dependabot-auto-merge.yml auto-merges semver-minor dependency bumps with no human review for a security-sensitive proxy package

[morcen]

Problem

.github/workflows/dependabot-auto-merge.yml calls gh pr merge --auto --merge for both version-update:semver-patch and version-update:semver-minor Dependabot updates, giving them identical unattended treatment:

- name: Auto-merge Dependabot PRs for semver-minor updates
  if: ${{steps.metadata.outputs.update-type == 'version-update:semver-minor'}}
  run: gh pr merge --auto --merge "$PR_URL"
  ...
- name: Auto-merge Dependabot PRs for semver-patch updates
  if: ${{steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
  run: gh pr merge --auto --merge "$PR_URL"

Why it matters

Passage is a security-sensitive HTTP proxy: its SSRF protections (AllowedHostsGuard, redirect re-validation in PassageController::guardRedirects()), HMAC signing, and hop-by-hop/header-stripping logic all depend directly on the exact runtime behavior of Composer dependencies covered by Dependabot (per .github/dependabot.yml), notably guzzlehttp/guzzle and illuminate/*. Unlike patch releases, semver-minor releases are permitted by semver to add new behavior or change defaults (e.g. a Guzzle minor release changing default redirect-following behavior, or a new deprecation that alters header casing/handling). Auto-merging these with zero human review — the same treatment given to patch releases — removes the one opportunity to catch a dependency change that silently weakens one of this package's own security guarantees before it reaches every consumer who depends on morcen/passage for exactly those guarantees.

Suggested fix

Restrict unattended auto-merge to version-update:semver-patch only, and require a human approval (or at minimum a maintainer-reviewed full security-audit run) before merging semver-minor Dependabot PRs — especially for guzzlehttp/guzzle and illuminate/*.

Location

• .github/workflows/dependabot-auto-merge.yml