| name | security-scan |
| description | Scan for vulnerable dependencies and CVEs via pnpm lint:security (Trunk Trivy/OSV-scanner), optional pnpm security:grype or pnpm lint:all (Trunk-all plus Grype). Use for dependency CVE checks, security-scoped lint, or post-bump verification. |
| compatibility | Node and pnpm versions per `.node-version` and root `package.json` `engines`; run `pnpm install` from repo root. Run `pnpm exec trunk install` if Trunk-managed linters are missing (see AGENTS.md). `grype` must be on PATH for `pnpm security:grype` and the Grype step in `pnpm lint:all`. |
Security scan: vulnerable dependencies
Purpose
Filesystem and dependency vulnerability checks for this TypeScript monorepo:
pnpm lint:security — trunk check --all --scope security (Trivy, OSV-scanner, and other security-scoped linters in .trunk/trunk.yaml).pnpm security:grype — Anchore Grype on the repo root (grype on PATH; not installed via pnpm — see knip.json ignoreBinaries).pnpm lint:all (optional, slower) — full Trunk check across all files, then Grype — CI-style thoroughness.
Default incremental Trunk: pnpm lint (trunk check -y). Prefer pnpm lint:security when the goal is vulnerability scanning.
See AGENTS.md for the layered harness (for example ESLint with eslint-plugin-security alongside Trivy/OSV).
CodeQL vs dependency scan (do not conflate)
Two independent security gates; each has its own pass/fail:
| Gate | Command | Skill |
|---|
| Dependencies | pnpm lint:security | This skill (OSV-scanner, Trivy via Trunk) |
| Source code | pnpm run codeql:local | codeql-fix |
- This skill scans the lockfile and related manifests for known CVEs—not application logic.
- CodeQL runs query suites on JavaScript/TypeScript source; clean SARIF does not mean the lockfile is CVE-free.
- Verifier order: build → lint → test → security-scan → codeql-fix; treat each phase separately.
Example: CodeQL can report zero findings while pnpm lint:security still fails on a transitive dependency (for example brace-expansion).
When to use
- Scan for CVEs or vulnerable dependencies
- Third-party / supply-chain review
- After dependency bumps: root and workspace
package.json files, pnpm-lock.yaml, and root package.json pnpm.overrides when triaging transitive issues
How to run
From the repository root:
pnpm lint:security
pnpm security:grype
Thorough pass (Trunk-all plus Grype):
pnpm lint:all
If Trunk tools are missing: pnpm exec trunk install per AGENTS.md.
Debugging parity: pnpm security:grype matches grype .. For Trivy/OSV, prefer pnpm lint:security so versions match Trunk; use standalone CLIs only when reproducing or debugging outside Trunk.
Fix loop
- Identify: Parse tool output; note affected manifests (
pnpm-lock.yaml, root or packages/*/package.json) and CVE IDs.
- Triage: Direct versus transitive dependencies; confirm reachability when prioritizing.
- Fix: Prefer
pnpm up, targeted pnpm add, or root pnpm.overrides when appropriate; run pnpm install after lockfile changes so scans match what you ship.
- Verify: Re-run
pnpm lint:security and pnpm security:grype (or pnpm lint:all) until clean or remaining issues are accepted with rationale.
Termination
- Checks exit zero with no actionable findings, or
- Residual risk is explicitly accepted, or
- Stop after a sensible iteration cap (default: 3) and summarize blockers.
Related commands (repo)
pnpm lint — default Trunk checkpnpm lint:security — security-scoped Trunk (Trivy/OSV and related linters)- CodeQL: codeql-fix when CodeQL is configured for this repo
- Workspace and bumps:
AGENTS.md (pnpm workspace) and CLAUDE.md for agent-specific workflows
