[GH-ISSUE #416] ci: add dependency review / vulnerability scanning for PRs #92

New issue

Closed

opened 2026-05-06 12:37:10 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-06 12:37:10 +02:00

Owner

Originally created by @Divkix on GitHub (Mar 10, 2026).
Original GitHub issue: https://github.com/cloudflare/vinext/issues/416

Problem

The CI pipeline currently has no dependency vulnerability scanning. There is no pnpm audit, no Dependabot configuration, and no OSV-based scanning. This means vulnerable dependencies can be introduced without any automated detection.

Proposed Solution

CI job: Add a dependencies job to ci.yml that runs pnpm audit --audit-level high. Initially advisory (continue-on-error) to avoid blocking PRs while we assess the baseline.
Dependabot: Create .github/dependabot.yml to automatically open PRs for dependency updates:
- npm ecosystem: weekly schedule, group minor+patch updates
- GitHub Actions: weekly schedule

Acceptance Criteria

pnpm audit runs in CI on every PR
Dependabot config created for npm and GitHub Actions ecosystems
Minor and patch updates grouped to reduce PR noise

Originally created by @Divkix on GitHub (Mar 10, 2026). Original GitHub issue: https://github.com/cloudflare/vinext/issues/416 ## Problem The CI pipeline currently has no dependency vulnerability scanning. There is no `pnpm audit`, no Dependabot configuration, and no OSV-based scanning. This means vulnerable dependencies can be introduced without any automated detection. ## Proposed Solution 1. **CI job**: Add a `dependencies` job to `ci.yml` that runs `pnpm audit --audit-level high`. Initially advisory (continue-on-error) to avoid blocking PRs while we assess the baseline. 2. **Dependabot**: Create `.github/dependabot.yml` to automatically open PRs for dependency updates: - npm ecosystem: weekly schedule, group minor+patch updates - GitHub Actions: weekly schedule ## Acceptance Criteria - [ ] `pnpm audit` runs in CI on every PR - [ ] Dependabot config created for npm and GitHub Actions ecosystems - [ ] Minor and patch updates grouped to reduce PR noise

BreizhHardware closed this issue

2026-05-06 12:37:10 +02:00

BreizhHardware commented

2026-05-06 12:37:11 +02:00

Author

Owner

@Divkix commented on GitHub (Mar 10, 2026):

Closing — premature for an unreleased project. Will revisit when vinext ships to npm.

@Divkix commented on GitHub (Mar 10, 2026): Closing — premature for an unreleased project. Will revisit when vinext ships to npm.

BreizhHardware referenced this issue

2026-05-06 12:39:04 +02:00

[PR #92] [MERGED] fix: sanitize redirect destinations and digest parsing #302