Clear JavaScript advisories and fix the nightly Security Scan

.github/workflows/ci.yml

@@ -208,6 +208,9 @@ jobs:
       - name: Install Task
         uses: ./.github/actions/install-task
 
+      - name: Audit JavaScript dependencies (high and critical)
+        run: task sec:js
+
       - name: Web lint (Typecheck, Biome, and knip)
         run: task web:lint
 

.github/workflows/security-scan.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Check Go vulnerabilities
         run: govulncheck ./...
 
-  web-audit:
+  js-audit:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -47,17 +47,19 @@ jobs:
         with:
           bun-version: "1.4.2"
 
-      - name: Install web packages
-        working-directory: web
-        run: bun install --frozen-lockfile
-
-      - name: Audit web dependencies (high and critical)
-        working-directory: web
-        run: bun audit --audit-level=high
+      - name: Audit web, docs and mock OAuth dependencies (high and critical)
+        run: scripts/check_js_audit.sh
 
   image-scan:
     runs-on: ubuntu-24.04
     steps:
+      # The image repository needs a login to pull.
+      - name: Log in to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
       - name: Scan the published gateway image
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:

CLAUDE.md

@@ -92,7 +92,12 @@ tests, web and CLI E2E, builds) is too slow to run locally on every push. CI run
 
 - `govulncheck` - Check for known Go vulnerabilities
 - `shellcheck` - Validate all shell scripts
-- `npm audit` - Check for npm package vulnerabilities
+- `task sec:js` - `bun audit` of the web, docs and mock OAuth packages; fails on any high or critical advisory
+
+CI runs all three on every push. The nightly Security Scan workflow (`.github/workflows/security-scan.yml`) runs
+`govulncheck` and the JavaScript audit again, and scans the published Docker image with Trivy, so new advisories
+show up when nobody pushes. Fix a failing scan by upgrading the package (refresh its `bun.lock` entry if it's a
+transitive dependency).
 
 ### 7. DeepSource Static Analysis
 

Taskfile.yml

@@ -21,6 +21,7 @@ tasks:
       - task: duplication
       - task: file-length
       - task: shellcheck
+      - task: sec:js
       - task: web:check-ignores
       - task: build
       - task: generate:test
@@ -39,6 +40,11 @@ tasks:
     cmds:
       - git ls-files "*.sh" | xargs shellcheck
 
+  sec:js:
+    desc: Fail on high or critical advisories in the web, docs and mock OAuth packages
+    cmds:
+      - scripts/check_js_audit.sh
+
   format:
     desc: Format Go, web, and mock OAuth code
     deps: [go:format, web:format, mock-oauth:format]

docs/src/content/docs/development/contributing.mdx

@@ -286,7 +286,8 @@ on GitHub, or email [security@docspring.com](mailto:security@docspring.com). See
 3. **Dependencies**
    - Keep dependencies updated
    - Review security advisories
-   - Run `govulncheck` and `npm audit`
+   - Run `task go:sec:vuln` (govulncheck) and `task sec:js` (`bun audit` of the web, docs and mock OAuth
+     packages); CI fails on any high or critical advisory
 
 ## Testing Requirements
 

scripts/check_js_audit.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Fails on any high or critical advisory in the JavaScript packages: the web UI, the docs site and the mock OAuth
+# server. bun audit reads bun.lock, so nothing needs installing first. CI runs it on every push, and the Security
+# Scan workflow nightly, so a newly disclosed advisory shows up even when nobody pushes.
+
+cd "$(dirname "$0")/.."
+
+status=0
+for dir in web docs mock-oauth; do
+  echo "Auditing ${dir} dependencies..."
+  if ! (cd "${dir}" && bun audit --audit-level=high); then
+    status=1
+  fi
+done
+exit "${status}"

web/knip.json

@@ -1,19 +1,13 @@
 {
-  "$schema": "https://unpkg.com/knip@5/schema-jsonc.json",
+  "$schema": "https://unpkg.com/knip@6/schema-jsonc.json",
   "ignore": [
     "src/api/generated.ts",
     "src/lib/generated/**",
     "src/contexts/step-up-debug.ts",
     "src/lib/api.ts",
     "src/api/schemas/**",
-    "orval.config.ts",
     "src/api/types.generated.ts",
     "src/components/ui/**"
   ],
-  "ignoreDependencies": [
-    "@radix-ui/react-tabs",
-    "tailwindcss",
-    "tw-animate-css",
-    "@biomejs/biome"
-  ]
+  "ignoreDependencies": ["@radix-ui/react-tabs"]
 }

web/package.json

@@ -69,7 +69,7 @@
     "@vitest/ui": "^4.1.11",
     "autoprefixer": "^10.6.1",
     "jsdom": "^27.4.0",
-    "knip": "^5.88.1",
+    "knip": "^6.39.0",
     "openapi-typescript": "^7.13.0",
     "orval": "^8.39.0",
     "otplib": "^12.0.1",