From 0acabdde67b8ae3bc071b072d6a651c068ddd175 Mon Sep 17 00:00:00 2001 From: muralx Date: Mon, 27 Jul 2026 12:52:30 +0100 Subject: [PATCH] ci(security): audit hono and nestjs package.json changes security.yml only re-ran npm audit on PRs touching sdk/mcp/fastmcp package.json. hono and nestjs ship too, so a PR changing only their dependencies would bypass the high/critical audit gate (the weekly scheduled run still covers the whole tree, but not per-PR). Add both package.json paths to the pull_request and push triggers for parity. --- .github/workflows/security.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index cb06df0..4125a73 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -14,6 +14,8 @@ on: - "packages/sdk/package.json" - "packages/mcp/package.json" - "packages/fastmcp/package.json" + - "packages/hono/package.json" + - "packages/nestjs/package.json" - ".github/workflows/security.yml" push: branches: @@ -24,6 +26,8 @@ on: - "packages/sdk/package.json" - "packages/mcp/package.json" - "packages/fastmcp/package.json" + - "packages/hono/package.json" + - "packages/nestjs/package.json" - ".github/workflows/security.yml" schedule: # Mondays 06:00 UTC — after dependabot runs.