# Triage 36 Dependabot findings (2 critical, 15 high) — 2026-07-08

GitHub reported 36 open vulnerabilities on main at push time (github.com/bex-co/bex/security/dependabot): 2 critical, 15 high, 15 moderate, 4 low. Triage which ecosystems (likely dashboard npm transitives vs Go modules), whether the criticals are reachable, and batch the upgrades. Triage is sub-hour; promote to a milestone only if the fixes need breaking upgrades.

Source: `git push` output, 2026-07-08. Goal: prod hardening hygiene (w1/m7 theme).
