---
id: w1/m23/t002
title: Triage the 36 Dependabot findings; batch safe upgrades
worker: worker1
status: todo
estimate: 45m
depends_on: []
---

## Objective

Triage the 36 open Dependabot vulnerabilities (2 critical, 15 high, 15 moderate, 4 low) reported on main: identify ecosystems, judge whether the criticals are reachable, and batch the safe upgrades. Promote to a milestone only if fixes need breaking upgrades.

## Context

- Source: `git push` output 2026-07-08 (github.com/bex-co/bex/security/dependabot).
- Likely split: dashboard npm transitives vs Go modules.
- Goal: prod hardening hygiene (w1/m7 theme).

## Steps

1. Pull the current Dependabot list (`gh api` / the security tab); group by ecosystem + severity.
2. For the 2 criticals, assess reachability in bex's code paths.
3. Batch non-breaking upgrades (`go get -u` / npm bumps) and open the PR(s); file a follow-up note for anything needing a breaking major bump.

## Files

- `lego/**/go.mod`/`go.sum`, `dashboard/package.json`/lockfile (as triage dictates)

## Acceptance criteria

- [ ] Findings triaged with ecosystem + criticals-reachability recorded; safe upgrades batched; residual breaking bumps captured as a note.
- [ ] Builds/tests green after the batched upgrades.

## Out of scope

- Breaking major-version upgrades (defer to a follow-up if needed).
