chore(deps): bump the routine-updates group across 1 directory with 9 updates

.github/workflows/build.yaml

@@ -23,6 +23,9 @@ jobs:
       - name: Audit dependencies
         run: bun run security:audit
 
+      - name: Check security overrides
+        run: bun run security:overrides
+
       - name: Run lint
         run: bun run check
 

.github/workflows/dependency-security.yaml

@@ -7,7 +7,8 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
 
 concurrency:
   group: dependency-security
@@ -20,6 +21,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -30,3 +33,56 @@ jobs:
 
       - name: Audit high and critical vulnerabilities
         run: bun run security:audit
+
+      - name: Prune redundant security overrides
+        run: bun run security:overrides --write
+
+      - name: Detect override cleanup
+        id: cleanup
+        run: |
+          if git diff --quiet -- package.json bun.lock; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Validate override cleanup
+        if: steps.cleanup.outputs.changed == 'true'
+        run: |
+          bun install --frozen-lockfile
+          bun run security:audit
+          bun run check
+          bun run test
+          bun run build
+
+      - name: Open or update override cleanup pull request
+        if: steps.cleanup.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          prune_branch="automation/prune-security-overrides"
+          default_branch="${{ github.event.repository.default_branch }}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -c "$prune_branch"
+          git add package.json bun.lock
+          git commit -m "chore(deps): prune redundant security overrides"
+
+          git fetch origin \
+            "$prune_branch:refs/remotes/origin/$prune_branch" || true
+          git push --force-with-lease origin "HEAD:$prune_branch"
+
+          existing_pr=$(gh pr list \
+            --head "$prune_branch" \
+            --state open \
+            --json number \
+            --jq '.[0].number // empty')
+
+          if [ -z "$existing_pr" ]; then
+            gh pr create \
+              --base "$default_branch" \
+              --head "$prune_branch" \
+              --title "chore(deps): prune redundant security overrides" \
+              --body "Removes security overrides that are no longer needed by the resolved dependency graph. Generated by the weekly dependency security workflow after audit, checks, tests, and build passed."
+          fi