Dependency Vulnerability Management for Next.js

The full executive answer

Four automated layers, all visible in the repository. First, Dependabot — GitHub's automated dependency updater — runs weekly, opening pull requests for security patches; safe minor updates are grouped for fast merging while major version changes arrive individually so each is assessed on its own. Second, every pull request passes a dependency-review gate that flags newly introduced vulnerable packages before they can merge. Third, npm audit runs in the Security workflow with a hard rule: any CRITICAL-severity advisory in a production dependency blocks the pipeline; HIGH-severity advisories are reported for triage. Fourth, CodeQL static analysis scans our own code on every push.

Supply-chain integrity is handled separately from vulnerability scanning: the dependency lockfile is integrity-checked on every CI run (npm ci fails on any tampering or drift), and we generate a CycloneDX Software Bill of Materials — a complete ingredients list of every package and version — on every build, with cryptographic build-provenance attestation via GitHub's attestation API. That means we can answer "were you exposed to package X?" in minutes, which is exactly the question everyone failed during incidents like log4shell. We self-assess at SLSA Level 2 on the supply-chain maturity ladder.

The honest nuance: the audit step in the main CI pipeline is advisory, with the blocking enforcement living in the dedicated Security workflow at CRITICAL level — a deliberate triage threshold so a low-risk advisory in a dev tool can't freeze shipping. As we approach enterprise launch we plan to ratchet the blocking threshold from CRITICAL to HIGH in production dependencies, targeted alongside the SOC 2 readiness work in Q4 2026.