chore(hatchet): remediate vulnerable transitives

[kattsushi]

Closes #156

Summary

• Pin patched Hatchet runtime transitives while keeping the direct SDK at 1.28.2.
• Upgrade the OpenTelemetry packages as a coherent 2.10.0 family.
• Reduce the repository audit from 121 to 96 findings and remove all targeted advisories.

Changes

File	Change
package.json	Add exact pnpm security overrides for gRPC, protobuf, Axios, and OpenTelemetry.
pnpm-lock.yaml	Resolve the patched dependency graph without unrelated direct upgrades.

Type

• Bug fix
• New feature
• Documentation only
• Code refactoring
• Maintenance/tooling
• Breaking change

Test plan

• pnpm install --frozen-lockfile
• Hatchet lint, typecheck, build, and tests: 142 tests passed.
• React Router example typecheck, build, and tests: 71 tests passed.
• Full workspace lint, typecheck, build, and tests passed.
• Audit confirms no advisories remain for the targeted packages.
• Audit delta: 121 → 96 findings (−8 high, −17 moderate).

Notes

• A live Hatchet service smoke test was not run because external service credentials were not part of this work unit.
• Existing unrelated audit findings remain for separate remediation units.

Contributor checklist

• Linked approved issue chore(hatchet): remediate vulnerable runtime transitives #156.
• Selected exactly one PR type (type:chore).
• No shell scripts were modified; shellcheck is not applicable.
• Commit uses Conventional Commit format.
• Commit contains no Co-Authored-By trailer.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bc057bb8-c417-46d2-b042-601353176b0b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}