chore: harden npm supply chain controls (#11157)

ui/AGENTS.md

@@ -226,5 +226,6 @@ pnpm run test:e2e:ui
 - [ ] Relevant E2E tests pass
 - [ ] All UI states handled (loading, error, empty)
 - [ ] No secrets in code (use `.env.local`)
+- [ ] New npm dependencies include package-health evidence (maintenance, popularity, known vulnerabilities, license, release age) and a rationale for not using existing/native alternatives.
 - [ ] Error messages sanitized
 - [ ] Server-side validation present

ui/components/shadcn/README.md

@@ -109,10 +109,10 @@ export function MyComponent() {
 
 ## Adding New shadcn Components
 
-When adding new shadcn components using the CLI:
+When adding new shadcn components using the CLI, pin the reviewed CLI version instead of using `@latest`:
 
 ```bash
-npx shadcn@latest add [component-name]
+pnpm dlx shadcn@4.7.0 add [component-name]
 ```
 
 The component will be automatically added to this directory due to the configuration in `components.json`:

ui/package.json

@@ -28,6 +28,8 @@
     "test:e2e:headed": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --headed",
     "test:e2e:report": "playwright show-report",
     "test:e2e:install": "playwright install",
+    "audit": "pnpm audit --audit-level critical",
+    "audit:high": "pnpm audit --audit-level high",
     "audit:fix": "pnpm audit fix"
   },
   "dependencies": {

ui/pnpm-workspace.yaml

@@ -14,20 +14,21 @@ minimumReleaseAge: 1440
 
 # --- Level 2: Explicit Build Script Allow-list ---
 # Only these packages may run install/postinstall lifecycle scripts.
-# Any unlisted package with lifecycle scripts will have them silently skipped.
-onlyBuiltDependencies:
+# Any unlisted package with lifecycle scripts fails the install.
+strictDepBuilds: true
+allowBuilds:
   # sharp: Native image processing (libvips). Installs platform-specific pre-built binary or compiles from source.
-  - sharp
+  sharp: true
   # @sentry/cli: Downloads the sentry-cli native binary for the current platform. Validates integrity via SHA256.
-  - "@sentry/cli"
+  "@sentry/cli": true
   # esbuild: Go binary. Downloads the pre-compiled binary matching the current platform/architecture.
-  - esbuild
+  esbuild: true
   # @heroui/shared-utils: Demi pattern — detects React/Next.js version at install time and copies the compatible bundle (React 18 vs 19).
-  - "@heroui/shared-utils"
+  "@heroui/shared-utils": true
   # unrs-resolver: Rust module resolver (NAPI-RS). Verifies the correct native binding is available for the platform.
-  - unrs-resolver
+  unrs-resolver: true
   # msw: Copies mockServiceWorker.js into the directories listed in package.json's `msw.workerDirectory` (here: `public/`) so the runtime worker stays in sync with the installed msw version. Pure file copy — no native binary, no network access. Required for vitest browser tests to intercept fetches via the service worker.
-  - msw
+  msw: true
 
 # --- Level 3: Trust Policy + Exotic Subdeps ---
 # Fail when a package's trust evidence is downgraded (e.g., new publisher).