[UlisesGascon]

Main Changes

This GitHub action will add an additional check when a PR is created in the project and will review any change in the dependencies (cda07fd).

This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
Source repository

Overall, this will prevent us to introduce vulnerable dependencies versions without the need to manually check that.

Impact in the OSSF Scorecard

Note that our current score is 10/10, so this is a preventive measurement.

Context

• Ref: Implementing OSSF Scorecard security-wg#2
• Report: https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/expressjs/express/commit/2a00da2067b7017f769c9100205a2a5f267a884b

Changelog

• cda07fd chore: add dependency review tool by @UlisesGascon

[inigomarquinez]

Suggested latest versions of pinned dependencies

[inigomarquinez]

Suggested change

	uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
	uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

[inigomarquinez]

Suggested change

	uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
	uses: actions/dependency-review-action@9129d7d40b8c12c1ed0f60400d00c92d437adcce # v4.1.3

[wesleytodd]

I would strongly prefer we use Socket if these two are things which overlap (which I think there is). I was going to start a thread about this but with all the moving parts I had not had a chance yet. Am I wrong that there is overlap and that Socket would provide the same things we want out of this (and way more)?

[UlisesGascon]

As we use Socket already at org level, we can close this :)