dependency-cve-gate

A differential CVE gate fails only on advisories your change introduces, so first check whether the flagged dependency was added or bumped by your pull request. Upgrade the dependency if possible; otherwise add an ignore entry with the advisory id, a reason, and an ignoreUntil date, landed before the dependency change.

Use a single [[IgnoredVulns]] table with three mandatory fields: the advisory id exactly as the scanner reports it, a reason explaining acceptance and what unblocks the fix, and an ignoreUntil re-triage date as a bare TOML local date. All other tables and top-level keys are rejected.

Exit 127 occurs when the rendered effective policy is invalid TOML, typically because a reason containing a double quote was emitted unescaped. Values must be escaped when the effective policy is rendered so the scanner receives parseable TOML.

An absolute baseline fails on the existing backlog from day one, and new advisories against untouched code keep unrelated pull requests red, teaching reviewers to ignore the check. Differential scanning points authors at the risk their own dependency change introduced, while a separate advisory census tracks the backlog.

Extending an expiry takes effect immediately because the gate reads ignoreUntil from the working tree, so it is not blocked by the intersection rule. Treat a later ignoreUntil like a new entry requiring review scrutiny; upgrading the dependency remains the correct fix.

This gate covers dependency vulnerability scanning only, not license policy, lockfile-provenance checks, or application-code SAST. It also does not apply to repository shapes without a wired dependency-CVE workflow, such as a plain React SPA or a Storybook-first component library.