[PresentJay]

Why this helps

Four workflows test Node22/24/26+Bun+Deno, handle changesets and publish. No dependency advisory report; zero runtime and12 dev direct dependencies.

Optional npm toolchain inventory adds advisory context to compatibility tests. Explicitly exclude bun.lock and deno.lock from npm-only scan claims. Package metadata declares zero regular runtime dependencies; this inventory is explicitly about the locked development/optional toolchain.

Change

Adds a separate manual-only Dependency triage report workflow. Maintainers can request a ranked HTML snapshot from the Actions tab. The workflow reads the committed npm lock using npm audit --package-lock-only --ignore-scripts, then feeds the completed JSON into pinned zero-shelter@0.0.10. It uploads the HTML for seven days and requests only contents: read.

Existing validation, security and publishing workflows stay intact. Findings retain exit 1; scanner/judgement errors retain exit 2. The report therefore cannot turn a failed scan into a clean result or accept existing findings into a baseline. There is no automatic schedule or new pull-request gate.

Observed validation

• Upstream base: f46b5575f726 (main).
• Active lockfile consumer: test.yml Node jobs and release.yml run npm ci.
• In this checkout, completed npm input produced 0 raw / 0 merged / 0 outstanding / 0 accepted findings. npm audit exited 0; the published CLI returned 0 for JSON and 0 for HTML.
• A synthetic failed-scanner JSON returned 2.
• The workflow parses as YAML; both shell blocks pass bash -n; git diff --check passes. Manifest and lockfile SHA-256 hashes match before and after the scan.

Unverified: the hosted Actions run and the existing application test/build matrix. This change adds one workflow only and was tested against the actual committed lockfile without installing the application. The report covers npm dependency advisories; it does not establish exploitability, reachability or complete project security. generate-changeset.yml skips fork PRs via head.repo.full_name==github.repository. Do not add a package changeset for CI-only work without maintainer direction; no template mandates one was found.

Network/data: npm audit queries the configured npm advisory service, and npx downloads the pinned public CLI. The artifact contains dependency report metadata; no account/API secrets or application data are needed.

Disclosure

I contribute to zero-shelter. This implementation, validation and PR description were prepared with AI assistance. This is an optional maintainer-tooling proposal; no dependency upgrade or risk acceptance is included.

[rexxars]

No thanks, I don't see this benefiting the project. The project has zero (production) dependencies. If anything this just adds another vector.