Clear the dependency advisories and gate them in CI

The full-workspace audit returned 88 advisory records across 78 unique
advisories. The lockfile now resolves clean at every severity.

Runtime: ws to 8.21.3, protobufjs, React Router to 7.18.2, find-my-way,
ip-address, and fast-uri move to patched floors. tar is dropped outright —
nothing has imported it since the hosted ripgrep bootstrap was removed.

Browser: Mermaid to 11.17.0 and DOMPurify to a patched release. Monaco has no
release carrying the fix, so patches/monaco-editor@0.55.1.patch pins its
bundled DOMPurify. That patch has to reach the Nix build too, so flake.nix
adds ./patches to the fileset alongside the refreshed pnpmDeps hash — without
it the Nix build installs an unpatched Monaco while every other build path
gets the patched one.

Tooling: Vite to 6.4.3, plus esbuild, PostCSS, nanoid, brace-expansion,
js-yaml, linkify-it, qs, and body-parser.

Fixing the versions once is not the same as keeping them fixed, so this also
adds the guards: dependabot for the update stream, CodeQL for source analysis,
and security.yml, which packs the CLI tarball and the VSIX and audits what
those artifacts actually ship — a clean lockfile says nothing about what ends
up inside a published package. check-artifacts.mjs asserts the Monaco patch
survived install rather than trusting that it did.
docs/security/dependency-remediation-2026-08.md records the evidence and the
ownership split behind each floor.

Author: elkaix

.github/dependabot.yml

@@ -4,30 +4,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    # Scheduled version-update PRs are disabled on purpose: this workspace's
-    # engines.node (>=24.15.0 <25) exceeds the Node.js version Dependabot's own
-    # updater sandbox ships, so ANY `pnpm install`/update it attempts hard-fails
-    # with ERR_PNPM_UNSUPPORTED_ENGINE (root .npmrc sets engine-strict=true).
-    # See dependabot/dependabot-core#7426, #4072, #12976 — there is no
-    # dependabot.yml-level fix; the real fix is lowering engines.node or
-    # disabling engine-strict in .npmrc, both out of scope here. This entry
-    # exists only so the `ignore` rules below apply to security-update PRs,
-    # which open-pull-requests-limit: 0 does not suppress.
+    # Scheduled version updates remain disabled because Dependabot's updater
+    # does not satisfy this workspace's strict Node 24.15 engine requirement.
+    # Security updates remain enabled and no dependency is ignored.
     open-pull-requests-limit: 0
-    ignore:
-      # Both advisories are on vite/esbuild resolved transitively through
-      # docs/package.json's vitepress@1.6.4 (vite@5.4.21 in pnpm-lock.yaml),
-      # a dev-only docs-site dependency. vitepress@1.6.4 pins `vite: 5.4.21`
-      # as a hard (non-peer) dependency, so pnpm cannot resolve a fix without
-      # vitepress 2 (alpha only as of 2026-08) — every attempt reopens the
-      # same failing PR. Unscoped by version on purpose: Dependabot's actual
-      # target version for this resolution is unverifiable (no open
-      # Dependabot PRs exist in this repo to read a target off of, and the
-      # target is not necessarily the advisory's first-patched version), so a
-      # version-scoped rule can silently fail to match and let the PR back
-      # in. Cost: this also suppresses vite/esbuild security-update PRs for
-      # apps/*, which today sit at patched vite@6.4.3+ directly — revisit if
-      # that changes. Drop both rules once docs/package.json moves to
-      # vitepress 2 stable.
-      - dependency-name: "vite"
-      - dependency-name: "esbuild"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '43 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          build-mode: none
+          languages: javascript-typescript
+          queries: security-extended
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          category: /language:javascript-typescript

.github/workflows/security.yml

@@ -0,0 +1,65 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Security audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+      - run: pnpm audit --json
+
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-scopes: runtime, development, unknown
+          fail-on-severity: low
+          vulnerability-check: true
+
+  artifact-security:
+    name: Artifact security
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm -C apps/desktop run package
+      - run: pnpm -C docs run build
+      - run: mkdir -p .tmp/security-artifacts/cli .tmp/security-artifacts/vsix
+      - run: pnpm --filter @pymodel/pythinker-code pack --pack-destination "${{ github.workspace }}/.tmp/security-artifacts/cli"
+      - run: pnpm --filter pythinker run package:platform -- --target linux-x64 --out-dir "${{ github.workspace }}/.tmp/security-artifacts/vsix"
+      - run: pnpm -C apps/pythinker-code run smoke
+      - run: pnpm run check:security-artifacts

SECURITY.md

@@ -26,7 +26,17 @@ Alternative channel:
 
 ## Our Response
 
-We will acknowledge your report and provide an initial assessment as soon as we can.
+We triage Critical and High reports within 24 hours. We target a fix within 72 hours for
+Critical and High issues, 7 days for Medium issues, and 30 days for Low issues.
+
+## Dependency Vulnerability Policy
+
+Pull requests cannot add a vulnerability at any severity. The repository uses a full-workspace
+audit because build and package steps can ship workspace code declared as a development
+dependency. A production-only audit is informational and is not a security gate.
+
+If a vulnerability is disclosed after clean code reaches `main`, the response times above apply.
+Dismissed or auto-dismissed alert state does not make a vulnerable dependency acceptable.
 
 ## Public Disclosure
 

apps/desktop/scripts/stage-runtime.ts

@@ -112,6 +112,7 @@ async function deploy(target: string): Promise<void> {
     await run('pnpm', [
       '--config.verify-deps-before-run=false', '--filter', deployPackage, 'deploy', '--legacy', '--prod',
       '--config.node-linker=hoisted', '--config.auto-install-peers=false', '--config.link-workspace-packages=true',
+      '--config.allow-unused-patches=true',
       deployTargetArgument(repositoryRoot, target),
     ])
   } finally {

apps/pythinker-code/dist-web/.web-bundle-manifest.json

@@ -1,4 +1,4 @@
 {
-  "sourceHash": "5fa1f4113f68cc5a0de3b4985ae517b47ca98f832e89e97cf636845fd3a2cd67",
+  "sourceHash": "6c3eea494011bc65aa88d7fd6e889fd882255b4d60e720cc332566f9b5b58da0",
   "sourceFileCount": 388
 }