From e7850f843bd099433746390ec348331b30fd3c30 Mon Sep 17 00:00:00 2001
From: Lance Pioch <git@lance.sh>
Date: Sat, 12 Sep 2026 14:57:58 -0400
Subject: [PATCH 1/3] Add Dependabot, security-audit CI, and refresh
 SECURITY.md

---
 .github/dependabot.yml                | 26 +++++++++++++++++++
 .github/workflows/security-audit.yaml | 36 +++++++++++++++++++++++++++
 security.md                           |  2 +-
 3 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/security-audit.yaml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..43e1e1f97d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      composer:
+        patterns:
+          - "*"
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      npm:
+        patterns:
+          - "*"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/security-audit.yaml b/.github/workflows/security-audit.yaml
new file mode 100644
index 0000000000..56e9342517
--- /dev/null
+++ b/.github/workflows/security-audit.yaml
@@ -0,0 +1,36 @@
+name: Security Audit
+
+on:
+  pull_request:
+    branches:
+      - "**"
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  composer-audit:
+    name: Composer Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Code Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.5"
+          tools: composer:v2
+          coverage: none
+
+      - name: Composer Audit
+        run: composer audit --no-interaction
+
+  yarn-audit:
+    name: Yarn Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Code Checkout
+        uses: actions/checkout@v6
+
+      - name: Yarn Audit
+        run: yarn audit --level high
diff --git a/security.md b/security.md
index b361cf30c3..4b2e8d758e 100644
--- a/security.md
+++ b/security.md
@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-While Pelican is in beta, we only provide security fixes for the most recent beta release. Older beta releases are unsupported.  
+We only provide security fixes for the most recent release. Older releases are unsupported; upgrade to receive fixes.  
 ![](https://img.shields.io/github/v/release/pelican/panel?label=latest-release)
 
 ## Reporting a Vulnerability

From 5939ffb3e1586b39d0c1a9ebf0c03332a6806165 Mon Sep 17 00:00:00 2001
From: Lance Pioch <git@lance.sh>
Date: Sat, 12 Sep 2026 15:13:40 -0400
Subject: [PATCH 2/3] Audit the lock file instead of requiring an install

---
 .github/workflows/security-audit.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security-audit.yaml b/.github/workflows/security-audit.yaml
index 56e9342517..5289484bf8 100644
--- a/.github/workflows/security-audit.yaml
+++ b/.github/workflows/security-audit.yaml
@@ -23,7 +23,7 @@ jobs:
           coverage: none
 
       - name: Composer Audit
-        run: composer audit --no-interaction
+        run: composer audit --locked --no-interaction
 
   yarn-audit:
     name: Yarn Audit

From 43af70452323e312350124e0932e923414069b45 Mon Sep 17 00:00:00 2001
From: Lance Pioch <git@lance.sh>
Date: Sat, 12 Sep 2026 15:36:23 -0400
Subject: [PATCH 3/3] Fail yarn audit only on high or critical advisories

---
 .github/workflows/security-audit.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/security-audit.yaml b/.github/workflows/security-audit.yaml
index 5289484bf8..3257ea6582 100644
--- a/.github/workflows/security-audit.yaml
+++ b/.github/workflows/security-audit.yaml
@@ -33,4 +33,8 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Yarn Audit
-        run: yarn audit --level high
+        # Yarn classic's exit code is a bitmask (8 = high, 16 = critical);
+        # --level only filters the output, so mask the code to match it.
+        run: |
+          yarn audit --level high || code=$?
+          exit $(( ${code:-0} & 24 ? 1 : 0 ))