diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9e4d863
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+updates:
+ - package-ecosystem: npm
+ directory: /
+ schedule:
+ interval: weekly
+ day: monday
+ open-pull-requests-limit: 5
+ labels:
+ - dependencies
+ - security
+
+ - package-ecosystem: github-actions
+ directory: /
+ schedule:
+ interval: monthly
+ open-pull-requests-limit: 3
+ labels:
+ - dependencies
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index a02ba3f..009fa2d 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -31,7 +31,8 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
- node-version: '20'
+ node-version: '22'
+ cache: npm
# Windows-specific: Clean any existing node_modules to avoid EPERM errors
- name: Clean node_modules (Windows)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7752b6a..7621cf5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,14 @@ jobs:
- uses: actions/setup-node@v4
with:
- node-version: '20'
+ node-version: '22'
+ cache: npm
+
+ - name: Verify dependency lockfile
+ run: npm ci --ignore-scripts
+
+ - name: Audit dependencies
+ run: npm audit --audit-level=high
- name: Validate JSON files
run: |
@@ -23,16 +30,10 @@ jobs:
node -e "JSON.parse(require('fs').readFileSync('$f', 'utf8'))"
done
- - name: Check inline script syntax in organization-network-map.html
+ - name: Check public map JavaScript syntax
run: |
- node -e "
- const fs = require('fs');
- const html = fs.readFileSync('organization-network-map.html', 'utf8');
- const match = html.match(/
+