The current PR workflow installs the lockfile and runs type/behavior/Rust tests, but it does not run npm audit --omit=dev. #305 found production Markdown-rendering vulnerabilities that could therefore re-enter a future lockfile unnoticed.
Add a focused PR-workflow step after npm ci that fails on production dependency advisories. Keep dev-only advisories out of this gate so development tooling does not block runtime security fixes.
The current PR workflow installs the lockfile and runs type/behavior/Rust tests, but it does not run
npm audit --omit=dev. #305 found production Markdown-rendering vulnerabilities that could therefore re-enter a future lockfile unnoticed.Add a focused PR-workflow step after
npm cithat fails on production dependency advisories. Keep dev-only advisories out of this gate so development tooling does not block runtime security fixes.