chore(deps): post-v0.2.0 dependency and Dependabot config cleanup - #131

Applies what the three Dependabot PRs closed on 2026-08-02 proposed (#126, #127, #128), correctly, plus the config changes that stop them recurring — and answers the base-branch question those closures raised. Also closes #124 by applying the postcss bump by hand, since with the Dependabot queue empty nothing was going to propose it.

Item 5 is a diagnosis with a recommendation, and it deliberately changes neither target-branch nor the grouped-security-updates repo setting.

1. fastapi 0.140.0 → 0.140.13, lock regenerated (was #127)

#127 failed CI because Dependabot edits pyproject.toml without touching backend/requirements.lock, so the drift gate rejects it. A pip bump here is never mergeable as opened.

Regenerated with the pinned command from CONTRIBUTING.md § Backend dependency lock (uv 0.8.17, --group build --generate-hashes --python-version 3.14). The lock moves three lines — fastapi's version and its two wheel hashes. starlette stays at the explicitly-pinned 1.3.1.

Changelog read before applying; nothing in the thirteen releases touches a path Scrye uses.

Verified against the regenerated lock, not the version pin. A venv on CPython 3.14.6 built the way the image builds — pip install --require-hashes -r requirements.lock, then pip install --no-deps --no-build-isolation . — runs the full suite green: 666 passed, 5 skipped, identical to the pre-bump baseline on the same interpreter.

2. docker/login-action 4.5.1 → 4.6.0, SHA-pinned (#128 proposed 4.5.2)

Pinned dbcb813823bdd20940b903addbd779551569679f # v4.6.0 in publish.yml, dev-nightly.yml and rescan.yml.

Why 4.6.0 over the 4.5.2 that #128 proposed. 4.5.2's only substantive commit improves Docker Hub OIDC error text — a path none of the three call sites can reach, since all three log in to ghcr.io with the built-in GITHUB_TOKEN as username/password. 4.6.0 supersedes it a day later, its change is adjacent to what this repo actually does (the login → buildx-builder → push chain), and it carries the action's own bundled dependency bumps. Taking it also avoids pinning to a release that was already superseded on the day it was applied.

SHA resolved from upstream with git ls-remote --tags, not from a changelog: refs/tags/v4.6.0 → dbcb813…. Note upstream's moving v4 tag currently points at the same commit — the pin here is the immutable v4.6.0 commit, not the alias.

Read at the source, by diffing v4.5.2...v4.6.0 rather than trusting the release notes, because these workflows run only on the tag-gated publish path and the nightly, which CI cannot exercise:

• action.yml is byte-identical — no input added, removed, renamed, or re-defaulted.
• src/main.ts and src/docker.ts are unchanged — the login flow itself does not move.
• The entire change is in src/context.ts's buildx scoped-config-dir helper: path.resolve containment on the resolved registry directory, validation of the scope input (at most one @, actions matching ^[a-z]+(,[a-z]+)*$), and rejection of a scope path escaping the registry dir — via a new isChildPath() helper.

The honest reading: behaviourally a no-op for us today. That helper returns early on if (scopeDisabled() || !scope || scope === '') return '', and no call site passes a scope input (each passes exactly registry, username, password — no ecr, no logout, no OIDC, and no DOCKER_CONFIG anywhere in the repo). Two of the three sites do go on to run buildx via .github/actions/build-image, so the hardened area is on the chain they use; rescan.yml only does a plain docker pull. Recorded as currency plus defence-in-depth against a future scope, not as a fix for anything reachable.

3. Node: majors ignored, and the 22 → 24 move written up (was #126)

#126 proposed node 25. Per the Node release schedule, v25 has no LTS date at all and reached end-of-life on 2026-06-01 — before the PR was opened, and years before the 22 line's 2027-04-30. It would have moved the builder onto an unsupported runtime.

.github/dependabot.yml's docker entry now ignores node majors, scoped to version-update:semver-major so digest refreshes of the pinned 22 tag still come through — the config can express this, so no workaround was needed. That scoping is load-bearing: declining a major previously left Dependabot offering nothing for this image and the digest went stale until #107 refreshed it by hand. The archive entry is explicit that this rests on documented update-types semantics rather than an observed run in this repo, and names the next scheduled docker run as the test.

docs/ROADMAP.md's Node item is rewritten to say the target is 24 (Active LTS, 2028-04-30), that it must be its own PR with a registry-verified digest pin, and to name the three files that must move together — docker/Dockerfile's builder digest, ci.yml's node-version, and CONTRIBUTING.md's stated Node requirement (plus README.md § Requirements). Bumping the Dockerfile alone would leave CI building on 22 while the image builds on 24.

4. The self-referencing image tag

dependency-name: "scrye" ignored, closing the private_source_authentication_failure run.

Which entry scans the compose file was verified by reading both files, not assumed: docker/docker-compose.yml carries the only image: scrye:0.2.0 reference, and docker/Dockerfile has no scrye image reference at all. So the substantive ignore is on the docker-compose entry; it is repeated on the docker entry because the failing run's ecosystem is visible only in the Dependabot UI/job logs, which are not reachable from a code session, and suppressing a name the Dockerfile never mentions costs nothing.

The image tag itself is unchanged, as required.

5. The base-branch problem — diagnosed, no setting changed

It is not grouped security updates, and it is not target-branch.

