fix(security): clear the dependency advisories and gate them in CI

.changeset/patched-bundled-dependencies.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Update the bundled dependencies to releases that carry the current security fixes.

.github/dependabot.yml

@@ -4,30 +4,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    # Scheduled version-update PRs are disabled on purpose: this workspace's
-    # engines.node (>=24.15.0 <25) exceeds the Node.js version Dependabot's own
-    # updater sandbox ships, so ANY `pnpm install`/update it attempts hard-fails
-    # with ERR_PNPM_UNSUPPORTED_ENGINE (root .npmrc sets engine-strict=true).
-    # See dependabot/dependabot-core#7426, #4072, #12976 — there is no
-    # dependabot.yml-level fix; the real fix is lowering engines.node or
-    # disabling engine-strict in .npmrc, both out of scope here. This entry
-    # exists only so the `ignore` rules below apply to security-update PRs,
-    # which open-pull-requests-limit: 0 does not suppress.
+    # Scheduled version updates remain disabled because Dependabot's updater
+    # does not satisfy this workspace's strict Node 24.15 engine requirement.
+    # Security updates remain enabled and no dependency is ignored.
     open-pull-requests-limit: 0
-    ignore:
-      # Both advisories are on vite/esbuild resolved transitively through
-      # docs/package.json's vitepress@1.6.4 (vite@5.4.21 in pnpm-lock.yaml),
-      # a dev-only docs-site dependency. vitepress@1.6.4 pins `vite: 5.4.21`
-      # as a hard (non-peer) dependency, so pnpm cannot resolve a fix without
-      # vitepress 2 (alpha only as of 2026-08) — every attempt reopens the
-      # same failing PR. Unscoped by version on purpose: Dependabot's actual
-      # target version for this resolution is unverifiable (no open
-      # Dependabot PRs exist in this repo to read a target off of, and the
-      # target is not necessarily the advisory's first-patched version), so a
-      # version-scoped rule can silently fail to match and let the PR back
-      # in. Cost: this also suppresses vite/esbuild security-update PRs for
-      # apps/*, which today sit at patched vite@6.4.3+ directly — revisit if
-      # that changes. Drop both rules once docs/package.json moves to
-      # vitepress 2 stable.
-      - dependency-name: "vite"
-      - dependency-name: "esbuild"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '43 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          build-mode: none
+          languages: javascript-typescript
+          queries: security-extended
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          category: /language:javascript-typescript

.github/workflows/security.yml

@@ -0,0 +1,68 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Security audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+      - run: pnpm audit --json
+
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-scopes: runtime, development, unknown
+          fail-on-severity: low
+          vulnerability-check: true
+
+  artifact-security:
+    name: Artifact security
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: node --test scripts/security/*.test.mjs
+      - run: pnpm -C apps/pythinker-code run prepack
+      - run: pnpm -C apps/desktop run package
+      - run: pnpm -C docs run build
+      - run: mkdir -p .tmp/security-artifacts/cli .tmp/security-artifacts/vsix
+      - run: pnpm --filter @pymodel/pythinker-code pack --pack-destination "${{ github.workspace }}/.tmp/security-artifacts/cli"
+      - run: pnpm --filter pythinker run package:platform -- --target linux-x64 --out-dir "${{ github.workspace }}/.tmp/security-artifacts/vsix"
+      - run: pnpm -C apps/pythinker-code run smoke
+      - run: git diff --exit-code -- apps/pythinker-code/dist-web
+      - run: pnpm run check:security-artifacts

.gitignore

@@ -10,6 +10,7 @@ coverage/
 .vitest-results/
 .DS_Store
 .playwright-mcp/
+.lavish/
 .claude
 .conductor
 .pythinker-stash-dir

SECURITY.md

@@ -26,7 +26,17 @@ Alternative channel:
 
 ## Our Response
 
-We will acknowledge your report and provide an initial assessment as soon as we can.
+We triage Critical and High reports within 24 hours. We target a fix within 72 hours for
+Critical and High issues, 7 days for Medium issues, and 30 days for Low issues.
+
+## Dependency Vulnerability Policy
+
+Pull requests cannot add a vulnerability at any severity. The repository uses a full-workspace
+audit because build and package steps can ship workspace code declared as a development
+dependency. A production-only audit is informational and is not a security gate.
+
+If a vulnerability is disclosed after clean code reaches `main`, the response times above apply.
+Dismissed or auto-dismissed alert state does not make a vulnerable dependency acceptable.
 
 ## Public Disclosure
 

apps/desktop/scripts/stage-runtime.ts

@@ -112,6 +112,7 @@ async function deploy(target: string): Promise<void> {
     await run('pnpm', [
       '--config.verify-deps-before-run=false', '--filter', deployPackage, 'deploy', '--legacy', '--prod',
       '--config.node-linker=hoisted', '--config.auto-install-peers=false', '--config.link-workspace-packages=true',
+      '--config.allow-unused-patches=true',
       deployTargetArgument(repositoryRoot, target),
     ])
   } finally {

apps/pythinker-code/dist-web/.web-bundle-manifest.json

@@ -1,4 +1,4 @@
 {
-  "sourceHash": "5fa1f4113f68cc5a0de3b4985ae517b47ca98f832e89e97cf636845fd3a2cd67",
+  "sourceHash": "c3f3aa64d301b50a33f02b02d5ba123747d52b048b1454d66fb3dee9abd2c416",
   "sourceFileCount": 388
 }