From a5e5face2c1612160a50df3d260eae21efd9e5d2 Mon Sep 17 00:00:00 2001
From: Anne Beth Andersen <195699472+abla86@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:25:05 +0200
Subject: [PATCH 1/2] chore(security): configure dependency updates

---
 .github/dependabot.yml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 99b0c21..6653ed6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,12 +1,17 @@
 version: 2
 updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule: { interval: "weekly" }
+    open-pull-requests-limit: 10
+    labels: ["security","github-actions"]
   - package-ecosystem: "npm"
     directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-  - package-ecosystem: "github-actions"
+    schedule: { interval: "weekly" }
+    open-pull-requests-limit: 10
+    labels: ["security","dependencies"]
+  - package-ecosystem: "pip"
     directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
+    schedule: { interval: "weekly" }
+    open-pull-requests-limit: 10
+    labels: ["security","dependencies"]

From 54ea9d6bd985f8c00d32836d00b9a5e69d3ac67d Mon Sep 17 00:00:00 2001
From: Anne Beth Andersen <195699472+abla86@users.noreply.github.com>
Date: Tue, 29 Sep 2026 20:25:08 +0200
Subject: [PATCH 2/2] ci(security): add dependency audit

---
 .../workflows/security-dependency-audit.yml   | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/security-dependency-audit.yml

diff --git a/.github/workflows/security-dependency-audit.yml b/.github/workflows/security-dependency-audit.yml
new file mode 100644
index 0000000..4576693
--- /dev/null
+++ b/.github/workflows/security-dependency-audit.yml
@@ -0,0 +1,27 @@
+name: Security Dependency Audit
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+permissions:
+  contents: read
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - name: Audit npm projects
+        shell: bash
+        run: |
+          set -euo pipefail
+          found=0
+          while IFS= read -r package; do
+            found=1
+            dir="$(dirname "$package")"
+            npm install --package-lock-only --ignore-scripts --no-audit --prefix "$dir"
+            npm audit --audit-level=high --prefix "$dir"
+          done < <(find . -name package.json -not -path '*/node_modules/*' -not -path './.git/*' -print)
+          [ "$found" -eq 0 ] && echo "No npm projects found."