Add automated dependency vulnerability scanning to CI - #792
Merged
portableDD merged 1 commit intoAug 31, 2026
Merged
Conversation
- CI now runs `npm audit --audit-level=high` on every push/PR to main and v2, failing the build on new high/critical advisories. - .github/dependabot.yml adds weekly automated update PRs for npm and GitHub Actions dependencies, with minor/patch bumps grouped into one PR per week; Dependabot opens security PRs immediately and independent of that schedule. - SECURITY.md documents the triage process for a flagged vulnerability, and notes the current known high-severity findings (transitively inherited through next) as follow-up work rather than silently failing CI with no context.
|
@OAKVISUALZ is attempting to deploy a commit to the Emmanuel Dorcas' projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@OAKVISUALZ Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
3 tasks
portableDD
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/ci.yml: adds annpm audit --audit-level=highstep, running on every push/PR tomainandv2, so the build fails on newly-flagged high/critical vulnerabilities instead of relying on someone remembering to runnpm auditlocally..github/dependabot.yml: adds weekly automated dependency-update PRs for npm packages and GitHub Actions, grouping routine minor/patch bumps into one PR per week (security-advisory PRs from Dependabot are opened immediately, independent of that schedule/grouping).SECURITY.md: documents the step-by-step triage process for a flagged vulnerability (identify → check reachability → prefer the smallest fix → escalate if unfixed → never silence the gate without sign-off), plus notes the current known findings so the new CI gate doesn't fail with no context attached.Note on CI
This PR targets
v2per the maintainer's guidance on #791.v2'sLint, Type-check & Buildworkflow currently fails independent of this PR (pre-existing lint/type errors unrelated to dependencies, and this new audit step will itself fail immediately becausev2already has 9 pre-existing high-severity advisories inherited transitively throughnext/postcss/sharp/picomatch). That's intentional and matches the issue's ask ("fails ... on high/critical vulnerabilities") — the gate now surfaces what was previously invisible.SECURITY.mddocuments this as known follow-up work (anextmajor-version bump) rather than something silently ignored. I did not attempt that bump here since it's a breaking change deserving its own reviewed PR.Test plan
.github/dependabot.ymland updated.github/workflows/ci.ymlvalidated as well-formed YAMLnpx prettier --checkclean on all three changed filesCloses #756