Summary

The CI pipeline (.github/workflows/test.yml) runs lint and unit tests but does not include any dependency vulnerability scanning. With 80+ direct dependencies including security-sensitive packages (Web3, Capacitor plugins, crypto libraries), undetected vulnerable dependencies pose a significant supply chain risk.

Evidence

• .github/workflows/test.yml — only runs npm run lint and npm run test.ci
• No npm audit, Snyk, or Dependabot security scanning step found in any workflow
• 8 open Dependabot PRs (build(deps): bump @ngneat/transloco from 2.22.0 to 6.0.4 #3315-build(deps): bump webpack and @angular-devkit/build-angular #3323) have been open since February 2025 (over a year), suggesting no automated merge or review process for dependency updates
• Several major version bumps pending: zone.js (0.11→0.15), typescript (4.7→5.7), swiper (8→11)

Impact

• Vulnerable dependencies may ship to production undetected
• Stale Dependabot PRs accumulate, increasing the effort to catch up
• Major version dependency drift increases the risk of breaking changes when finally updated

Suggested Approach

1. Add npm audit --audit-level=high step to the test workflow:

- name: Security audit
  run: npm audit --audit-level=high --omit=dev

2. Configure Dependabot auto-merge for patch updates via .github/dependabot.yml
3. Consider adding a scheduled weekly security scan workflow
4. Prioritize reviewing the 8 pending Dependabot PRs, especially the major version bumps

Related

• Open Dependabot PRs: build(deps): bump @ngneat/transloco from 2.22.0 to 6.0.4 #3315, build(deps): bump @capacitor-community/bluetooth-le from 6.0.1 to 7.0.0 #3316, build(deps-dev): bump lint-staged from 11.1.2 to 15.4.3 #3317, build(deps): bump zone.js from 0.11.4 to 0.15.0 #3318, build(deps-dev): bump typescript from 4.7.4 to 5.7.3 #3319, build(deps): bump swiper from 8.4.7 to 11.2.2 #3320, build(deps-dev): bump stylelint-scss from 3.20.1 to 6.11.0 #3321, build(deps-dev): bump @types/node from 16.7.10 to 22.13.0 #3322, build(deps): bump webpack and @angular-devkit/build-angular #3323

Generated by Health Monitor with Omni