chore: Bump lavamoat from 10.0.1 to 10.0.2 (#3752)

Bumps
[lavamoat](https://github.com/LavaMoat/lavamoat/tree/HEAD/packages/lavamoat-node)
from 10.0.1 to 10.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/LavaMoat/lavamoat/releases">lavamoat's
releases</a>.</em></p>
<blockquote>
<h2>lavamoat: v10.0.2</h2>
<h2><a
href="https://github.com/LavaMoat/LavaMoat/compare/lavamoat-v10.0.1...lavamoat-v10.0.2">10.0.2</a>
(2025-11-19)</h2>
<h3>Dependencies</h3>
<ul>
<li>The following workspace dependencies were updated
<ul>
<li>dependencies
<ul>
<li>lavamoat-core bumped from ^17.0.1 to ^17.1.0</li>
<li>lavamoat-tofu bumped from ^8.0.11 to ^8.1.0</li>
</ul>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/LavaMoat/LavaMoat/blob/main/packages/lavamoat-node/CHANGELOG.md">lavamoat's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/LavaMoat/LavaMoat/compare/lavamoat-v10.0.1...lavamoat-v10.0.2">10.0.2</a>
(2025-11-19)</h2>
<h3>Dependencies</h3>
<ul>
<li>The following workspace dependencies were updated
<ul>
<li>dependencies
<ul>
<li>lavamoat-core bumped from ^17.0.1 to ^17.1.0</li>
<li>lavamoat-tofu bumped from ^8.0.11 to ^8.1.0</li>
</ul>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/LavaMoat/LavaMoat/commit/3a2edd40482b0f06ebd95eb08054ceb073c6ecdf"><code>3a2edd4</code></a>
chore: release main (<a
href="https://github.com/LavaMoat/lavamoat/tree/HEAD/packages/lavamoat-node/issues/1849">#1849</a>)</li>
<li>See full diff in <a
href="https://github.com/LavaMoat/lavamoat/commits/lavamoat-v10.0.2/packages/lavamoat-node">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lavamoat&package-manager=npm_and_yarn&previous-version=10.0.1&new-version=10.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Updates lavamoat to 10.0.2 and tightens LavaMoat policies to allow
specific worker_threads and EventEmitter APIs.
> 
> - **LavaMoat policies**:
> -
`packages/snaps-execution-environments/lavamoat/webpack/node-*/policy.json`:
> - Replace `worker_threads` builtin allow with targeted
`worker_threads.Worker` and `worker_threads.parentPort` for
`@metamask/post-message-stream`.
> - Replace `events` allow with `events.EventEmitter` for
`@metamask/providers>@metamask/safe-event-emitter`.
> - **Dependencies**:
> - Bump `lavamoat` devDependency to `^10.0.2` and update lockfile
(bringing in `lavamoat-core@^17.1.0` and `lavamoat-tofu@^8.1.0`).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
89a056f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MetaMask Bot <[email protected]>

Author: dependabot[bot]

packages/snaps-execution-environments/lavamoat/webpack/node-process/policy.json

@@ -29,7 +29,8 @@
     },
     "@metamask/post-message-stream": {
       "builtin": {
-        "worker_threads": true
+        "worker_threads.Worker": true,
+        "worker_threads.parentPort": true
       },
       "globals": {
         "MessageEvent.prototype": true,
@@ -71,7 +72,7 @@
     },
     "@metamask/providers>@metamask/safe-event-emitter": {
       "builtin": {
-        "events": true
+        "events.EventEmitter": true
       },
       "globals": {
         "setTimeout": true

packages/snaps-execution-environments/lavamoat/webpack/node-thread/policy.json

@@ -29,7 +29,8 @@
     },
     "@metamask/post-message-stream": {
       "builtin": {
-        "worker_threads": true
+        "worker_threads.Worker": true,
+        "worker_threads.parentPort": true
       },
       "globals": {
         "MessageEvent.prototype": true,
@@ -71,7 +72,7 @@
     },
     "@metamask/providers>@metamask/safe-event-emitter": {
       "builtin": {
-        "events": true
+        "events.EventEmitter": true
       },
       "globals": {
         "setTimeout": true

packages/snaps-execution-environments/package.json

@@ -101,7 +101,7 @@
     "jest-environment-node": "^29.5.0",
     "jest-fetch-mock": "^3.0.3",
     "jest-silent-reporter": "^0.6.0",
-    "lavamoat": "^10.0.1",
+    "lavamoat": "^10.0.2",
     "prettier": "^3.3.3",
     "rimraf": "^4.1.2",
     "serve-handler": "^6.1.5",

