Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 17 packages with OpenSSF Scorecard issues.

View full job summary

sequenceDiagram
  autonumber
  participant PR as "Pull Request"
  participant GHA as "GitHub Actions (pages-preview)"
  participant Repo as "Repository (sparse-checkout)"
  participant NPM as "npm / package-lock"
  participant Wrangler as "wrangler (npx --prefix .github)"

  rect rgba(200,200,255,0.5)
    PR->>GHA: Trigger pages-preview workflow
  end

  rect rgba(200,255,200,0.5)
    GHA->>Repo: Checkout repo (sparse: .github/package.json + lockfile)
    Repo-->>GHA: Provide package.json and package-lock.json
  end

  rect rgba(255,230,200,0.5)
    GHA->>NPM: npm ci --ignore-scripts --prefix .github (use lockfile)
    NPM-->>GHA: Install CI tooling into .github/node_modules
  end

  rect rgba(240,200,255,0.5)
    GHA->>Wrangler: npx --prefix .github wrangler deploy
    Wrangler-->>GHA: Deploy to Cloudflare Pages
  end

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the project's dependency management and security posture. It centralizes automated dependency updates for both npm packages and pre-commit hooks under Dependabot, ensuring consistent and timely updates across various parts of the codebase. Furthermore, it addresses a security concern by explicitly pinning the 'wrangler' dependency via a lockfile, aligning with best practices for supply chain security. These changes streamline CI processes and reduce manual overhead for dependency maintenance.

Highlights

• Dependabot Configuration: Added 'npm' and 'pre-commit' ecosystems to Dependabot for automated dependency updates across various directories.
• Dependency Pinning: Pinned the 'wrangler' dependency using a 'package.json' and 'package-lock.json' within the '.github' directory to improve security and address OSSF Scorecard alerts.
• CI Workflow Update: Modified the 'pages-preview.yml' workflow to use 'npm ci' for installing 'wrangler' based on the new lockfile, ensuring reproducible builds.
• Pre-commit Autoupdate Management: Disabled 'pre-commit.ci's automatic updates, delegating this responsibility to Dependabot to prevent duplicate pull requests.
• Git Ignore: Added '/.github/node_modules/' to '.gitignore' to prevent committing generated dependency files for CI tooling.

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​wrangler@​3.114.17

View full report

Greptile Summary

This PR completes the Dependabot coverage story by adding pre-commit and npm ecosystems, and replaces the bare npm i wrangler@version install in CI with a proper lockfile-based npm ci — resolving the OSSF Scorecard pinned-dependencies alert. The deploy-preview job correctly uses a sparse checkout of only the main-branch lockfile (untrusted PR code never enters that job), and pre-commit.ci autoupdate is cleanly disabled so Dependabot exclusively owns hook version bumps.

• dependency-review.yml: The allow-dependencies-licenses entries for @img/sharp-* packages are pinned to @0.33.5. With Dependabot now managing npm for both /.github (wrangler) and /site (Astro), a future update to either ecosystem can transitively bump the sharp version, causing the dependency-review gate to reject the Dependabot PR. Removing the version qualifier from those PURLs (e.g., pkg:npm/@img/sharp-wasm32 instead of pkg:npm/@img/sharp-wasm32@0.33.5) fixes this without weakening the license policy.
• All other changes are well-structured and internally consistent.

Confidence Score: 4/5

• Safe to merge — the one issue found is a future-proofing concern that will only surface when Dependabot creates its first sharp-bumping npm PR, not on this PR itself.
• The workflow logic is sound, the sparse-checkout approach for the deploy job is correct and secure, and the lockfile correctly pins all wrangler transitive deps. The single concern (version-pinned PURL entries in dependency-review.yml) is a maintenance hazard introduced by this PR but won't cause any immediate failures — it only becomes a problem once Dependabot starts bumping packages that transitively change the sharp version.
• .github/workflows/dependency-review.yml — version-pinned @img/sharp-* PURL entries will go stale as Dependabot bumps npm deps.

Important Files Changed

This is a comment left during a code review.
Path: .github/workflows/dependency-review.yml
Line: 56-58

Comment:
**Version-pinned sharp PURLs will break future Dependabot PRs**

`allow-dependencies-licenses` uses exact-version PURLs for `@img/sharp-*` packages. Now that this PR enables Dependabot for both `/.github` (wrangler) and `/site` (Astro), future Dependabot PRs that bump either of those packages may transitively pull in a newer version of `@img/sharp-*`. When that happens, the new version won't match `@0.33.5` and the dependency-review gate will fail, blocking the Dependabot PR even though the license hasn't changed.

The fix is to drop the version qualifier from the PURL, which matches any version of the package:

```suggestion
            pkg:npm/@img/sharp-wasm32,
            pkg:npm/@img/sharp-win32-ia32,
            pkg:npm/@img/sharp-win32-x64
```

The same staleness risk exists for the PyPI entries (`mem0ai@1.0.5`, `numpy@2.4.3`, etc.) which were already there before this PR, but those will now surface sooner once Dependabot starts creating npm PRs that exercise this action more frequently.

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 5f10cc0}

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.90%. Comparing base (494013f) to head (5f10cc0).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

@@           Coverage Diff           @@
##             main     #369   +/-   ##
=======================================
  Coverage   93.90%   93.90%           
=======================================
  Files         447      447           
  Lines       20819    20819           
  Branches     2011     2011           
=======================================
  Hits        19551    19551           
  Misses        981      981           
  Partials      287      287           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.