Add dependency risk review report under docs/security [S2BMQ4R]

[cameronnewman]

The whole branch diff against main is one added file. Work is complete and pushed.

Summary

Adds docs/security/DEPENDENCY-RISK.md, a dependency risk review covering every manifest in the repo. go.mod is the only conventional manifest, so the review also inventories the third-party code declared inline in .github/workflows/ci.yml, action.yml, and .goreleaser.yaml — Go tools, GitHub Actions, an npm package, and a container image — because those execute with repository credentials. 12 direct dependencies are rated: 0 Critical, 1 High, 3 Medium, 8 Low. Three findings are called out at the top of the report.

Urgent findings

• The GoReleaser CLI is the one unpinned third-party executable (version: "~> v2", .github/workflows/ci.yml:179 and :245), floating to the latest v2.x in the two jobs holding contents: write that publish consumer-downloaded binaries. Everything else in the repo is SHA-, tag-, or digest-pinned. Rated High.
• markdownlint-cli2@0.18.1 hard-pins js-yaml 4.1.0 and markdown-it 14.1.0 as exact versions, so npm cannot resolve away six advisories (2 High, CVSS 7.5). Bumping to 0.23.2 clears all six — verified by auditing a resolved 0.23.2 tree.
• go 1.26.0 admits a toolchain with six symbol-reachable stdlib advisories (4× html/template XSS via render.HTML, encoding/xml recursion via both parsers). Not a CI or release exposure — every build path floats go-version: "1.26" to go1.26.7 — so it's rated Medium, not High.

Two checks de-escalated rather than escalated: all four GitHub Actions SHA pins were verified against their upstream tag objects (all match, all latest), and the aquasec/trivy digest matches the official 0.72.0 manifest in the registry, which bounds the open GO-2026-4919 supply-chain advisory that OSV matches to that version.

Changes

• docs/security/DEPENDENCY-RISK.md — new. Summary (per-ecosystem totals, risk counts, tools and versions, date), a seven-column table per ecosystem, a subsection per Medium-and-above dependency with reasoning, call sites, and a recommended action, plus full evidence for the Low-rated ones and a method/limitations note. Reachability is marked verified only for Go and unverified everywhere else.

Validation

• govulncheck ./... (v1.7.0, DB 2026-08-21) — 6 symbol-reachable, 5 imported-not-called, 22 required-not-imported, all stdlib.
• npm audit on a --package-lock-only tree for markdownlint-cli2@0.18.1 — 1 high, 2 moderate groups; the same for 0.23.2 — zero.
• npx --yes markdownlint-cli2@0.18.1 (the repo's own pinned linter) — Summary: 0 error(s) across 16 files.
• Every cited file:line was checked against the file with sed -n; six citations had drifted and were corrected.
• git diff --name-status main...HEAD — a single A entry.

Not verified: CI was not waited on. I expect build, security-scan, lint, and release to run; nothing is known red.

---

Ergates task: 06G3EKQ8AZC7MTAD3KNS2BMQ4R

[greptile-apps]

Greptile Summary

The PR adds a comprehensive dependency-risk report covering repository-managed Go, npm, GitHub Actions, CI tools, and container dependencies.

• Inventories 12 direct dependencies and their API or CLI usage.
• Documents version age, vulnerabilities, maintenance signals, reachability limitations, and risk ratings.
• Prioritizes exact GoReleaser pinning, a markdownlint-cli2 upgrade, and a higher Go toolchain patch floor.

Confidence Score: 5/5

The documentation-only PR appears safe to merge, with no concrete inaccuracies or CI failures identified.

The report accurately reflects the repository-managed dependency declarations and relevant code paths, explicitly distinguishes verified from unverified reachability, and complies with the applicable Markdown lint configuration.

_{Reviews (1): Last reviewed commit: "docs(deps): dependency risk review for t..." | Re-trigger Greptile}