add security packages

[vamsi (thedumsieffect)]

No description provided.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — all dependency upgrades are verified valid, API migrations are consistent across the codebase, and no breaking changes from the @fastify/static v10 upgrade affect the server's usage pattern.

The stack upgrades (Node 22, pnpm 10, react-router v8, @fastify/static v10) are internally consistent and the server does not use the changed setHeaders API. The new CI workflows and workspace security controls are additive. The only finding is the audit threshold choice, which is a preference rather than a defect.

Files Needing Attention: No files require special attention.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    PR[PR / Push to main or staging] --> AuditJob & TestsJob

    subgraph AuditJob["audit.yml — Security"]
        HR[Harden Runner\negress-policy: audit] --> CO1[Checkout code]
        CO1 --> PI1[Install pnpm@10.34.5]
        PI1 --> SN1[Setup Node 20]
        SN1 --> AUDIT[pnpm audit\n--audit-level critical]
    end

    subgraph TestsJob["tests.yml — Tests"]
        direction TB
        subgraph PkgIdx["package-index job"]
            CO2[Checkout] --> SN2[Setup Node 20]
            SN2 --> VALPKG[node --test\nvalidate-runneth-package-index.mjs]
        end
        subgraph SiteJob["site job"]
            CO3[Checkout] --> PI3[Install pnpm@10.34.5]
            PI3 --> SN3[Setup Node 20\nwith pnpm cache]
            SN3 --> INSTALL[pnpm install --frozen-lockfile\nallowBuilds: better-sqlite3 esbuild]
            INSTALL --> TEST[pnpm --filter use-case-library-server test]
        end
    end

    style AuditJob fill:#fef9c3,stroke:#ca8a04
    style TestsJob fill:#eff6ff,stroke:#3b82f6
    style PkgIdx fill:#f0fdf4,stroke:#22c55e
    style SiteJob fill:#f0fdf4,stroke:#22c55e

Loading

_{Reviews (2): Last reviewed commit: "Update ATC LP lesson 5 to the AI ad-nami..." | Re-trigger Greptile}