🔒 Harden dependency intake and monitoring

[IsaacInsoll]

Summary

• apply a seven-day npm release-age gate for routine dependency resolution
• configure grouped monthly npm and GitHub Actions updates with 30-day major and 7-day other routine npm cooldowns
• add a SHA-pinned dependency-review check for moderate-or-higher runtime and development vulnerabilities
• add a weekly/manual high-severity npm audit without making every pull request rerun npm audit
• document emergency package-age exceptions and publishing recovery, release authority, permanent workflow identity, and ResizeObserver fallback behavior

GitHub settings

The repository already had Dependabot alerts, private vulnerability reporting, secret scanning, push protection, protected main, least-privilege CI, and rebase-only merging. Dependabot security updates were enabled during this work. Repository auto-merge remains disabled.

GitHub initially reported dependency review as unsupported despite alerts being active. Reapplying the documented vulnerability-alerts endpoint explicitly enabled/refreshed the dependency graph; the rerun passed, and Dependency review is now a required main check bound to the GitHub Actions app.

Enabling alerts surfaced stale findings for deleted examples/**/package-lock.json manifests. None reference the current root or maintained fixture lockfiles; the next default-branch graph refresh will be checked before any alert is dismissed.

npm age-gate evidence

Pinned npm 12.0.2 was tested against release-it@21.0.1, published three days earlier:

• normal resolution with min-release-age=7 failed as expected
• exact min-release-age-exclude[]=release-it resolution succeeded
• a subsequent integrity-locked npm ci succeeded without the exclusion
• both repository lockfiles remained byte-identical after a normal lockfile-only install

Dependabot Core v0.379.0 reads npm's age setting for routine updates and explicitly overrides it for security updates: https://github.com/dependabot/dependabot-core/releases/tag/v0.379.0

Verification

• clean npm ci: zero vulnerabilities
• npm run security:audit: zero vulnerabilities
• npm run format:check
• npm run lint
• npm run typecheck
• npm test: 63 tests
• npm run test:types: all 12 compiler, React type, and resolution combinations
• npm run test:consumer
• npm run package:check
• npm run test:browser:container: 23 tests

The first browser run had one intermittent Ctrl-click popup timeout with 22 other tests passing. An immediate unchanged rerun passed all 23; this branch does not modify browser code or fixtures.

The release guide explicitly describes pre-release target controls: release-it, the permanent workflow, the GitHub environment, and npm trusted publishing remain assigned to the next release-tooling steps.