chore(security): automate weekly dependency security refresh

[Jayanth Reddy Bujula (jbujula)]

Summary

Stops the S360 / Component Governance alerts fixed in #506 from silently coming back.

The gap: Dependabot only reads dependencies / devDependencies. It cannot see the npm overrides block - which is where most transitive fixes in this repo live, including the gulp-mocha > mocha override that removes the exact-pinned minimatch@3.0.4 and diff@5.0.0. So Dependabot reports "no update available" while Component Governance keeps raising the same alerts, and someone has to fix them by hand every time.

This matters more here than in most repos: this package ships its own node_modules inside the published tarball, so a vulnerable transitive copy left here is re-detected downstream in powerplatform-build-tools no matter what that repo pins.

Changes

scripts/audit-overrides.js

For each npm audit advisory it walks the via chain to the GHSA IDs, looks each one up in the GitHub Advisory DB for its real first_patched_version, then compares that against every installed copy on disk (not just the lockfile). It proposes an override only when a patched version is actually published.

Two guard rails learned the hard way:

• Refuses a flat override for any package spanning multiple majors. The tree has minimatch at majors 3, 5 and 10 - a flat "minimatch": "^3.1.5" would silently downgrade glob's minimatch@10.
• Never invents a version. If no fix is published it is reported under Accepted risk rather than pinned to something that does not exist.

Output is a three-section report: Automatic fixes / Needs a human / Accepted risk. --write applies the automatic ones.

.github/workflows/dependency-security.yml

Weekly (Mondays 06:00 UTC) plus workflow_dispatch:

1. npm update - refresh the lock inside the ranges already declared. This alone historically clears most alerts; the ranges were fine, the lock was stale.
2. node scripts/audit-overrides.js --write - raise any range that is genuinely too low.
3. npm run ci must pass - a broken tree is never proposed.
4. Open a PR containing the report.

Runs on Node 20: the script needs a modern npm for npm audit --json, and Node 22+ is avoided because its native TypeScript stripping conflicts with ts-node/register during npm run ci.

.github/dependabot.yml

Groups routine minor/patch churn into one PR so genuine security PRs stay easy to spot, adds a dependencies label, and adds a github-actions ecosystem. Documents the overrides gap.

Review and notifications

Nothing auto-merges. Reviewers come from the existing .github/CODEOWNERS (@microsoft/powerapps-isv-tools-contrib, @microsoft/powerplatform-isv-tools-admin), which already covers *.

Verification

Ran against this repo on the #506 branch, where it correctly reported the already-fixed state rather than proposing spurious changes:

## Automatic fixes
- none required

## Needs a human
- none

## Accepted risk
- elliptic: GHSA-848j-6mx2-7j84 - dev-only (rewiremock -> node-libs-browser
  -> crypto-browserify), no patched version published

It was also validated against powerplatform-build-tools in an unfixed state, where it independently reproduced a hand-built fix plan and caught three bugs in it - including the multi-major downgrade above.

The same automation is proposed for powerplatform-build-tools in microsoft/powerplatform-build-tools#1441.

Note

The scheduled trigger only becomes active once this merges into main - GitHub registers schedule and workflow_dispatch from the default branch only.