jethac opened a new issue, #42990: URL: https://github.com/apache/superset/issues/42990
### Problem No workflow performs a scheduled advisory or malware scan across the dependency surface — nothing in `.github/workflows/` matches advisory, malware, supply-chain or OSV. Dependabot opens PRs when a fixed version exists. It does not tell you that a package already in the lockfile has just been flagged as malicious with no fix available, which is the shape of every recent npm worm incident. Between merges, the repository has no signal at all. ### Proposed change A nightly job that queries OSV (or equivalent) across both the Python and npm surfaces and **fails only on malware-class advisories**, staying quiet for ordinary vulnerabilities that Dependabot already handles. Failing on everything would produce a permanently red nightly and get ignored within a week; failing only on "this package is malicious" is a signal worth waking up to. Verified against `master` at `3539c41dab`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
