Dependency Security

This repository has no Dependabot version-update configuration, so GitHub does not open dependency pull requests on a schedule. Dependency bumps are made deliberately, on a tracked issue, with bun run bump-deps.

Advisories against the tree you already have installed are a separate concern from version bumps, and they are covered by bun audit, which resolves every installed package against the npm advisory database:

bun run audit            # the gate: fails closed on any untrusted audit result
bun run audit:report     # the full detail, every severity

The same check runs in CI from .github/workflows/dependency-audit.yml — weekly, on demand, and on any pull request that touches a manifest or the lockfile. It reports and fails; it never opens a pull request, so it cannot flood the board the way scheduled version updates did.

bun run audit fails closed before it applies the count ratchet. A nonzero bun audit status, a missing command, a network failure, or an unrecognized report is an error; none may be interpreted as a clean tree. That matters because treating an npm outage or a changed output format as zero advisories would silently disable the security control.

For a successful, recognized report, tools/dep-audit/baseline.txt records the counts carried when this channel was adopted and the check fails when a severity goes above its baseline. Baseline updates are written atomically and only after a successful parse, so a failed or malformed audit can never replace the file with zeroes:

bun run audit:update-baseline    # only ever to LOWER a count you just fixed

Never raise a baseline number to make a build pass. Lower it in the same commit that removes the advisory, exactly as with the design-lint ratchet. Bun currently exits nonzero while the installed tree has advisories, so that backlog remains an honest blocker before the ratchet comparison; do not suppress that status.

Dependabot alerts and Dependabot security updates would cover the same ground with less effort, but they are repository settings rather than files in this tree and enabling them needs admin on the repository. They are currently off. If you have admin, turning both on is worthwhile — bun audit is the floor, not a reason to skip them.

Dependencies can also be bumped directly:

bun run bump-deps

Not enabled

Neither of these is set up in this repository. They are listed because their absence is the gap, not because they are configured:

• Dependency analysis on pull requests, such as Socket.
• Secret scanning — GitHub Secret Scanning, Gitleaks or Trufflehog.

The rule that no secret value is stored in the database is a design invariant, enforced by the schema holding only secretRef pointers. It is not enforced against a developer pasting a key into a source file, which is what secret scanning would catch.