[rqbazan]

Summary

One known vulnerability, in build-time tooling only. It can't be fixed without an override, so pnpm audit ignores it and the alert gets dismissed in Dependabot.

Package	Severity	Runtime/dev	Path	Fix
fflate 0.7.3 (GHSA-px8p-9vwx-vf98: infinite loop in unzipSync on malformed ZIP64)	moderate	dev: satori only runs while building the og:image cards	.>satori>fflate	None available: satori pins fflate: 0.7.3 exactly, even in its latest release. Ignored in pnpm audit, dismissed in Dependabot. Drop the ignore when satori moves on.

 pnpm-workspace.yaml
+  auditConfig.ignoreGhsas: [GHSA-px8p-9vwx-vf98]   # with a comment saying why and when to drop it
 .github/
+├── dependabot.yml                  # security updates only: npm and github-actions on "/"
 ├── workflows/
+│   └── dependency-audit.yml        # Mondays 09:00 UTC: pnpm audit on pnpm-lock.yaml, opens/comments/closes one issue
 └── zizmor.yml
+    dependabot-cooldown: days: 1    # matches minimumReleaseAge: 1440
 README.md
+  two sentences on the weekly audit and Dependabot security updates

• Dependabot (.github/dependabot.yml): open-pull-requests-limit: 0 turns version updates off, while security updates still open PRs, grouped into one per ecosystem. cooldown.default-days: 1 mirrors pnpm's minimumReleaseAge. GitHub applies it to version updates only, so check the fixed version's age before merging a security PR.
• Dependency audit (.github/workflows/dependency-audit.yml): this runs on a schedule and on workflow_dispatch, not as a pull_request check, so a new advisory never blocks unrelated PRs. It keeps one issue labeled dependency-audit open while the audit finds known vulnerabilities, and closes it once the audit comes back clean. The only repo-specific line is audit "pnpm-lock.yaml" pnpm audit.
• Overrides: none. Changesets: none, since the site isn't published. Dependency changes: none: package.json and pnpm-lock.yaml are untouched.
• Repository settings: an org admin turns on the dependency graph and Dependabot security updates separately. Until then, dependabot.yml has nothing to act on, and the weekly audit is the only check that runs.

Evidence

• Before: pnpm audit → 1 vulnerabilities found, Severity: 1 moderate, exit 1.
  After: pnpm audit → Severity: 1 moderate (1 ignored), exit 0.
• Before: no dependency-audit workflow.
  After: I ran the audit step script locally from the worktree root (RUNNER_TEMP=$(mktemp -d) GITHUB_OUTPUT=/dev/stdout bash -e -o pipefail -c '<step>'). It prints found=false and leaves the report empty.
• pipx run --spec zizmor==1.30.1 zizmor --offline . and the online run with a token both report no findings. The one suppressed finding is undocumented-permissions on issues: write, which only shows with --persona=auditor.
• CI's commands pass locally with pnpm 10.30.3 via mise: pnpm install --frozen-lockfile (lockfile unchanged), pnpm rr jsc, pnpm astro check (0 errors, 0 warnings), pnpm astro build (5 pages).

Merge Danger

Door: two-way

To undo it, revert the PR. The audit ignore lives in a single config key, and nothing else in the dependency tree changes.

Blast Radius: repo-maintenance

Nothing changes in the site or its build. After merge, Dependabot may open security PRs, and the Monday audit may open an issue. If a future advisory touches fflate, it gets a new GHSA id, so the ignore won't hide it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TkHa1BVnm277qEiEuipG6n

[changeset-bot]

⚠️ No Changeset found

Latest commit: 27c577a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		27c577a	2026-10-17T23:10:54.128Z	View logs ↗