Add dependency review workflow

Author: Boyeep

.github/dependency-review-config.yml

@@ -0,0 +1,7 @@
+# Keep the initial policy focused on risky dependency changes first.
+# If you want stricter license enforcement later, add allow-licenses here.
+fail-on-severity: high
+fail-on-scopes:
+  - runtime
+  - unknown
+license-check: true

.github/workflows/dependency-review.yml

@@ -0,0 +1,21 @@
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@v4
+        with:
+          config-file: ./.github/dependency-review-config.yml

CONTRIBUTING.md

@@ -87,6 +87,8 @@ For a pre-commit style check on staged content, run:
 npm run check:secrets -- --staged
 ```
 
+Dependency review also runs automatically on pull requests to catch newly introduced vulnerable dependency changes.
+
 ## Changing the API Contract
 
 If you modify request or response shapes:

README.md

@@ -120,6 +120,8 @@ The root check runs:
 
 CodeQL code scanning also runs on GitHub for `javascript-typescript`, `python`, and workflow files.
 
+Pull requests also run GitHub dependency review so new vulnerable dependency changes are easier to catch before merge.
+
 ## Releases
 
 - Release Drafter keeps a draft release updated from merged pull requests on `main` and can auto-label incoming pull requests by path.

SECURITY.md

@@ -31,6 +31,7 @@ The repository also uses automated scanning to help catch common security issues
 
 - `gitleaks` in CI for tracked git content
 - CodeQL code scanning on GitHub for JavaScript/TypeScript, Python, and workflow files
+- GitHub dependency review on pull requests for newly introduced vulnerable dependency changes
 
 Those checks do not replace private disclosure. If you believe a vulnerability is real or
 exploitable, please still report it through a private advisory.