[yumike]

Summary

Add a dedicated Dependency Review workflow using GitHub's standard action, pinned to its v5.0.0 commit.

• Run on every pull request, without branch or path filters.
• Reject newly introduced known vulnerabilities at every severity, including runtime, development, and unknown dependency scopes.
• Use only contents: read, do not persist checkout credentials, and do not post PR comments.
• Leave license policy, Renovate configuration, and the 14-day release-age policy unchanged.
• Document why development scopes and an unfiltered PR trigger must be retained.

This catches cases such as #1343 introducing vulnerable Undici through jsdom's development dependencies. A runtime-only check would miss it. It checks dependency changes, not the entire existing vulnerability backlog.

Validation

Executed the exact pinned action bundle with this workflow's inputs against GitHub's live dependency comparison API:

• chore(deps): update dependency jsdom to v30 #1343: fails and reports vulnerable Undici 8.12.1, including the TLS-validation advisory.
• Runtime-only negative control: passes on the same PR, demonstrating why the broader scopes matter.
• Unchanged dependency graph: passes.
• Reversed comparison removing the vulnerable version: passes.
• API 404: fails.

Also verified both action pins and release ages, parsed the workflow, ran make format, Prettier checks, root lint, and git diff --check.

Required-check activation

This PR adds the check but does not change repository rules or merge settings. After it has run, add Dependency Review (source: GitHub Actions) as a required status check in an active ruleset targeting main. Review the existing rules before activating that ruleset; it is currently disabled.