fix #423 - bug: Enable Dependabot security updates

[fantonangeli]

Closes #423

❗ Maintainer action required @ricardozanini

Please verify that Dependabot security updates are enabled for this repository:

1. Open Settings.
2. Go to Security and quality > Advanced Security.
3. In the Dependabot section, make sure Dependabot alerts is enabled.
4. Make sure Dependabot security updates is also enabled.

Describe the Bug

The repository currently has several open security alerts, including high-severity vulnerabilities.
The current Dependabot configuration only groups regular version updates.

Steps to reproduce

1. Open the repository Dependabot alerts.
2. Notice multiple old unresolved security alerts.

How to test:

• pnpm audit
• It should return:

No known vulnerabilities found

[netlify]

✅ Deploy Preview for openworkflow-editor canceled.

Name	Link
🔨 Latest commit	d0b500a
🔍 Latest deploy log	https://app.netlify.com/projects/openworkflow-editor/deploys/6aa7cf55afc10300086e2ae5

[Copilot]

🟡 Changes recommended

Bound the fast-uri overrides to the supported 3.x release line and consolidate the selectors.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This pull request configures grouped Dependabot security updates and applies dependency overrides to address vulnerable transitive packages.

Changes:

• Groups npm and GitHub Actions security updates.
• Adds pnpm dependency overrides.
• Updates the lockfile with revised resolutions.

File summaries

File	Summary
pnpm-workspace.yaml	Adds overrides, but the fast-uri ranges must remain bounded to major version 3.
pnpm-lock.yaml	Records the resulting dependency resolutions.
.github/dependabot.yml	Configures grouped security updates.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

pnpm-workspace.yaml:77

• The unbounded replacement range resolves this override to nanoid@6.0.1 in the lockfile, even though the consuming PostCSS toolchain was on the 3.x line. This is a major-version substitution outside the consumer's semver contract and can break the Vite/PostCSS build; constrain the security override to the patched 3.x range instead of allowing the latest major.

  nanoid@<3.3.18: ">=3.3.18"

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The critical fast-uri override still permits vulnerable versions, so its range must be corrected before approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified in the reviewed changes.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[lornakelly]

LGTM

[fantonangeli]

Hi @ricardozanini we would need you to check the configuration in the PR description as we don't have permissions to access the security settings

[ricardozanini]

@fantonangeli I haven't changed anything and I remember turning this on once I created the repo:

[fantonangeli]

@fantonangeli I haven't changed anything and I remember turning this on once I created the repo:

@ricardozanini Thanks for checking. We should have everything we need now