[onyinyechinwokwu-success]

Summary

One PR for the four open supply-chain issues assigned in this repo.

• chore: 25 open Dependabot alerts (10 high) and no security-update PRs since September — upgrade now and fix the update pipeline #918, dependency upgrades. next moves to ^16.3.8 (resolves to 16.4.2). axios is pinned to ^1.20.0 through overrides, along with other vulnerable transitives. vite and vitest are bumped for their advisories. The stale package-lock.json is removed and npm/yarn/pnpm lockfiles are gitignored. Dependabot is already on the bun ecosystem.
• ci: add dependency review and a fail-closed bun audit gate; block non-registry sources in bun.lock #917, CI gates. A dependency-review workflow fails PRs that add high-severity or malware advisories. A supply-chain CI job runs scripts/lockfile-lint.mjs, which asserts every bun.lock entry comes from the npm registry with a sha512 integrity hash. scripts/audit-gate.mjs runs bun audit --json and fails closed on tool errors, unexpected exit codes and unparseable output. Its exceptions live in scripts/audit-allowlist.json, each with a reason and an expiry date.
• security: add a bunfig.toml install policy — release-age cooldown, explicit trusted-dependency policy, bun-only installs #919, install policy. bunfig.toml sets [install] minimumReleaseAge = 259200 (3 days). A preinstall guard (scripts/require-bun.mjs) refuses npm, yarn and pnpm installs. trustedDependencies stays absent. CONTRIBUTING.md documents the policy.
• tooling: enable OpenSSF Scorecard and a PR-time package-risk scanner (Socket or equivalent) on the frontend #922, partial. Adds the OpenSSF Scorecard workflow, with actions pinned to commit SHAs. The Socket package-risk scanner is not included. It needs a Socket GitHub App install or an API token secret, which is a maintainer action. tooling: enable OpenSSF Scorecard and a PR-time package-risk scanner (Socket or equivalent) on the frontend #922 stays open for that part.

Linked issues

Closes #917
Closes #918
Closes #919
Refs #922 (Socket scanner still open, see above)

Audit numbers

bun audit before this PR: 55 findings (21 high, 31 moderate, 3 low). After: 6 findings (1 high, 4 moderate, 1 low).

Remaining findings:

• braces (high, GHSA-vfj7-8cjw-p6xm). No patched release exists. It is dev-only, reached through eslint-config-next. It is allowlisted until 2026-12-31.
• uuid and stream-json (moderate). Transitive through jayson. No fix in the current major.
• elliptic (low). No fix available.

The Dependabot alert count (25 open at the time of the issue) needs re-checking on the alerts page after merge.

Decisions to review

• next resolves to 16.4.2, not 16.3.8. ^16.3.8 allows later minor versions, and bun picked the newest. 16.4.2 was published 2026-10-15, and build and tests pass on it. If you want exactly 16.3.8, pin it.
• Release-age cooldown of 3 days. minimumReleaseAgeExcludes is empty. Add a package there only with maintainer sign-off.
• Dependency review needs the dependency graph enabled for the repo. deny-licenses is not set, since no license list was agreed.
• Required checks. Maintainers should add supply-chain and the dependency review check to main's required status checks.
• Action pinning. Only the new workflows pin actions to SHAs. Existing workflows still use tags, so Scorecard's Pinned-Dependencies check will keep flagging them. That is a follow-up.

Test evidence

Run locally with bun 1.3.14 and Node 24, after bun install --frozen-lockfile:

• typecheck: pass
• lint: 0 errors, 2 pre-existing warnings
• format:check: pass
• test:coverage: 133 files, 1496 tests passed, 3 expected fails
• build and bundle:check: pass, all routes within budget
• New unit tests (scripts/*.test.mjs, 30 tests): lockfile lint, audit gate and the bun-only guard. These run under bun run test.
• node scripts/lockfile-lint.mjs: 1213 packages OK
• node scripts/audit-gate.mjs: no unexcepted high or critical advisories
• npm run preinstall (npm user agent): refused with a message pointing to CONTRIBUTING. bun run preinstall: passes.
• bun install: passes through the guard.
• Rebased onto upstream/main (includes ci: supply-chain guardrails for hidden payloads and build scripts (#914, #915, #921, #920) #924). check-hidden-content.mjs: 394 files, no findings.
• bunfig.toml: a 10-year release-age window blocks a fresh add. The default 3-day window installs. minimumReleaseAgeExcludes lets a named package through the same window.

Not verified here:

• The Playwright e2e job (continue-on-error in CI).
• The dependency-review and Scorecard workflows. These only run on GitHub.

