Issue #77 — Dependency Vulnerability Policy: OSV-Scanner in CI + Dependabot SLAs

[Topmatrixmor2014]

Add OSV-scanner to CI and a Dependabot remediation SLA so the dependency graph stays clean and new vulnerabilities are caught at PR time.

Requirements and Context

The default branch currently carries dozens of dependency alerts (npm + crates.io), several caused by stale/divergent lockfiles. npm audit only surfaces a subset; OSV-scanner covers npm, pnpm, and Cargo against the same OSV/GHSA database Dependabot uses. There is no PR-time gate and no documented remediation SLA.

Objectives

1. Add an OSV-scanner CI job that scans package-lock.json, backend/pnpm-lock.yaml, and Cargo.lock and fails on high/critical findings.
2. Add/refresh a dependabot.yml with grouped PRs and an explicit remediation SLA (e.g., high ≤ 14 days).
3. Resolve the stale-lockfile drift that generates false-positive alerts (align frontend/package-lock.json with package.json).
4. Document the vulnerability triage/remediation process in docs/.

Suggested Execution

1. git checkout -b feat/dependency-security.
2. Add the OSV-scanner job to .github/workflows/ and .github/dependabot.yml.
3. Regenerate/align stale lockfiles (especially frontend/package-lock.json).
4. Add docs/vulnerability-management.md and verify CI runs the scanner.

Acceptance Criteria

• CI fails on high/critical findings from OSV-scanner across all lockfiles.
• dependabot.yml defines grouped PRs and a documented SLA.
• Stale lockfile drift is resolved (frontend lockfile matches package.json).
• The triage process is documented.

Guidelines

• Pin the OSV-scanner action to a known-good release.
• Run npm ci/cargo consistently so lockfile regressions are caught by the same CI.

Timeframe: 96 hours

---

[github-actions]

🤖 Greptile AI Context

Greptile has indexed this repository and can provide AI-assisted code review
and context for this issue.

How to use Greptile on this issue:

• Comment @greptileai to ask about relevant code, files, or implementation approaches
• Reference specific files or error messages for targeted analysis
• Use @greptileai explain <file> to get an explanation of any file

Greptile is configured with project-specific rules in .greptile/config.json.

[Theophilus131]

please assign this to me. i can deliver a PR within 2 days

[grantfox-oss]

🦊 GrantFox — @Theophilus131 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #646)
2. Your PR will be reviewed by the FinChippay maintainers

Good luck! Track your progress on GrantFox.