chore: security audit cleanup — CodeQL, workflow permissions, dependency overrides

.github/codeql/codeql-config.yml

@@ -0,0 +1,8 @@
+# Excludes directories that generate false positives:
+# - tests/fixtures: pre-built webpack bundles checked in as test artifacts, not source code
+# - spec/dummy: Rails test apps used for integration testing, not production code
+
+paths-ignore:
+  - 'packages/react-on-rails-pro-node-renderer/tests/fixtures/**'
+  - 'react_on_rails_pro/spec/dummy/**'
+  - 'react_on_rails/spec/dummy/**'

.github/workflows/actionlint.yml

@@ -1,5 +1,8 @@
 name: Lint GitHub Actions
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/bundle-size.yml

@@ -1,5 +1,8 @@
 name: Bundle Size
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:

.github/workflows/check-markdown-links.yml

@@ -1,5 +1,8 @@
 name: Check Markdown Links
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]

.github/workflows/codeql.yml

@@ -0,0 +1,36 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1' # Weekly Monday 6am UTC
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript-typescript', 'ruby']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4

.github/workflows/examples.yml

@@ -1,5 +1,8 @@
 name: Generator tests # TODO needs to be duplicated for RoR Pro
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/gem-tests.yml

@@ -1,5 +1,8 @@
 name: Rspec test for gem
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/integration-tests.yml

@@ -1,5 +1,8 @@
 name: Integration Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/lint-js-and-ruby.yml

@@ -1,5 +1,8 @@
 name: Lint JS and Ruby
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/package-js-tests.yml

@@ -1,5 +1,8 @@
 name: JS unit tests for Renderer package
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/playwright.yml

@@ -1,5 +1,8 @@
 name: Playwright E2E Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]

.github/workflows/precompile-check.yml

@@ -1,5 +1,8 @@
 name: Assets Precompile Check
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/pro-integration-tests.yml

@@ -1,5 +1,8 @@
 name: React on Rails Pro - Integration Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/pro-lint.yml

@@ -1,5 +1,8 @@
 name: React on Rails Pro - Lint
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/pro-test-package-and-gem.yml

@@ -1,5 +1,8 @@
 name: React on Rails Pro - Package Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/trigger-docs-site.yml

@@ -1,5 +1,8 @@
 name: Trigger docs site rebuild
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]

package.json

@@ -126,7 +126,35 @@
       "app>react": "^18.3.1",
       "app>react-dom": "^18.3.1",
       "sentry-testkit>body-parser": "npm:empty-npm-package@1.0.0",
-      "sentry-testkit>express": "npm:empty-npm-package@1.0.0"
+      "sentry-testkit>express": "npm:empty-npm-package@1.0.0",
+      "lodash@>=4.0.0 <=4.17.22": ">=4.17.23",
+      "qs@>=6.7.0 <=6.14.1": ">=6.14.2",
+      "bn.js@>=5.0.0 <5.2.3": ">=5.2.3",
+      "bn.js@<4.12.3": ">=4.12.3",
+      "minimatch@<3.1.3": ">=3.1.3",
+      "minimatch@>=9.0.0 <9.0.6": ">=9.0.6",
+      "basic-ftp@<5.2.0": ">=5.2.0",
+      "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
+      "minimatch@<3.1.4": ">=3.1.4",
+      "serialize-javascript@<=7.0.2": ">=7.0.3",
+      "ajv@<6.14.0": ">=6.14.0",
+      "ajv@>=7.0.0-alpha.0 <8.18.0": ">=8.18.0",
+      "@tootallnate/once@<3.0.1": ">=3.0.1",
+      "svgo@=4.0.0": ">=4.0.1",
+      "svgo@>=2.1.0 <2.8.1": ">=2.8.1",
+      "immutable@>=5.0.0 <5.1.5": ">=5.1.5",
+      "flatted@<3.4.0": ">=3.4.0",
+      "flatted@<=3.4.1": ">=3.4.2",
+      "smol-toml@<1.6.1": ">=1.6.1",
+      "handlebars@>=4.0.0 <=4.7.8": ">=4.7.9",
+      "serialize-javascript@<7.0.5": ">=7.0.5",
+      "path-to-regexp@<0.1.13": ">=0.1.13",
+      "brace-expansion@<1.1.13": ">=1.1.13",
+      "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3",
+      "handlebars@>=4.0.0 <4.7.9": ">=4.7.9",
+      "picomatch@<2.3.2": ">=2.3.2",
+      "picomatch@>=4.0.0 <4.0.4": ">=4.0.4",
+      "yaml@>=1.0.0 <1.10.3": ">=1.10.3"
     }
   }
 }