[zoeyrose]

Summary

Add a dependency review check for pull requests targeting main. Newly introduced high or critical vulnerable dependencies fail the check.

Implementation / behavior

The dedicated Dependency review job uses the official action with read-only repository permissions and reviews runtime, development, and unknown dependency scopes. It runs for every pull request, including Dependabot and fork contributions, without checking out or executing PR code. Lower-severity findings do not block the check.

The workflow uses a full action commit SHA that Dependabot can update normally; it adds no separate approved-version list, license gate, or human-approval requirement.

Validation

• Actionlint and whitespace checks passed.
• Independent review confirmed the workflow trigger, permissions, inputs, and action reference.

Limitations / follow-up

Repository aggregate validation and live fork/Dependabot acceptance remain pending CI. Required-check enforcement will be published separately after this workflow lands and passes.

[zoeyrose]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T16:35:20.546978Z	2ccf812	Manual request
🔒 Security Review	✅ Completed 2026-10-11T16:35:42.922671Z	2ccf812	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 2ccf812473

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 2ccf812473

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[github-actions]

🎉 This PR is included in version 1.8.0 🎉

The release is available on:

• v1.8.0
• GitHub release

Your semantic-release bot 📦🚀