[PresentJay]

I contribute to zero-shelter and tried stream-json's committed npm tree to see whether an occasional HTML advisory snapshot is useful. The saved report found no advisories, so this is an optional reporting proposal rather than evidence of an urgent dependency problem. The change and validation used AI assistance.

Only .github/workflows/dependency-report.yml changes. Dependency triage report runs through workflow_dispatch, with contents: read. It uses npm audit --package-lock-only --ignore-scripts and pinned zero-shelter@0.0.10 to turn the single npm source into HTML retained for 7 days. It installs no project dependencies, runs no project lifecycle scripts and accepts no baseline. Finding exit 1 and judgement-error exit 2 fail the job. The existing stream behavior/type checks and one-runtime-dependency boundary remain unchanged. Node 24 is used only for this report job.

Saved validation at 0f70a661308d recorded 0 raw, 0 merged and 0 outstanding findings; audit, JSON and HTML exited 0. The stored Node 24.3.0 run passed npm run lint, npm test, npm run ts-check and npm run js-check, plus YAML, shell and diff checks. Manifest and lockfile were unchanged. These checks were not rerun for this rewrite; the full supported runtime/OS matrix and new hosted manual run remain unverified.

This uses npm advisory metadata without assessing reachability. Audit sends package/version metadata to the configured registry, and npx downloads and executes third-party CLI code in CI. Read-only repository permissions do not remove that execution boundary.

Would you use a report like this alongside the existing checks? I can withdraw it if it adds another workflow without enough value.

[PresentJay]

I contribute to zero-shelter and proposed an optional HTML snapshot of stream-json's committed npm tree alongside the existing stream behavior and type checks. Would you use this format for an occasional dependency review?

[uhop]

Thank you for the proposal, and for laying out what the report does and what it sends. To answer your question: I would not use it for stream-json right now, so I am going to close this pull request.

The package has one runtime dependency, stream-chain, which I also maintain. Dependabot already watches the npm dependencies and the GitHub Actions here. With so little to triage, I would rarely run a separate report.

I wish you luck with the project!