit d2c1983. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.75%. Comparing base (bc17ace) to head (d2c1983).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #316   +/-   ##
=======================================
  Coverage   79.75%   79.75%           
=======================================
  Files          83       83           
  Lines        1309     1309           
  Branches      160      189   +29     
=======================================
  Hits         1044     1044           
+ Misses        265      259    -6     
- Partials        0        6    +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.