Cardano Updates

  'GetStakeDistribution' raises an error in protocol version >= 13; we must rely on GetPoolDistr2 instead.

  This is mostly useless now since Alonzo transactions are mostly valid Conway transactions. So in practice, the fallback are only adding noise to the error message; In particular, the rest of the code cannot upgrade from eras that are too old anyway; which means that even if we would successfully let a BabbageEra transaction parse, it would later fail with a worse error anyway.

Bumps [ts-deepmerge](https://github.com/voodoocreation/ts-deepmerge) from 6.2.0 to 8.0.0.
- [Release notes](https://github.com/voodoocreation/ts-deepmerge/releases)
- [Commits](https://github.com/voodoocreation/ts-deepmerge/compare/6.2.0...8.0.0)

---
updated-dependencies:
- dependency-name: ts-deepmerge
  dependency-version: 8.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.32.17 to 1.32.25.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.32.17...config/v1.32.25)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) from 1.19.23 to 1.19.24.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/credentials/v1.19.23...credentials/v1.19.24)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.19.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The Sept-2025 qix-hack lockdown is no longer needed: all 18 malicious
releases have been unpublished from npm (404: [email protected], [email protected],
[email protected], ...), so they can neither match a constraint nor be
resolved.

- .yarn/constraints.pro: dropped the ForbidMaliciousReleases blocklist,
  kept as a documented placeholder. The constraints plugin and the CI
  `yarn constraints` check are retained for future supply-chain rules.
- resolutions: removed the 18 color/ansi/debug cluster pins. Yarn now
  resolves them to clean current versions, verified to exclude every
  previously-blocked release (ansi-regex 6.2.2 not 6.2.1, debug 4.4.3
  not 4.4.2, ansi-styles 6.2.3 not 6.2.2).

Build green; yarn install --immutable clean; yarn constraints passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

ws now resolves naturally to 7.5.11 + 8.21.0, both above the patched
floors (7.5.10 / 8.17.1). OSV clean. Resolution no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

WebdriverIO v9 self-manages browser drivers, so wdio-chromedriver-service
and the chromedriver package are removed; the legacy yarn-install dep is
dropped and mocha moves to 10.8.2 (patched nanoid/serialize-javascript/
diff), with cross-spawn 4.0.2 gone. The over-broad global chalk pin is
removed (v9 needs chalk 5 ESM; our CJS tools keep chalk 4 via their own
^4 ranges).

Includes the test migration v9 requires (caught by the strict tsc build):
- wdio.conf.js: autoCompileOpts (removed in v8) -> tsConfigPath; drop the
  'chromedriver' service entry
- tsconfig types: webdriverio/async -> @wdio/globals/types
- specs: toHaveTextContaining -> toHaveText(x, { containing: true }) /
  toContain; await $$(sel).length (now a Promise in v9)

Resolutions removed: chalk, nanoid, serialize-javascript, diff, cross-spawn.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The two scoped minimatch pins (~3.0.2->3.1.5, 5.0.1->5.1.9) are no
longer needed: natural resolution yields 3.1.5 / 5.1.9 / 7.4.9 / 8.0.7
/ 9.0.9 / 10.2.5, all OSV-clean (3.x ReDoS fixed in 3.0.5).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

dockerode@4 declares tar-fs ^2.1.4 (patched), the last sub-2.1.4 parent
(puppeteer-core's 2.1.1 was already dropped by the wdio v9 upgrade).
tar-fs now resolves to 2.1.4 / 3.1.2 everywhere. Resolution removed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

No open Dependabot alert for protobufjs; natural resolution is 7.2.6 +
7.6.4, both above the CVE-2023-36665 fix (7.2.4). The forced 7.6.4 pin
is no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

No open Dependabot alert for protobufjs; natural resolution is 7.2.6 +
7.6.4, both above the CVE-2023-36665 fix (7.2.4). The forced 7.6.4 pin
is no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

dockerode@4 declares tar-fs ^2.1.4 (patched), the last sub-2.1.4 parent
(puppeteer-core's 2.1.1 was already dropped by the wdio v9 upgrade).
tar-fs now resolves to 2.1.4 / 3.1.2 everywhere. Resolution removed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The two scoped minimatch pins (~3.0.2->3.1.5, 5.0.1->5.1.9) are no
longer needed: natural resolution yields 3.1.5 / 5.1.9 / 7.4.9 / 8.0.7
/ 9.0.9 / 10.2.5, all OSV-clean (3.x ReDoS fixed in 3.0.5).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

ws now resolves naturally to 7.5.11 + 8.21.0, both above the patched
floors (7.5.10 / 8.17.1). OSV clean. Resolution no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>