Main Changes

This GitHub action will add an additional check when a PR is created in the project and will review any change in the dependencies.

This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
Source repository

Overall, this will prevent us from introducing vulnerable dependencies versions without the need to manually check that.

Impact in the OSSF Scorecard

Note that our current score is 10/10, so this is a preventive measurement.

Context

• Ref: Implementing OSSF Scorecard expressjs/security-wg#2
• Report: https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/jshttp/statuses/commit/454ceb6e0bfea4f889be244de2538df8afb4dc2a