Skip to content

Conversation

@Gagan202005
Copy link
Contributor

βœ… Summary

This PR adds a GitHub Actions workflow to run npm dependency security audit on a schedule (and/or PRs) to detect vulnerable packages early.


πŸ”§ Changes Included

  • Added Dependency Audit GitHub Actions workflow
  • Runs npm audit --audit-level=high
  • Configured as non-blocking (|| true) to avoid failing CI until vulnerabilities are resolved

βœ… Why this change?

  • Helps track high/critical security vulnerabilities in dependencies
  • Improves security visibility for maintainers
  • Encourages proactive dependency updates

πŸ§ͺ Testing Done

  • Workflow file validated
  • Verified the command runs successfully in CI (non-blocking)

πŸ“Œ Notes

  • The repo currently reports some vulnerabilities via npm audit
  • Once dependencies are updated, maintainers can remove || true to make this workflow strict/blocking.

Gagan202005 and others added 5 commits January 24, 2026 04:05
Signed-off-by: Gagan202005 <gagansinghal2005@gmail.com>
Signed-off-by: Gagan202005 <gagansinghal2005@gmail.com>
Signed-off-by: Gagan202005 <gagansinghal2005@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants