fix: restore copyleft enforcement in dependency review

[depalmar]

Summary

• restore explicit copyleft license enforcement for dependency review
• keep deny-licenses: GPL-3.0, AGPL-3.0 as an interim control despite upstream deprecation
• clarify migration intent in workflow comments (track replacement before dependency-review-action v5)

Why this change

A prior edit removed deny-licenses without a replacement enforcement mechanism in this repo, creating a license-policy gap. This PR closes that gap by restoring enforcement.

Test plan

• Confirm .github/workflows/dependency-review.yml includes deny-licenses: GPL-3.0, AGPL-3.0
• Confirm Dependency Review job still runs and reports results on PRs
• Follow-up: design and adopt non-deprecated replacement policy before v5

---

Note

Low Risk
Workflow-only change that updates dependency review configuration comments and keeps an interim license denylist; no runtime or application code impact.

Overview
Updates the GitHub Actions Dependency Review workflow to explicitly document interim copyleft license enforcement by keeping deny-licenses: GPL-3.0, AGPL-3.0 and noting the upstream deprecation/migration intent before dependency-review-action v5.

^{Written by Cursor Bugbot for commit 0f7bb42. This will update automatically on new commits. Configure here.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[cursor]

Stale comment

Security review for PR #245:

No high-confidence vulnerabilities found in this diff.

What changed:

• .github/workflows/dependency-review.yml removes the deprecated deny-licenses input and keeps fail-on-severity: high vulnerability blocking enabled.

Threat-focused assessment:

• Injection/auth/authz/secrets/deserialization/SSRF/XSS/CSRF: no application code or runtime behavior changes in this PR.
• Dependency/supply-chain security: vulnerability scanning gate remains active (fail-on-severity: high).

Low-confidence concern (policy/compliance, not a confirmed security vulnerability):

• Removing deny-licenses weakens license-policy enforcement in this workflow. This is primarily legal/compliance risk rather than a direct exploit path.
• If license restrictions are required, enforce them in a dedicated license-scanning workflow/tool and make it required in branch protection.

Security result: pass (no confirmed exploitable vulnerability introduced/exposed by this PR).

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Security review completed for this PR.

Result

No high-confidence vulnerabilities found in the submitted diff.

Evidence

• The diff only changes .github/workflows/dependency-review.yml.
• fail-on-severity: high remains enabled, so vulnerable dependency blocking behavior is preserved.
• The action pin (actions/dependency-review-action commit SHA) is unchanged.
• The removed setting (deny-licenses) is a deprecated license-policy control, not an injection/auth/secrets/SSRF/XSS primitive.

Low-confidence / validation-needed concern

• Removing deny-licenses may reduce license compliance enforcement if there is no replacement workflow.
• This is primarily governance/compliance risk, not a direct exploitable security vulnerability.

Remediation guidance

• If license policy enforcement is required, add a dedicated license scanning workflow/tool (separate from dependency vulnerability scanning) to keep equivalent policy coverage while avoiding deprecated inputs.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: PR claims to remove deny-licenses but keeps it
  • Removed the deny-licenses option from the workflow to match the PR's stated intent, as a later commit had erroneously restored it.

Or push these changes by commenting:

@cursor push 75717c339c

Preview (75717c339c)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -25,8 +25,8 @@
         with:
           # Fail on high and critical vulnerabilities
           fail-on-severity: high
-          # Enforce copyleft denylist until a dedicated replacement policy is added.
-          # NOTE: `deny-licenses` is deprecated upstream; track migration before v5.
-          deny-licenses: GPL-3.0, AGPL-3.0
+          # NOTE: `deny-licenses` is deprecated in dependency-review-action and may be
+          # removed in a future major release. Keep vulnerability checks enabled and
+          # rely on dedicated license policy tooling/workflows for enforcement.
           # Comment on PR with results
           comment-summary-in-pr: always

[cursor]

Stale comment

Security review completed for this PR.

Result: No high-confidence vulnerabilities found in the introduced changes.

Findings (prioritized)

• None.

Notes

• The diff is limited to comments in .github/workflows/dependency-review.yml; no executable workflow logic, permissions, action versions, or inputs were changed.
• Residual risk to track separately: deny-licenses is marked deprecated upstream, so future migration planning remains important to avoid policy drift when upgrading the action.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Security review complete for PR #245.

Result: No high-confidence vulnerabilities found in this diff.

Confirmed findings (prioritized):

1. None.

Uncertain / watch items (requires validation):

1. dependency-review.yml still relies on deny-licenses, which is noted as deprecated. This PR does not change runtime behavior, but if the upstream action removes support in a future major release, copyleft enforcement could silently weaken (supply-chain policy bypass risk).

Recommended remediation:

1. Pin and monitor the dependency-review action major version.
2. Add a migration task/test that fails CI if copyleft denylist enforcement stops working after action upgrades.

Given the current diff, security posture is unchanged and no exploitable issue is introduced.

  

_{Sent by Cursor Automation: Find vulnerabilities}