From 555c87f1c5de9c98d6b6e1a35949312fcab686be Mon Sep 17 00:00:00 2001
From: Joe Boccanfuso <109477394+jbocce@users.noreply.github.com>
Date: Mon, 23 Feb 2026 16:26:49 -0500
Subject: [PATCH] chore(security): Updates for running bun audit during CI and
 dependabot PR version update settings (#5836)

chore(security): Update circleci config to only run bun audit for lockfile changes.

Disabled all dependabot pull requests for bun and npm version updates.
---
 .circleci/config.yml     | 15 +++++++++++++--
 .github/.dependabot.yaml |  4 ++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index cfbc48460..6668d1052 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -112,11 +112,22 @@ jobs:
       - checkout
       - attach_workspace:
           at: ~/repo
-      # SECURITY AUDIT
+      # SECURITY AUDIT - only when bun.lock has changed
       - run:
           name: 'Security Audit - High Risk Vulnerabilities'
           command: |
-            echo "🔍 Running bun audit for security vulnerabilities..."
+            git fetch origin master 2>/dev/null || true
+            BASE_REF=$(git merge-base HEAD origin/master 2>/dev/null)
+            if [[ -z "$BASE_REF" ]]; then
+              echo "Could not determine base ref (e.g. shallow clone or no origin/master), skipping security audit."
+              exit 0
+            fi
+            CHANGED_FILES=$(git diff --name-only origin/master...HEAD 2>/dev/null || echo "")
+            if ! echo "$CHANGED_FILES" | grep -qx 'bun.lock'; then
+              echo "⏭️ bun.lock unchanged - skipping security audit."
+              exit 0
+            fi
+            echo "🔍 bun.lock changed - running bun audit for security vulnerabilities..."
             echo "Checking for HIGH-RISK vulnerabilities..."
 
             # Define ignored vulnerabilities with comments
diff --git a/.github/.dependabot.yaml b/.github/.dependabot.yaml
index fb9089fbc..87d5e594b 100644
--- a/.github/.dependabot.yaml
+++ b/.github/.dependabot.yaml
@@ -2,6 +2,8 @@ version: 2
 enable-beta-ecosystems: true
 updates:
   - package-ecosystem: 'bun'
+    # Disable all pull requests for bun version updates.
+    open-pull-requests-limit: 0
     directory: '/'
     schedule:
       interval: 'daily'
@@ -10,6 +12,8 @@ updates:
       prefix: 'chore'
       include: 'scope'
   - package-ecosystem: 'npm'
+    # Disable all pull requests for npm version updates.
+    open-pull-requests-limit: 0
     directory: '/'
     schedule:
       interval: 'daily'