Clear JavaScript advisories and fix the nightly Security Scan

[ndbroadbent]

Fixes #143.

Advisories

bun audit --audit-level=high reported 20 high-severity advisories in web/. docs/ had 7 and mock-oauth/ had 3 (one critical); the scan didn't audit those two. All came in through build and test tooling.

• Refreshed the vulnerable transitive packages in each bun.lock within their existing version ranges: brace-expansion, fast-uri, picomatch, rollup, source-map-js, ws, @trpc/server, http-cache-semantics, js-yaml, form-data, path-to-regexp and proxy-addr.
• braces has no fixed release, so knip goes from 5 to 6.39, which no longer depends on fast-glob. I also removed the knip.json ignores knip 6 reports as unneeded.
• bun audit --audit-level=high now passes in all three packages.

Catching new advisories

• scripts/check_js_audit.sh (task sec:js) audits web, docs and mock-oauth from their lockfiles, with no install needed.
• CI runs it in web-tests (a required check), so a push that brings in an advisory fails, instead of only the next nightly scan.
• The nightly scan's js-audit job (formerly web-audit) uses the same script.

Image scan

docker.io/docspringcom/rack-gateway needs a login to pull. Anonymous requests get 401 authentication required, so Trivy never scanned the image. The image-scan job now logs in with the release workflow's Docker Hub secrets first.

Checks

• Web unit tests (156), typecheck and build pass, and knip 6 is clean.
• mock-oauth's tests pass, and the docs build with no broken links.
• The Security Scan workflow has been dispatched on this branch to confirm all three jobs pass; the result will be added below.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 8 billable files and costs up to $2.00.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 12 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 61 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 41b4dd33-2a08-441c-bfb1-f2ed745e7e48

📥 Commits

Reviewing files that changed from the base of the PR and between be5314d and 7ffe0df.

⛔ Files ignored due to path filters (3)

• docs/bun.lock is excluded by !**/*.lock
• mock-oauth/bun.lock is excluded by !**/*.lock
• web/bun.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• .github/workflows/ci.yml
• .github/workflows/security-scan.yml
• CLAUDE.md
• Taskfile.yml
• docs/src/content/docs/development/contributing.mdx
• scripts/check_js_audit.sh
• web/knip.json
• web/package.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in be5314d...7ffe0df on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 13, 2026 1:57a.m.	Review ↗
Go		Oct 13, 2026 1:57a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.