fix(security): clear the dependency advisories and gate them in CI (#153)

## Related Issue

No issue — this came from the Dependabot alerts on `main`. GitHub
currently reports **83 vulnerabilities** there (2 critical, 33 high, 41
moderate, 7 low).

## Problem

A full-workspace audit returned 88 advisory records across 78 unique
advisories. Several land in code that actually runs: the WebSocket
server, the protobuf decoder, the router, and the Markdown/diagram
renderers inside the web UI that the CLI ships prebuilt as `dist-web`.

An unreachable advisory is still a valid finding — reachability changes
urgency and test scope, not whether the dependency is vulnerable.

The second problem is that nothing was watching. Fixing 78 advisories
once and having them drift back is the default outcome without a gate.

## What changed

**Advisory floors.** The lockfile now resolves clean at every severity.

| Area | Moves |
|---|---|
| Runtime | `ws` → 8.21.3, `react-router` → 7.18.2, plus `protobufjs`,
`@protobufjs/utf8`, `find-my-way`, `ip-address`, `fast-uri` |
| Browser | `mermaid` → 11.17.0, `dompurify` → patched, Monaco via patch
(below) |
| Tooling | `vite` → 6.4.3, plus `esbuild`, `postcss`, `nanoid`,
`brace-expansion`, `js-yaml`, `linkify-it`, `qs`, `body-parser` |

`tar` is dropped outright rather than bumped — nothing has imported it
since the hosted ripgrep bootstrap was removed.

**Monaco has no release carrying the fix**, so
`patches/monaco-editor@0.55.1.patch` pins its bundled DOMPurify. A patch
that only applies on some build paths is worse than no patch, so
`flake.nix` adds `./patches` to the fileset — without it the Nix build
would install an unpatched Monaco while every other path got the patched
one — and `scripts/security/check-artifacts.mjs` asserts the patch
survived install rather than trusting that it did.

**`dist-web` is rebuilt** in the same commit. The CLI ships the bundle
prebuilt, so patched `mermaid`/`dompurify`/Monaco only reach users once
the committed bundle is rebuilt against them. The staleness gate
enforces this.

**The guards**, so this does not have to be redone:

- `dependabot.yml` for the update stream.
- `codeql.yml` for source analysis.
- `security.yml`, which packs the CLI tarball and the VSIX and audits
**what those artifacts actually ship**. A clean lockfile says nothing
about what ends up inside a published package — the two can disagree,
and the artifact is what users install.

`docs/security/dependency-remediation-2026-08.md` records the evidence
and the ownership split behind each floor, including the rule that
discovery sources can corroborate a version but never establish a safe
floor on their own.

## Verification

Run locally against this branch:

| Gate | Result |
|---|---|
| `pnpm run typecheck` | pass |
| `pnpm run lint` | 0 errors (3224 pre-existing warnings) |
| `pnpm run test` | 20318 passed; the one failure was
`sessionIndex.test.ts` under concurrent load and passes 39/39 isolated |
| `pnpm run check:security-artifacts` | every version floor asserted;
Monaco patch confirmed present in the installed tree |
| `node scripts/check-nix-workspace.mjs` | 18/18 workspace deps present
|
| `nix build .#pythinker-code` | builds; refreshed `pnpmDeps` hash
verified, no mismatch |
| pre-push suite | all checks passed in 296s |

`check:security-artifacts` additionally needs
`.tmp/security-artifacts/{cli,vsix}` populated, which `security.yml`
does by packing first — that part is exercised by CI on this PR, not
locally.

## Checklist

- [x] I have read the CONTRIBUTING document.
- [ ] I have linked a related issue — none; this came from the
Dependabot alert list.
- [x] I have added tests that prove my feature works —
`scripts/security/check-artifacts.mjs` and `check-built-browser.mjs` are
the tests: they assert the floors and the Monaco patch against the
packed artifacts, so a regression fails CI rather than reappearing as an
alert.
- [x] Ran `gen-changesets` skill — `patch` on `@pymodel/pythinker-code`:
"Update the bundled dependencies to releases that carry the current
security fixes." The CI and tooling parts carry no changeset; users
cannot perceive them.
- [x] Ran `gen-docs` skill, or this PR needs no doc update — no
user-facing CLI behavior changed.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Expanded diagram rendering support, including flowcharts, state
diagrams, timelines, mind maps, radar charts, treemaps, Sankey charts,
Venn diagrams, and more.
* Added editor language support and syntax highlighting for Python,
JavaScript, TypeScript, HTML, JSON, YAML, XML, MDX, Razor, Liquid,
Handlebars, FreeMarker, and CSS.
* Added improved code, math, Mermaid, D2, and infographic block
rendering.

* **Bug Fixes**
  * Strengthened content sanitization and security validation.
  * Improved diagram rendering reliability and layout behavior.
* Addressed dependency vulnerabilities and removed unused packaged
assets.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: elkaix

.changeset/patched-bundled-dependencies.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Update the bundled dependencies to releases that carry the current security fixes.

