Clear six dependency advisories, and let Dependabot open PRs

[thalida]

Closes #214

Six advisories closed, and the mechanism that should have surfaced them added.

The three Dependabot alerts

#	Package	Was	Now
7	browserslist	4.28.2	4.28.8 (fix was 4.28.7)
5, 2	js-yaml	4.2.0	4.3.1 (via overrides)

Neither was reachable here. browserslist's advisory needs an untrusted browserslist-stats.json custom stats file — there is none, and no custom browserslist config. js-yaml's two need attacker-controlled YAML, and the only thing openapi-typescript parses is .local/openapi.generated.json, produced by scripts/gen_openapi.py from our own Pydantic models. Both are scope: development and neither reaches the built bundle. Hygiene, not an incident.

They differ in one important way:

• browserslist arrives via ^4.24.0, so npm update reaches the fix.
• js-yaml had no upgrade path at all. @redocly/openapi-core@1.34.17 pins it at exactly 4.2.0, and openapi-typescript is already on its newest release (7.13.0), so the redocly version that moved to js-yaml ^5.2.2 isn't reachable from it. No amount of npm update would ever have fixed this. An overrides entry forcing 4.3.1 was the only route, and it stays inside 4.x.

Three more that Dependabot never flagged

npm audit and GitHub's advisory database disagreed. Once the first two were cleared, npm still reported:

Package	Was	Now	Comes from
brace-expansion	2.1.2 / 5.0.8	2.1.4 / 5.0.9	eslint, openapi-typescript (both instances were in range)
fflate	0.8.2	0.8.3	@types/three — types-only, no runtime code
nanoid	3.3.16	3.3.18	vite → postcss

All dev-scope, all patch bumps, lockfile-only. npm audit now reports 0.

Dependabot config

There was no .github/dependabot.yml and no open Dependabot PRs — alerts were on with nothing behind them, so an advisory sat until someone noticed a push warning. The same detection-without-remediation gap #209 closed for the image's OS packages.

Added grouped weekly PRs for npm (app/) and github-actions, with production and development deps grouped separately so they land as reviewable PRs rather than thirty individual ones.

No Python stanza, deliberately. Dependabot has no uv ecosystem, and per GitHub's docs its pip one reads only pip/pipenv/pip-compile/poetry files. On this repo it would edit pyproject.toml, leave uv.lock behind, and fail every uv sync --frozen build. Python deps stay manual; the config says so.

Verification

• npm audit → 0 vulnerabilities, confirmed again inside the CI container's own npm ci
• just check-types-fresh → exit 0, so js-yaml 4.3.1 emits byte-identical generated types (manifest.generated.ts is diff-checked, so any drift would fail)
• vitest → 191 files, 2153 tests, exit 0
• npm run build → exit 0
• prettier --check . → exit 0
• Lockfile diff is only the browserslist data family (caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db, baseline-browser-mapping) plus the five patched packages — no orphan churn, no majors

Not included

Nothing in CI runs npm audit, so the npm half of the split above still depends on someone running it by hand. Wiring it into the gate would fail CI on any new advisory in any transitive dev dependency — a policy call rather than a cleanup, so it's left alone here.

🤖 Generated with Claude Code

https://claude.ai/code/session_011Qzxns3a3Q12RfayHZRrGZ