[warengonzaga]

Summary

Promotes the Discord bot's dependency, runtime, and CI updates from dev to main:

• Pin Build Flow Action v1.0.0 to its verified commit and skip licensed Gitleaks only on Dependabot pull requests.
• Pin the container to Node.js 26.12.1 on Alpine 3.24.
• Update discord.js, dotenv, Express, PostgreSQL, Redis, Biome, Bun and Node.js types, and esbuild.
• Keep package.json and bun.lock synchronized.

No application source files are changed.

Validation

The current PR Build Flow, dev push Build Flow, and Code Quality runs passed:

• PR Build Flow
• dev push Build Flow
• Code Quality
• Snyk status

The prior description noted critical proxy-addr and high undici findings from a container scan. This update pins proxy-addr to 2.0.8; confirm the latest image scan for any remaining finding before merge.

This release promotion has not been merged.

[Copilot]

Copilot review overview

🟢 Approval recommended

The commit matches v0.3.1, and the identical dev revision completed the workflow successfully.

Review effort: Balanced
Findings: None

What changed in this PR

Promotes Build Flow v0.3.1 to main using its exact release commit.

Changes:

• Replaces the v0.2.1 tag with the verified v0.3.1 commit SHA.
• Ensures nested workflows resolve from the same pinned revision.

File	Description
.github/​workflows/​build-flow.yml	Pins Build Flow to the v0.3.1 release commit.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🛠️ Container Build Complete - Dev Build

Build Status: ✅ Success
Flow Type: dev
Description: Development and testing

---

📦 Pull Image

Docker Hub: docker pull wgtechlabs/unthread-discord-bot:dev-95c79bc

GHCR: docker pull ghcr.io/wgtechlabs/unthread-discord-bot:dev-95c79bc

---

📋 Build Details

Property	Value
Flow Type	dev
Commit	9e95c29
Registry	Docker Hub + GHCR

🏷️ Image Tags

• wgtechlabs/unthread-discord-bot:dev-95c79bc
• wgtechlabs/unthread-discord-bot:dev
• ghcr.io/wgtechlabs/unthread-discord-bot:dev-95c79bc
• ghcr.io/wgtechlabs/unthread-discord-bot:dev

---

🔍 Testing Your Changes

1. Pull the image using one of the commands above
2. Run the container with your test configuration
3. Verify the changes work as expected
4. Report any issues in this PR

---

🚀 Quick Start

# Pull and run the container
Docker Hub: docker pull wgtechlabs/unthread-discord-bot:dev-95c79bc
docker run <your-options> <image>

---

---

🔒 Security Scan Results

📋 Pre-Build Security Checks

✅ Source Code Scan: 1 vulnerabilities found
✅ Dockerfile Scan: 0 misconfigurations found

🐳 Container Image Vulnerabilities

Severity	Count
🟠 High	1
Total	1

📋 View Vulnerability Details

Node.js

• 🟠 CVE-2026-19534 (HIGH) - undici
  • undici: undici: Denial of Service via unrequested WebSocket subprotocol
  • Fixed in: 6.28.1, 7.29.1, 8.10.2

📊 Detailed Security Reports

View detailed vulnerability reports in the GitHub Security tab.

---

_{🤖 Powered by Container Build Flow Action vfb5c0662b33f7702bc1ccf85350689436989f606
💻 with ❤️ by Waren Gonzaga under WG Technology Labs, and Him 🙏}

[warengonzaga]

No actionable findings in the reviewed promotion scope at c7ce4ff against main 329b686.

The net diff upgrades the reusable workflow from v0.2.1 to the verified v0.3.1 release commit. The caller inputs and permissions are unchanged. The upstream default single-image behavior remains compatible, nested CI/CodeQL resolve at the pinned revision, and release publishing remains gated on successful artifact production.

Current promotion Build Flow run 37414434889 and CodeQL quality run 37414431555 passed, along with Snyk, Node 22/24/26 checks, Gitleaks, CodeQL and the container job. Copilot completed on this exact head with no findings. Local checks on the identical dev tree passed lint, type checks, build and 186 tests (21 skipped); dev push 37413693195 also passed and published images.

The scan reports two existing dependency vulnerabilities (critical proxy-addr CVE-2026-90711 and high undici CVE-2026-19534). Dependencies and Dockerfile are unchanged by this promotion; those warnings remain outside its scope.

No pending bot reviews or unresolved threads remain. GitHub reports CLEAN/MERGEABLE. Ready for a regular dev-to-main merge commit when authorized; this review does not merge or release the promotion.