Dragan Spiridonov 6dcb919aee feat(deps): dependency-security system + fix grpc-js HIGH (ADR-115) ...

Closes the gap that let @grpc/grpc-js@1.14.3 (CVE-2026-48068/48069, HIGH)
sit undetected: every existing dependency check only fires on dep-file
changes, so a CVE disclosed against a frozen pin was invisible.

Adds:
- scripts/dependency-audit.mjs    in-repo + consumer-POV audit, severity gate
- scripts/dependency-update.mjs   security-first in-range updater with a guard
                                  that refuses to drop optional @ruvector
                                  platform deps (the Dependabot lockfile bug)
- dependency-audit.yml            daily consumer-POV scan -> tracking issue
- dependency-update.yml           weekly in-range security PR (gh CLI)
- docs/guides/dependency-security-policy.md + ADR-115
- tests/unit/scripts/dependency-security.test.ts (11 hermetic tests)
- npm scripts: deps:audit[:consumer], deps:update[:all]

Also bumps @grpc/grpc-js 1.14.3 -> 1.14.4 in-range (HIGH 1 -> 0); optional
platform deps preserved (90 -> 90).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-30 12:18:21 +00:00

..

actions

feat: CI/CD best-in-class Phase 1+2 with crypto-secure randomness

2026-02-26 18:38:00 +00:00

ISSUE_TEMPLATE

feat: Complete Agentic QE Fleet v2.1 implementation (closes #101)

2025-12-02 15:02:30 +00:00

workflows

feat(deps): dependency-security system + fix grpc-js HIGH (ADR-115)

2026-06-30 12:18:21 +00:00

FUNDING.yml

chore: add FUNDING.yml for GitHub sponsor badge

2025-12-04 15:19:09 +00:00

PULL_REQUEST_TEMPLATE.md

fix(init): release-gate corpus + --json contract (#401)

2026-04-07 16:44:27 +00:00