Known vulnerabilities identified and remediated timely

CMMC 2.0 SI.L1-3.14.1 (NIST 800-171r2 3.14.1) requires that organizations identify information system flaws, report them, and correct them. Known vulnerabilities in npm dependencies — tracked in CVE databases and surfaced by tools like npm audit — represent documented attack vectors. A critical vulnerability in a dependency used in an FCI-handling system is a direct compliance finding if no scanning process exists. CWE-1395 and SSDF RV.2 (Verify and Validate Software) require automation so that new CVEs are caught promptly rather than discovered only when exploited. Without a committed lock file, builds are not reproducible and vulnerability scanning results are inconsistent.

Add Dependabot for weekly automatic PR generation on vulnerable packages, and add npm audit to every CI run so builds fail before merging new vulnerabilities:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: 'npm'
    directory: '/'
    schedule:
      interval: 'weekly'
    open-pull-requests-limit: 10

# .github/workflows/security.yml
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm audit --audit-level=high

Commit package-lock.json to version control — without it, npm audit produces results against a different dependency tree than what is actually deployed. Run npm audit locally before the first commit to establish a clean baseline.