fix: harden dashboard authorization

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    target-branch: master
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - security

.github/workflows/ci.yml

@@ -19,10 +19,10 @@ jobs:
         with:
           version: 8.6.1
 
-      - name: Setup Node 18
-        uses: actions/setup-node@v3
+      - name: Setup Node 24
+        uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 24
 
       - name: Get pnpm store directory
         id: pnpm-cache
@@ -38,7 +38,7 @@ jobs:
             ${{ runner.os }}-pnpm-store-
 
       - name: Install deps (with cache)
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Generate Prisma client
         run: npx prisma generate

SECURITY.md

@@ -0,0 +1,15 @@
+# Security policy
+
+## Supported version
+
+Security fixes target the current `master` branch.
+
+## Report a vulnerability
+
+Do not open a public issue for a security vulnerability. Contact the maintainer
+through the GitHub profile and include the affected route, the expected result,
+and clear reproduction steps. Do not include real access tokens or private
+repository data.
+
+The application uses a GitHub OAuth token with `repo` scope. The token must stay
+on the server. Client code and API responses must not return it to the browser.

package.json

@@ -5,7 +5,7 @@
   "scripts": {
     "dev": "prisma generate && next dev",
     "preinstall": "npx only-allow pnpm",
-    "build": "prisma generate && prisma db push && next build",
+    "build": "prisma generate && next build",
     "start": "next start",
     "lint": "eslint .",
     "preview": "next build && next start",
@@ -14,44 +14,48 @@
     "format:check": "prettier --check \"**/*.{ts,tsx,mdx}\" --cache"
   },
   "dependencies": {
-    "@emotion/react": "^11.10.0",
-    "@emotion/server": "^11.10.0",
+    "@emotion/react": "^11.14.0",
+    "@emotion/server": "^11.11.0",
     "@hello-pangea/dnd": "^15.0.0",
-    "@mantine/core": "^5.5.2",
-    "@mantine/hooks": "^5.5.2",
-    "@mantine/next": "^5.5.2",
-    "@mantine/notifications": "^5.5.2",
-    "@next-auth/prisma-adapter": "^1.0.4",
-    "@octokit/core": "^4.0.5",
-    "@octokit/types": "^7.1.1",
-    "@prisma/client": "^4.2.1",
-    "@tabler/icons": "^1.78.1",
-    "@trpc/client": "^9.27.2",
-    "@trpc/next": "^9.27.2",
-    "@trpc/react": "^9.27.2",
-    "@trpc/server": "^9.27.2",
-    "next": "12.2.3",
-    "next-auth": "^4.10.3",
+    "@mantine/core": "^5.10.5",
+    "@mantine/hooks": "^5.10.5",
+    "@mantine/next": "^5.10.5",
+    "@mantine/notifications": "^5.10.5",
+    "@next-auth/prisma-adapter": "^1.0.7",
+    "@octokit/core": "^4.2.4",
+    "@octokit/types": "^7.5.1",
+    "@prisma/client": "^4.16.2",
+    "@tabler/icons": "^1.119.0",
+    "@trpc/client": "^9.27.4",
+    "@trpc/next": "^9.27.4",
+    "@trpc/react": "^9.27.4",
+    "@trpc/server": "^9.27.4",
+    "next": "12.3.7",
+    "next-auth": "4.24.15",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-query": "^3.39.2",
-    "superjson": "^1.9.1",
-    "zod": "^3.18.0",
-    "zustand": "^4.0.0"
+    "react-query": "^3.39.3",
+    "superjson": "^1.13.3",
+    "zod": "^3.25.76",
+    "zustand": "^4.5.7"
   },
   "devDependencies": {
     "@types/node": "18.6.3",
     "@types/react": "18.0.15",
     "@types/react-dom": "18.0.6",
-    "@typescript-eslint/eslint-plugin": "^5.33.1",
-    "@typescript-eslint/parser": "^5.33.1",
-    "eslint": "^8.21.0",
-    "eslint-config-next": "12.2.3",
-    "eslint-config-prettier": "^8.5.0",
-    "eslint-plugin-sort-destructure-keys": "^1.4.0",
-    "eslint-plugin-typescript-sort-keys": "^2.1.0",
+    "@typescript-eslint/eslint-plugin": "^5.62.0",
+    "@typescript-eslint/parser": "^5.62.0",
+    "eslint": "^8.57.1",
+    "eslint-config-next": "12.3.7",
+    "eslint-config-prettier": "^8.10.2",
+    "eslint-plugin-sort-destructure-keys": "^1.6.0",
+    "eslint-plugin-typescript-sort-keys": "^2.3.0",
     "prettier": "2.7.1",
-    "prisma": "^4.2.1",
-    "typescript": "^4.7.4"
-  }
+    "prisma": "^4.16.2",
+    "typescript": "^4.9.5"
+  },
+  "engines": {
+    "node": "24.x"
+  },
+  "packageManager": "pnpm@8.6.1"
 }