chore(security): re-enable Dependabot vulnerability alerts and schedule dependency audits #236

What happened

Security and stability hardening audit finding H09 / P3 (2026-09-28). Priority is an audit recommendation, not a claim of a production incident.

The repository currently has no continuous signal for newly disclosed vulnerabilities in its dependencies:

• gh api repos/abruption/session-peer/vulnerability-alerts returns 404 (alerts disabled).
• gh api repos/abruption/session-peer/dependabot/alerts returns 403 "Dependabot alerts are disabled for this repository".
• security_and_analysis.dependabot_security_updates is disabled.

#189 (913e800) removed .github/dependabot.yml to stop version-update pull requests and stated that it "does not disable dependency vulnerability alerts". That statement is accurate for the file change, but alerts are nonetheless off in repository settings now. .github/requirements/build.txt still says "Dependabot updates this file".

pip-audit and npm audit --omit=dev run only when CI or a release runs: ci.yml triggers on push to main and pull_request with no schedule, and publish.yml audits at release time. A vulnerability disclosed between commits is not reported.

What you expected

• Dependabot vulnerability alerts enabled, independently of the decision to keep version updates off.
• A weekly scheduled audit (pip-audit over the relay,mcp runtime set and npm audit --omit=dev for control/) that reports without blocking unrelated PRs.
• The stale build.txt comment corrected.

Environment

• Baseline: published session-peer v1.0.2, commit 2046836822b88e53246de73851186598604cb5ec.
• Reproduction: read-only GitHub REST API queries and source review; no settings were changed.
• Audit environment: macOS arm64, Python 3.14.7.
• No live message tests or production mutation.

Source evidence

• .github/requirements/build.txt#L1-L2 — stale Dependabot comment
• .github/workflows/ci.yml#L3-L6 — no schedule trigger
• .github/workflows/ci.yml#L197-L215 — commit-time Python audit
• .github/workflows/publish.yml#L136-L165 — release-time audits
• tests/docs/test_release_workflows.py#L15-L33 — every ci.yml job must be in release-gate; only ci.yml/publish.yml are pin-checked

Acceptance criteria

• Vulnerability alerts enabled and confirmed via the API; the setting is documented in SECURITY.md or RELEASING.md.
• Scheduled audit lives in a separate workflow (a new ci.yml job would be forced into release-gate), uses commit-pinned actions and permissions: contents: read, and is added to the pinning test.
• build.txt comment reflects how pins are actually maintained.

Scope and limitations

Target: v1.0.3 hardening work. This issue does not authorize a release or operating-service changes; enabling alerts is an owner decision and does not reintroduce version-update PRs.

Related, not duplicates: #117 (release gates and audits), #189 (Dependabot version updates removed), #140 (a former Dependabot PR).

Checked

• Searched existing issues for duplicates.
• Removed credentials, conversation contents, private paths and real device/session identifiers.
• Used isolated fixtures without weakening inbound permissions.