[groupthinking]

Closes #2476

Summary

• Compare the exact pull request base and head dependency inputs. For supported lockfile changes, submit focused snapshots for both revisions with the same scope and correlator.
• For the root npm lockfile, include declared workspace manifests in both snapshots. If any changed npm manifest is not covered by a changed lockfile, use the full scan.
• Keep the full-tree scan for mixed or unsupported dependency changes and pushes to main. Bound each Python requirements report to 120 seconds on that path so one file cannot consume the entire ten-minute job. If a report times out, Component Detection falls back to declared dependencies for that file, so its transitive graph can be incomplete.
• Preserve the current severity and license policy and the evidence capture merged into main by fix: bootstrap image security remediation with retained evidence #2409.

Paths changed

• .github/workflows/dependency-review.yml
• tests/unit/test_dependency_review_workflow.py

Validation

• uv run --no-project --with pytest --with pyyaml python -m pytest -q -o addopts='' tests/unit/test_dependency_review_workflow.py — 14 passed after integrating latest main.
• Ruff lint and format checks, plus git diff --check — passed.
• Hosted dependency review on head 24c8711 — passed, with no snapshot warning or dependency changes for this workflow/test-only diff.
• Current head 2485239 contains the full-scan time bound. All hosted pull request checks on this exact head have passed. The main push full-scan path has not been verified with this change.

Once this repair reaches main, rerun dependency review on #2464 and #2465 before treating either as merge ready.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Oct 28, 2026 8:03am UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: groupthinking/EventRelay
• Branch: codex/dependabot-issue-gate
• File: .coderabbit.yaml
• Commit: 2485239
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a7601bc9-ba24-4c41-8a97-b507d9d9ae12

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

🟡 Changes recommended

The dependency-review workflow compares mismatched base and head scan scopes and omits workspace and SDK dependency roots, producing false dependency changes and incomplete dependency graphs.

3 open issues

• Require staged lockfiles to cover every changed manifest · New
• Include all workspace roots in root lockfile graph generation · New
• Match base and head scan inputs and detector settings · New

What changed in this PR

This PR aims to prevent dependency-review timeouts on lockfile updates such as #2464 and #2465 by limiting snapshot scans to relevant dependency inputs.

Changes:

• Adds focused staging and snapshot submission for root uv lockfile and npm lockfile-pair changes.
• Retains full scans for mixed or unsupported dependency inputs and pushes to main, without changing severity or license policy.
• Adds regression tests for scan selection and staging, including exercising both ecosystems when the workflow changes.

File	Description
tests/​unit/​test_dependency_review_workflow.py	Tests focused scan selection, staged files, and fallback conditions.
.github/​workflows/​dependency-review.yml	Adds focused dependency snapshots alongside the existing full-scan path.

_{Review effort: Balanced}

[linear-code]

GRV-849