Security: triage Dependabot vulnerabilities before promotion

[Traky12]

GitHub reported 115 vulnerabilities on the default branch (2 critical, 32 high, 60 moderate, 21 low) during the architecture-governance publication.

Required Gate before production or template promotion:

• Review Dependabot alerts and classify false positives.
• Upgrade or pin vulnerable dependencies.
• Re-run CI/security workflows.
• Record residual risk and owner.

This repository remains a testing/template asset until the security Gate is closed.

[Traky12]

CASTÚO governance update — 2026-08-18

Scope: Dependabot and supply-chain triage before promotion.

The open Dependabot PR queue remains an actionable security workstream. Each PR must be evaluated through its own checks, compatibility impact, reviewer approval and merge/revert record. The local dashboard dependency scan reports advisories=0 only for its declared dependency tree; it does not close this repository's remote findings.

Exit criteria: every applicable Dependabot PR is merged or explicitly dispositioned; checks and security workflows are green; issue history records the decision; the protected main branch is rechecked through the remote security gate.

Owner: repository owner plus security reviewer.

Rollback: revert through a new PR if a dependency update breaks tests, runtime or policy; retain the issue open until the remote evidence is attached.

Claim boundary: no zero-vulnerability, production-security or maturity claim is promoted from local scans alone.