* Mitigate axios supply-chain compromise (CVE-2026-03-31)
Pin axios to 1.13.5 via overrides to prevent resolution of compromised
1.14.1/0.30.4 versions. Add bunfig.toml with minimumReleaseAge=604800
(7 days) and .npmrc min-release-age=7 as defense-in-depth against
future supply-chain attacks.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add changeset for axios supply-chain mitigation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add impl plan for defihack
* add Yellow + LI.FI multi-track support with ENS hydration and e2e demo runbook
- implement end-to-end custom action support in compiler, IR generation, runtime action resolution, and executor routing
- add new offchain venue adapters: and , and register/export them in
- add adapter test suites for Yellow session lifecycle and LI.FI swap/bridge/compose_execute flows
- add LI.FI compose_execute safety guard: enforce unless explicit override is set
- add CLI ENS profile hydration (, ) for and
- clamp ENS-hydrated to safe bounds (0..500) in
- remove unused/dead ENS helper surface
- add DefiHack demo spells and prompt-first README runbook (VM rehearsal + deterministic CLI e2e)
- update README and reference docs for new venues and CLI flags
* Add changeset
* Remove unused docs
- rename package names/imports/docs/scripts to @grimoirelabs/*
- keep CLI bin name as grimoire
- update publish docs for new scope
- fix formatting in venue tests
Fran Algaba