[Tarulatapriya]

Closes #1790

Summary of Changes

Establishes a recurring dependency review cadence and automated vulnerability triage workflow for Snyk and Dependabot:

1. Recurring Snyk CI Schedule (.github/workflows/snyk.yml):

   • Added weekly scheduled scan (cron: '0 6 * * 1') matching Dependabot's weekly Monday cycle.
   • Added workflow_dispatch for manual on-demand scans.
   • Added automated issue alerting via actions/github-script@v9: when high/critical vulnerabilities are detected on main, CI automatically opens or updates a tracking issue labeled security and dependencies.

2. Documented Process (docs/DEPENDENCY_REVIEW.md):

   • Defined response SLAs: Critical CVEs triaged within 48h (7-day resolution); High CVEs triaged within 5 days (14-day resolution).
   • Documented procedures for checking Dependabot PR overlap to avoid redundant manual work.
   • Documented local reproduction via npm run security while enforcing the bun.lock lockfile policy.
   • Defined criteria and guidelines for documented .snyk policy exceptions with required expiration dates.

3. Policy Updates (SECURITY.md & .snyk):

   • Added dependency management section and cross-references in SECURITY.md and .snyk.

Validation

• bun run build / next build passes cleanly.
• bun run lint passes with 0 errors.

[netlify]

👷 Deploy request for reframe-os pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	a2f8240

[github-actions]

👋 Thanks for your PR, @Tarulatapriya!

Welcome to Reframe — a browser-based video editor built for everyone 🎬

🟠 GSSoC'26 PR detected — thanks for contributing under GirlScript Summer of Code 2026!

What happens next

1. 🤖 Automated checks — build & TypeScript typecheck will run automatically
2. ✅ Vercel preview — a preview deployment will be created (requires maintainer authorization for fork PRs)
3. 👀 Code review — a maintainer will review your changes
4. 🚀 Merge — once approved, your PR will be merged!

Quick checklist

• PR title follows Conventional Commits (e.g. feat: add dark mode)
• Linked the issue this PR closes (e.g. Closes #123)
• Tested the changes locally (bun run dev)
• Build passes (bun run build)

Useful links

• 📖 CONTRIBUTING.md
• 🐛 Open Issues
• ⭐ Star the repo to support the project!

Happy coding! 🎉

[github-actions]

✅ PR Format Check Passed — @Tarulatapriya

Basic format checks passed. A maintainer will review your code changes.

This does not mean the PR is approved — it just means the format is correct.