.github/dependabot.yml

@@ -4,30 +4,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    # Scheduled version-update PRs are disabled on purpose: this workspace's
-    # engines.node (>=24.15.0 <25) exceeds the Node.js version Dependabot's own
-    # updater sandbox ships, so ANY `pnpm install`/update it attempts hard-fails
-    # with ERR_PNPM_UNSUPPORTED_ENGINE (root .npmrc sets engine-strict=true).
-    # See dependabot/dependabot-core#7426, #4072, #12976 — there is no
-    # dependabot.yml-level fix; the real fix is lowering engines.node or
-    # disabling engine-strict in .npmrc, both out of scope here. This entry
-    # exists only so the `ignore` rules below apply to security-update PRs,
-    # which open-pull-requests-limit: 0 does not suppress.
+    # Scheduled version updates remain disabled because Dependabot's updater
+    # does not satisfy this workspace's strict Node 24.15 engine requirement.
+    # Security updates remain enabled and no dependency is ignored.
     open-pull-requests-limit: 0
-    ignore:
-      # Both advisories are on vite/esbuild resolved transitively through
-      # docs/package.json's vitepress@1.6.4 (vite@5.4.21 in pnpm-lock.yaml),
-      # a dev-only docs-site dependency. vitepress@1.6.4 pins `vite: 5.4.21`
-      # as a hard (non-peer) dependency, so pnpm cannot resolve a fix without
-      # vitepress 2 (alpha only as of 2026-08) — every attempt reopens the
-      # same failing PR. Unscoped by version on purpose: Dependabot's actual
-      # target version for this resolution is unverifiable (no open
-      # Dependabot PRs exist in this repo to read a target off of, and the
-      # target is not necessarily the advisory's first-patched version), so a
-      # version-scoped rule can silently fail to match and let the PR back
-      # in. Cost: this also suppresses vite/esbuild security-update PRs for
-      # apps/*, which today sit at patched vite@6.4.3+ directly — revisit if
-      # that changes. Drop both rules once docs/package.json moves to
-      # vitepress 2 stable.
-      - dependency-name: "vite"
-      - dependency-name: "esbuild"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '43 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          build-mode: none
+          languages: javascript-typescript
+          queries: security-extended
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          category: /language:javascript-typescript

.github/workflows/security.yml

@@ -0,0 +1,68 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Security audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+      - run: pnpm audit --json
+
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-scopes: runtime, development, unknown
+          fail-on-severity: low
+          vulnerability-check: true
+
+  artifact-security:
+    name: Artifact security
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: node --test scripts/security/*.test.mjs
+      - run: pnpm -C apps/pythinker-code run prepack
+      - run: pnpm -C apps/desktop run package
+      - run: pnpm -C docs run build
+      - run: mkdir -p .tmp/security-artifacts/cli .tmp/security-artifacts/vsix
+      - run: pnpm --filter @pymodel/pythinker-code pack --pack-destination "${{ github.workspace }}/.tmp/security-artifacts/cli"
+      - run: pnpm --filter pythinker run package:platform -- --target linux-x64 --out-dir "${{ github.workspace }}/.tmp/security-artifacts/vsix"
+      - run: pnpm -C apps/pythinker-code run smoke
+      - run: git diff --exit-code -- apps/pythinker-code/dist-web
+      - run: pnpm run check:security-artifacts

.gitignore

@@ -10,6 +10,7 @@ coverage/
 .vitest-results/
 .DS_Store
 .playwright-mcp/
+.lavish/
 .claude
 .conductor
 .pythinker-stash-dir

SECURITY.md

@@ -26,7 +26,17 @@ Alternative channel:
 
 ## Our Response
 
-We will acknowledge your report and provide an initial assessment as soon as we can.
+We triage Critical and High reports within 24 hours. We target a fix within 72 hours for
+Critical and High issues, 7 days for Medium issues, and 30 days for Low issues.
+
+## Dependency Vulnerability Policy
+
+Pull requests cannot add a vulnerability at any severity. The repository uses a full-workspace
+audit because build and package steps can ship workspace code declared as a development
+dependency. A production-only audit is informational and is not a security gate.
+
+If a vulnerability is disclosed after clean code reaches `main`, the response times above apply.
+Dismissed or auto-dismissed alert state does not make a vulnerable dependency acceptable.
 
 ## Public Disclosure
 

apps/desktop/scripts/stage-runtime.ts

@@ -112,6 +112,7 @@ async function deploy(target: string): Promise<void> {
     await run('pnpm', [
       '--config.verify-deps-before-run=false', '--filter', deployPackage, 'deploy', '--legacy', '--prod',
       '--config.node-linker=hoisted', '--config.auto-install-peers=false', '--config.link-workspace-packages=true',
+      '--config.allow-unused-patches=true',
       deployTargetArgument(repositoryRoot, target),
     ])
   } finally {

apps/pythinker-code/dist-web/.web-bundle-manifest.json

@@ -1,4 +1,4 @@
 {
-  "sourceHash": "5fa1f4113f68cc5a0de3b4985ae517b47ca98f832e89e97cf636845fd3a2cd67",
+  "sourceHash": "c3f3aa64d301b50a33f02b02d5ba123747d52b048b1454d66fb3dee9abd2c416",
   "sourceFileCount": 388
 }