Security: 1 code-scanning alert of class DependencyUpdateToolID [code-scanning class DependencyUpdateToolID]

[iderex]

Board: yes

Security and quality alerts are worked before any phase, one issue per class of alert (the rule of 2026-09-05 on steinbruch, fleet-wide since 2026-09-06). This is the class DependencyUpdateToolID from code-scanning, 1 open alert, the highest severity high.

What the class says

Determines if the project uses a dependency update tool.

The alerts

• alert Record the manifest address as a commitment that cannot be withdrawn #4, severity high, at no file associated with this alert:1: https://github.com/Flowfin/hub/security/code-scanning/4

Done when

• This class stands at zero open alerts on the Security tab: every alert repaired by a change that lands here, or dismissed with a reason written on this issue that names the predicate, pasted from the API rather than clicked.
• The planning issue for this class on the operations tracker, which asks how the class is kept from arriving again, is named here; nothing here waits on it.

[iderex]

The class stands at zero open alerts, read from the API after the Scorecard run that followed the merge of #177.

#177 added .github/dependabot.yml, watching Go modules and the actions under .github/workflows weekly, one grouped request per ecosystem, held 7 days past a version's publication, and merged as 94530d052be385ef202ca72c5ede4170722b9a8e. .github/workflows/scorecard.yml ran on that push and finished green:

$ gh run list --repo Flowfin/hub --workflow scorecard.yml --limit 1 --json databaseId,event,status,conclusion,headSha --jq '.[] | "\(.databaseId)\t\(.event)\t\(.status)\t\(.conclusion)\t\(.headSha[0:7])"'
34079538936	push	completed	success	94530d0
$ gh api repos/Flowfin/hub/code-scanning/alerts/4 --jq '{number,state,fixed_at,dismissed_at}'
{"dismissed_at":null,"fixed_at":"2026-09-07T03:25:44Z","number":4,"state":"fixed"}
$ gh api 'repos/Flowfin/hub/code-scanning/alerts?state=open&per_page=100' --jq '.[] | select(.rule.id=="DependencyUpdateToolID") | .number'

Read 2026-09-07. The last command prints nothing: no open alert of this class remains. The alert was repaired rather than dismissed, so no predicate is named here.

What the analysis read is that a configuration file exists. Whether the platform accepted it is a separate reading, made by the first run of Dependabot on it rather than by the analysis; the pull request body says where a parse error shows if there is one.

The planning issue for this class on the operations tracker is erawright/operations#2175, which names this issue among the nineteen it covers and asks how the family is kept from arriving again. Nothing here waits on it.