yarn.lock

@@ -4359,7 +4359,7 @@ __metadata:
     jest-environment-node: "npm:^29.5.0"
     jest-fetch-mock: "npm:^3.0.3"
     jest-silent-reporter: "npm:^0.6.0"
-    lavamoat: "npm:^10.0.1"
+    lavamoat: "npm:^10.0.2"
     prettier: "npm:^3.3.3"
     readable-stream: "npm:^3.6.2"
     rimraf: "npm:^4.1.2"
@@ -13676,25 +13676,25 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lavamoat-core@npm:^17.0.1":
-  version: 17.0.1
-  resolution: "lavamoat-core@npm:17.0.1"
+"lavamoat-core@npm:^17.0.1, lavamoat-core@npm:^17.1.0":
+  version: 17.1.0
+  resolution: "lavamoat-core@npm:17.1.0"
   dependencies:
     "@babel/types": "npm:7.27.3"
     "@lavamoat/types": "npm:^0.1.0"
     json-stable-stringify: "npm:1.3.0"
-    lavamoat-tofu: "npm:^8.0.11"
+    lavamoat-tofu: "npm:^8.1.0"
     merge-deep: "npm:3.0.3"
     ses: "npm:1.14.0"
   bin:
     lavamoat-sort-policy: src/policy-sort-cli.js
-  checksum: 10/216db62524b416ba5670ae237ccdb94d07a04a84294c9193c3f8cd245dc883f37f993bdecefb22f99f8d742e7297303b9dca430631e4a74547c8b9dc94592e2f
+  checksum: 10/bc45feddf10ecc563a938df315b639100874bcd0e22a388fe2047f1f93579f8f9967653aff6e416d0079f9cd11240e2bc9a45c698ec781070bb525fb3584af27
   languageName: node
   linkType: hard
 
-"lavamoat-tofu@npm:^8.0.11":
-  version: 8.0.11
-  resolution: "lavamoat-tofu@npm:8.0.11"
+"lavamoat-tofu@npm:^8.1.0":
+  version: 8.1.0
+  resolution: "lavamoat-tofu@npm:8.1.0"
   dependencies:
     "@babel/parser": "npm:7.27.3"
     "@babel/traverse": "npm:7.27.3"
@@ -13704,29 +13704,29 @@ __metadata:
     type-fest: "npm:4.41.0"
   peerDependencies:
     lavamoat-core: ">15.4.0"
-  checksum: 10/4435814fae3934ca41d8a8ef7962b86a556cb3a2000d50d200d5afdabf43984231ceabf0dc5aa74e8890967f42d5ac01e7c8e78c69804b224ad7ead56a9b4abb
+  checksum: 10/ed96ddf284af0051179a4f46bc6432fb32d05f5055ae94fe3f469a7d7f17c62e834854bf2ed26fb55ff012a02789b8b0bee3cb760aab24d04d8714dba3d43b3f
   languageName: node
   linkType: hard
 
-"lavamoat@npm:^10.0.1":
-  version: 10.0.1
-  resolution: "lavamoat@npm:10.0.1"
+"lavamoat@npm:^10.0.2":
+  version: 10.0.2
+  resolution: "lavamoat@npm:10.0.2"
   dependencies:
     "@babel/code-frame": "npm:7.27.1"
     "@babel/highlight": "npm:7.25.9"
     "@lavamoat/aa": "npm:^4.3.4"
     bindings: "npm:1.5.0"
     corepack: "npm:0.33.0"
     htmlescape: "npm:1.1.1"
-    lavamoat-core: "npm:^17.0.1"
-    lavamoat-tofu: "npm:^8.0.11"
+    lavamoat-core: "npm:^17.1.0"
+    lavamoat-tofu: "npm:^8.1.0"
     node-gyp-build: "npm:4.8.4"
     resolve: "npm:1.22.10"
     yargs: "npm:17.7.2"
   bin:
     lavamoat: src/cli.js
     lavamoat-run-command: src/run-command.js
-  checksum: 10/d9061d06c5a7938a020e8b5aa551093f60641d776b2cd61d5d55a9180c1a8164bf9d2bead11b5692c9c3536b70b953b10523049c8490ac18b1e0e2101fc68183
+  checksum: 10/e00fb5e9d9eb9537afc8af631dd5903a4f2e9a96314d627afc6dc6c2a17d956e7aa4a1a07b13cb461beccc50d780708de34cba2becb590ff15c89d2a72a36e9d
   languageName: node
   linkType: hard