#126/#127/#128 are all version updates across three different ecosystems, and their head branches carry the /dev/ target-branch segment — Dependabot read the config and honoured it. Each PR's timeline then records an automatic_base_change_succeeded event:

The v0.2.0 promotion #122 merged at 23:56:07Z. GitHub automatically retargets open PRs whose base branch is deleted to the merged PR's base — and a promotion has dev as its head branch, so auto-delete-on-merge deleted dev and moved the entire open-PR queue onto main in the same instant. base.sha on all three is the promotion's merge commit.

This is the second blast radius of the auto-delete incident already recorded on 2026-08-02: it did not only delete a branch that had to be restored, it re-based every open PR onto the protected release branch.

#110 and #120 are the genuinely-documented security-update case: their head branches carry no /dev/ segment, and neither has an automatic_base_change_succeeded event. Read the event type precisely — #120 does carry two plain base_ref_changed events, which are the manual retarget-to-dev-and-back already documented on 2026-07-31, a different thing entirely.

Recommendation: nothing further to change. The remedy is already in place — auto-delete was disabled on 2026-08-02, and with no head-branch deletion there is no retarget. Specifically: do not alter target-branch, do not trade grouped security updates for one-PR-per-advisory (grouping is not implicated), and do not re-enable auto-delete. Written into CLAUDE.md § Dependency hygiene and a new CONTRIBUTING.md subsection with a two-signal table for telling the two causes apart.

6. The three advisory issues — two now closed

• GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass) — fixed by the 7.18.2 backport, not the 8.3.0 major #123 (react-router) — re-verified, still accurate, stays open. Range still >=7.12.0 <8.3.0, no 7.x fix, npm audit still offers only the 7.11.0 downgrade.
• GHSA-r28c-9q8g-f849 (postcss source-map path traversal) — RESOLVED: bumped 8.5.16 → 8.5.25 #124 (postcss) — bumped by hand and closed. postcss 8.5.16 → 8.5.25.
  • Applied here rather than deferred because Dependabot had not proposed it and the queue is now empty — a HIGH advisory waiting on a bot that will not act is worse than a four-line diff.
  • The real fix floor was verified in the published source, not read off the range: 8.5.18's lib/previous-map.js loadFile() gains the containment check (relative(dirname(cssFile), path) rejected when '..', '../…', or absolute) that 8.5.17 lacks. 8.5.25 still carries it, and is the current release on the pinned major.
  • No overrides entry, no parent bump. postcss turns out to be a direct devDependency, and every package that also reaches it declares a peer/caret range 8.5.25 satisfies (vite's ^8.5.3 included), so one pin lifts the tree — npm ls postcss --all shows a single deduped copy. The "stop if a parent needs a major" condition never arose.
  • Regenerated with npm pkg set + npm install --package-lock-only. Diff: postcss 8.5.16 → 8.5.25, its nanoid floor ^3.3.12 → ^3.3.16, nanoid 3.3.15 → 3.3.16 — all dev-only, no new packages.
  • npm audit no longer reports postcss; the two remaining highs are the react-router pair from GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass) — fixed by the 7.18.2 backport, not the 8.3.0 major #123. Nothing ships either way — PostCSS runs during vite build and the image copies only dist/.
• GHSA-mh99-v99m-4gvg (brace-expansion DoS) — RESOLVED: the advisory was re-scoped per major and 1.1.18 / 2.1.4 are both patched #125 (brace-expansion) — materially wrong; corrected and closed. GHSA-mh99-v99m-4gvg was re-scoped on 2026-07-31 from a flat <=5.0.7 into per-major ranges (<1.1.17 → 1.1.17; >=2.0.0,<2.1.3 → 2.1.3). Scrye's 1.1.18 and 2.1.4 are both above their line's first patched version, so the chore(release): v0.2.0 release prep — CHANGELOG cut, brace-expansion bump, Dependabot security-PR routing #121 bump did clear it. Verified at the source: 1.1.17 and 2.1.3 introduce EXPANSION_MAX_LENGTH and name CVE-2026-14257 in their comments; 1.1.16 and 2.1.2's index.js do not. Closed on the issue's own stated criterion; original text preserved in a collapsed block; no duplicate opened.

The shipped [0.2.0] CHANGELOG is left as published — it was accurate against the advisory data at tag time, and §14 carries the correction. [Unreleased] gains a ### Security entry for the postcss bump that says explicitly that, unlike brace-expansion in 0.2.0, this one does clear its advisory.

7. CodeQL roadmap item

New docs/ROADMAP.md § Near-term item for enabling GitHub code scanning on Python and TypeScript: free for public repos, default setup adds a workflow running on every push and PR, and the first run surfaces a triage backlog — so it wants its own scoped session, not a settings-page click. Includes the default-vs-advanced-setup decision and a requirement that dismissals carry written reasons.

Verification

• CI green on f062ceb: Backend ✅ · Frontend ✅ · Image — build + dogfood self-scan ✅ (multi-arch check skipped by design on a dev-based PR)
• Backend locally: ruff ✅ · black --check ✅ · gen_env_example --check ✅ · lock-drift recompile idempotent ✅ · pytest 666 passed, 5 skipped on CPython 3.14.6 against the hash-pinned lock ✅
• Frontend locally, after the postcss bump: ESLint ✅ · Prettier ✅ · Vitest 20 files / 69 tests ✅ · npm run build ✅ · npm audit clean of postcss ✅

See docs/ARCHIVE.md § Deviations for the dated entry covering all of the above.