Demonstrate Bomly Guard dependency protection

[bomly-guy]

Summary

• demonstrates Bomly Guard on a multi-module pnpm workspace
• demo-base is the guarded baseline with fail-on: any
• this branch adds one vulnerable dependency per child workspace module:
  • apps/web/package.json: node-fetch 2.6.6 (GHSA-r683-j2x4-v87g)
  • packages/lib/package.json: marked 0.3.19 (multiple ReDoS advisories)

Validation

• base branch contains .github/workflows/bomly-guard.yml
• base branch uses fail-on: any
• PR diff includes child-module manifest changes plus the regenerated root pnpm-lock.yaml
• exercises file-location capture for multi-module setups (PR annotations, comments, code scanning alerts)

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Bomly Diff Summary

Compared 469c300e52b89694d98328f53cdec7d8a1148896 to b59c3015602f7fc7566a689d155d0e6ffb1250ce.

Overview

Status	Manifests	Dependencies	Findings	Duration
❌ Failing findings	+0 / ~2 / -0	+6 / ~0 / -0	4 introduced / 0 persisted / 0 resolved	49.7s

Dependency Changes

Summary: 5 added, 0 changed, 0 removed.

Added Dependencies

Change	Package	Version	Direct?	Scope	Licenses
added	marked@0.3.19	0.3.19	Yes	runtime	MIT
added	node-fetch@2.6.6	2.6.6	Yes	runtime	MIT
added	tr46@0.0.3	0.0.3	No	runtime	MIT
added	webidl-conversions@3.0.1	3.0.1	No	runtime	BSD-2-Clause
added	whatwg-url@5.0.0	5.0.0	No	runtime	MIT

Vulnerabilities

Summary: 4 introduced, 0 persisted, 0 resolved.

Introduced Vulnerabilities

Change	Severity	ID	Package	Fixed In	Source	Title
introduced	HIGH	GHSA-5v2h-r2cx-5xgj	marked@0.3.19	4.0.10	grype	Inefficient Regular Expression Complexity in marked
introduced	HIGH	GHSA-r683-j2x4-v87g	node-fetch@2.6.6	2.6.7	grype	node-fetch forwards secure headers to untrusted sites
introduced	HIGH	GHSA-rrrm-qjm4-v8hf	marked@0.3.19	4.0.10	grype	Inefficient Regular Expression Complexity in marked
introduced	MEDIUM	GHSA-xf5p-87ch-gxw2	marked@0.3.19	0.6.2	grype	Marked ReDoS due to email addresses being evaluated in quadratic time

License Changes

Summary: 5 added, 0 changed, 0 removed.

Added Licenses

Change	Package	Licenses
added	marked@0.3.19	MIT
added	node-fetch@2.6.6	MIT
added	tr46@0.0.3	MIT
added	webidl-conversions@3.0.1	BSD-2-Clause
added	whatwg-url@5.0.0	MIT

Project Posture

ℹ️ Scorecard ran, but no project posture data was found for these dependencies (e.g. no source repository is known).

Policy Findings

Summary: 4 introduced, 0 persisted, 0 resolved.

Introduced Findings

	Status	Category	Severity	ID	Package	Fixed In	Title
❌	introduced	vulnerability	HIGH	GHSA-5v2h-r2cx-5xgj	marked@0.3.19	4.0.10	Inefficient Regular Expression Complexity in marked
❌	introduced	vulnerability	HIGH	GHSA-r683-j2x4-v87g	node-fetch@2.6.6	2.6.7	node-fetch forwards secure headers to untrusted sites
❌	introduced	vulnerability	HIGH	GHSA-rrrm-qjm4-v8hf	marked@0.3.19	4.0.10	Inefficient Regular Expression Complexity in marked
❌	introduced	vulnerability	MEDIUM	GHSA-xf5p-87ch-gxw2	marked@0.3.19	0.6.2	Marked ReDoS due to email addresses being evaluated in quadratic time

Legend: ✅ resolved · ❌ failing · ⚠️ warning