[TEST — do not merge] Verify CI security gates block a seeded critical CVE

[WolfTasks]

Throwaway verification PR for issue #5 — deliberately adds lodash@4.17.11 (GHSA-jf85-cpcp-j695 prototype pollution, critical) to confirm the security gates actually block.

Expected: frontend-build (npm audit) RED and dependency-review RED. Will be closed without merge and the branch deleted once confirmed.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

frontend/package-lock.json

Name	Version	Vulnerability	Severity
lodash	4.17.11	Prototype Pollution in lodash	critical
		Command Injection in lodash	high
		Prototype Pollution in lodash	high
		lodash vulnerable to Code Injection via `_.template` imports key names	high

Only included vulnerabilities with severity high or higher.

OpenSSF Scorecard

Package	Version	Score	Details
npm/lodash	4.17.11	🟢 7.2	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration CI-Tests 🟢 8 22 out of 25 merged PRs checked by a CI test -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 7 Found 22/30 approved changesets -- score normalized to 7 Contributors 🟢 10 project has 90 contributing companies or organizations Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing 🟢 10 project is fuzzed License 🟢 9 license file detected Maintained 🟢 10 9 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Vulnerabilities ⚠️ 0 104 existing vulnerabilities detected

Scanned Files

• frontend/package-lock.json