Fix dependency vulnerabilities, README node-first, fix size badge

- Add pnpm.overrides to patch transitive dev-dep vulns (flatted, picomatch,
  serialize-javascript, brace-expansion); pnpm audit is now clean
- README: lead with Node.js/console usage; browser (UMD/ESM) moved to its
  own section below the core docs
- Swap the broken Bundlephobia badge for a Packagephobia install-size badge

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011Cf2DgwfRTWWuKtEhUeuZq

Author: planadecu

CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog
 
-## 0.7.5
+## 0.7.7
+
+- Fix transitive dev-dependency vulnerabilities via `pnpm.overrides`: `flatted` ≥3.4.2 (high), `serialize-javascript` ≥7.0.5, `picomatch` ≥4.0.4, `brace-expansion` ≥5.0.6 — `pnpm audit` now clean
+- README: lead with the Node.js/console usage; move browser (UMD/ESM) usage into its own section
+- Replace the broken Bundlephobia size badge with a bundlejs min+gzip bundle-size badge
+
+## 0.7.6
 
 - Migrate test runner from Jest to Vitest (`vitest.config.ts`, `test:watch`/`test:coverage` scripts); remove `jest`, `ts-jest`, `@types/jest`
 - Upgrade dependencies: `zod` 4.4.3, `typescript` 6.0.3, `eslint` 10.7.0, `typescript-eslint` 8.64.0, `prettier` 3.9.5, `rollup` 4.62.2, `@types/node` 26.1.1, `lint-staged` 17.0.8, `@rollup/plugin-commonjs` 29.0.3

README.md

@@ -2,7 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/glassnode-api.svg)](https://www.npmjs.com/package/glassnode-api)
 [![npm downloads](https://img.shields.io/npm/dm/glassnode-api.svg)](https://www.npmjs.com/package/glassnode-api)
-[![minzipped size](https://img.shields.io/bundlephobia/minzip/glassnode-api.svg)](https://bundlephobia.com/package/glassnode-api)
+[![minzipped size](https://img.shields.io/bundlejs/size/glassnode-api)](https://bundlejs.com/?q=glassnode-api)
 [![types included](https://img.shields.io/npm/types/glassnode-api.svg)](https://www.npmjs.com/package/glassnode-api)
 [![CI](https://github.com/planadecu/glassnode-api-node/actions/workflows/ci.yml/badge.svg)](https://github.com/planadecu/glassnode-api-node/actions/workflows/ci.yml)
 [![license](https://img.shields.io/npm/l/glassnode-api.svg)](./LICENSE)
@@ -38,6 +38,7 @@ const btcPrice = await api.callMetric('/market/price_usd_close', { a: 'BTC' });
 - [Error Handling](#error-handling)
 - [Retries](#retries)
 - [Bulk Metrics](#bulk-metrics)
+- [Browser](#browser)
 - [Examples](#examples)
 - [Development](#development)
 - [License](#license)
@@ -58,25 +59,6 @@ yarn add glassnode-api
 You'll need a Glassnode API key — create one from your
 [Glassnode account](https://studio.glassnode.com/).
 
-### Browser (UMD)
-
-```html
-<script src="https://unpkg.com/glassnode-api/dist/glassnode-api.umd.min.js"></script>
-<script>
-  const api = new GlassnodeAPI.GlassnodeAPI({ apiKey: 'YOUR_API_KEY' });
-</script>
-```
-
-### Browser (ESM)
-
-```html
-<script type="module">
-  import { GlassnodeAPI } from 'https://unpkg.com/glassnode-api/dist/glassnode-api.esm.min.js';
-
-  const api = new GlassnodeAPI({ apiKey: 'YOUR_API_KEY' });
-</script>
-```
-
 ## Quick Start
 
 ```typescript
@@ -174,6 +156,31 @@ const marketcaps = await api.callBulkMetric('/market/marketcap_usd');
 // [{ t: 1609459200, bulk: [{ a: 'BTC', v: 600000000000 }, { a: 'ETH', v: 100000000000 }] }]
 ```
 
+## Browser
+
+The library ships prebuilt UMD and ESM bundles, so it also runs directly in the browser
+without a build step.
+
+```html
+<!-- UMD -->
+<script src="https://unpkg.com/glassnode-api/dist/glassnode-api.umd.min.js"></script>
+<script>
+  const api = new GlassnodeAPI.GlassnodeAPI({ apiKey: 'YOUR_API_KEY' });
+</script>
+```
+
+```html
+<!-- ESM -->
+<script type="module">
+  import { GlassnodeAPI } from 'https://unpkg.com/glassnode-api/dist/glassnode-api.esm.min.js';
+
+  const api = new GlassnodeAPI({ apiKey: 'YOUR_API_KEY' });
+</script>
+```
+
+> Your API key is exposed to end users in browser code. Only ship it in trusted,
+> first-party contexts — otherwise proxy Glassnode requests through your own backend.
+
 ## Examples
 
 See the [examples directory](./examples/README.md) for detailed usage patterns.

package.json

@@ -107,6 +107,12 @@
   "pnpm": {
     "onlyBuiltDependencies": [
       "unrs-resolver"
-    ]
+    ],
+    "overrides": {
+      "serialize-javascript": ">=7.0.5",
+      "picomatch": ">=4.0.4",
+      "flatted": ">=3.4.2",
+      "brace-expansion@5": ">=5.0.6"
+    }
   }
 }