Checklist

• Tied to accepted issues (Closes #…)
• bun run build passes locally
• bun run lint, bun run format:check and bun run test pass locally
• No UI change
• Changelog updated under Security
• Docs updated: CONTRIBUTING.md install policy
• No secrets committed

Supply-chain changes

This PR changes package.json scripts and dependencies, bun.lock, workflows, scripts/ and bunfig.toml. Each change is there for the issue it cites:

• package.json: next, vite, vitest. Version bumps for published advisories (chore: 25 open Dependabot alerts (10 high) and no security-update PRs since September — upgrade now and fix the update pipeline #918). next resolves to 16.4.2, published 2026-10-15.
• package.json: overrides. Pins vulnerable transitive packages to patched versions (chore: 25 open Dependabot alerts (10 high) and no security-update PRs since September — upgrade now and fix the update pipeline #918). Each one is listed in the first commit message.
• package.json: preinstall. The bun-only guard (security: add a bunfig.toml install policy — release-age cooldown, explicit trusted-dependency policy, bun-only installs #919). It blocks npm, yarn and pnpm installs, which would read the wrong lockfile and run install scripts.
• bun.lock. The resolved tree for the changes above. scripts/lockfile-lint.mjs checks it: 1213 packages, all from the npm registry with sha512 hashes.
• bunfig.toml. A 3-day release-age cooldown (security: add a bunfig.toml install policy — release-age cooldown, explicit trusted-dependency policy, bun-only installs #919).
• .github/workflows/dependency-review.yml, scripts/audit-gate.mjs, scripts/audit-allowlist.json, ci.yml (supply-chain job). The CI gates (ci: add dependency review and a fail-closed bun audit gate; block non-registry sources in bun.lock #917). The audit gate runs bun audit through a pinned bun 1.3.14, because CI's bun 1.2.4 has no audit command.
• .github/workflows/scorecard.yml. OpenSSF Scorecard (tooling: enable OpenSSF Scorecard and a PR-time package-risk scanner (Socket or equivalent) on the frontend #922). Actions are pinned to commit SHAs.
• vitest.config.mts. Adds scripts/**/*.test.mjs to the test include, so the new script tests run.
• .gitignore, .prettierignore, CONTRIBUTING.md. Lockfile ignores and the install policy (chore: 25 open Dependabot alerts (10 high) and no security-update PRs since September — upgrade now and fix the update pipeline #918, security: add a bunfig.toml install policy — release-age cooldown, explicit trusted-dependency policy, bun-only installs #919).

Allowlisted advisory: braces (GHSA-vfj7-8cjw-p6xm), dev-only, no patched release. The allowlist entry expires 2026-12-31.

Note for the reviewer: supply-chain-reviewed must be applied before this PR can merge (see the supply-chain review gate job).

[vercel]

@onyinyechinwokwu-success is attempting to deploy a commit to the David Dada's projects Team on Vercel.

A member of the Team first needs to authorize it.

[dadadave80]

Thanks for this. I reviewed the supply-chain changes for the supply-chain-reviewed label. I found nothing that runs unexpected code, and the gates do what they say. A few things are worth tightening.

Checked

• Lockfile: every bun.lock change is a registry version bump with an integrity hash, and lockfile-lint confirms all 1,213 packages. No new packages enter the tree beyond re-nested @vitest/* and caniuse-lite copies. The axios copies at 1.16.0 and 1.18.0 now resolve to 1.20.0, which clears the 7 high advisories. next resolves to 16.4.2, a minor bump rather than only the 16.3.8 patch, and build and e2e pass.
• New script: the only new package.json script is preinstall. scripts/require-bun.mjs only checks npm_config_user_agent.
• audit-gate.mjs fails closed: a tool error, an unexpected exit code, unparseable JSON, exit 1 with no findings, and an expired allowlist entry all fail the gate. On this PR only braces is allowlisted (dev-only, no fix published yet, expires 2026-12-31).
• Workflows: Scorecard is pinned to commit SHAs and its permissions are scoped to the job. dependency-review is read-only.

Please address (follow-ups are fine)

1. Deleting package-lock.json blinds GitHub's dependency graph. The graph and the dependency compare API only read package-lock.json, not bun.lock: the compare for this PR lists 1,018 entries, all from the file being deleted. After merge, dependency review has nothing to compare and Dependabot alerts lose their data source. The bun audit gate becomes the real check. Tracked in #928 (submit a bun.lock dependency snapshot).
2. Overrides without an upper bound. ws, postcss, browserslist, follow-redirects, smol-toml, source-map-js and launch-editor use >=, so the next lock regeneration could jump to a new major version. Please use ^ like axios and nanoid.
3. Overrides that look unnecessary. launch-editor doesn't appear in the resolved lock, and baseline-browser-mapping isn't tied to any advisory. Please drop both, or say why they're needed.

Notes

• The ws override moves @walletconnect/jsonrpc-ws-connection and jayson from ws 7 to 8, which is a major version change. In the browser they use the native WebSocket, so the risk is low.
• minimumReleaseAge only takes effect when the lock is re-resolved. CI installs with --frozen-lockfile on bun 1.2.4, so in practice it protects local bun add and bun update, not CI.

[github-actions]

Thanks for the PR! A maintainer will take a look shortly. ✨

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
heliobond	Ready	Preview	Oct 22, 2026 3:13pm UTC