Security advisories addressed

OWASP A06 (Vulnerable and Outdated Components) is the most mechanically preventable entry on the OWASP Top 10 — npm audit flags high and critical vulnerabilities automatically, yet most projects never run it in CI. SSDF SP 800-218 PW.4.4 requires active vulnerability scanning of dependencies as a baseline software security practice. A high-severity advisory in a direct dependency (e.g., prototype pollution in lodash, RCE in an older serialize-javascript) can be fixed with a single npm audit fix — but only if you know it's there.

Add npm audit to your CI pipeline. It exits non-zero on findings at or above the specified level, blocking the build:

# .github/workflows/ci.yml
- name: Audit dependencies
  run: npm audit --audit-level=high

To fix current findings:

npm audit fix          # auto-fix compatible versions
npm audit fix --force  # upgrade to breaking versions (review changes carefully)
npm audit              # see remaining issues requiring manual intervention

Add to package.json for local runs:

{ "scripts": { "audit:ci": "npm audit --audit-level=high" } }