Dependency vulnerabilities tracked and remediated

Unpatched dependencies are the most common initial access vector in supply-chain attacks: a single vulnerable lodash or express version can expose every application built with it once a public exploit drops. NIST 800-53 rev5 SI-2 (Flaw Remediation) requires timely patching; RA-5 (Vulnerability Monitoring and Scanning) mandates continuous scanning. FedRAMP rev5 SI-2 sets a 30-day remediation window for high-severity findings. CWE-1357 and SLSA L2 both address dependency provenance and vulnerability management. CI/CD pipelines that never run npm audit provide a false sense of security — vulnerabilities accumulate silently across every merge.

Add npm audit --audit-level=high to your CI pipeline as a required check and configure Dependabot to open PRs for security updates within 24 hours of disclosure.

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: daily
    open-pull-requests-limit: 10
    groups:
      security:
        applies-to: security-updates
        update-types: [minor, patch]

# .github/workflows/security.yml
name: Dependency Audit
on: [push, pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npm ci
      - run: npm audit --audit-level=high

Run npm audit fix immediately for any critical or high findings already in the lockfile. Use npm audit --json to integrate results into a SIEM or tracking ticket.