feat: Implement dependency vulnerability audit across all services

[Ugasutun]

Closes #104

Overview

This PR introduces automated dependency vulnerability scanning across all services (Node.js, Python, and Rust) to detect and prevent known security issues (CVEs) from entering the codebase. It integrates auditing tools into CI, enforces security gates, and enables continuous monitoring via Dependabot.

Problem
No automated scanning for dependency vulnerabilities
Known CVEs in dependencies can go undetected
No enforcement to block insecure code from being merged
Solution

Implemented a multi-language dependency audit pipeline with strict enforcement:

Node.js → npm audit --audit-level=high
Python → pip-audit
Rust → cargo audit

These checks are now part of CI and will fail builds on high/critical vulnerabilities, preventing insecure merges.

Key Changes
🔍 CI Integration
Added audit steps for:
Node.js dependencies
Python dependencies
Rust dependencies
Configured pipelines to fail on high/critical vulnerabilities
📦 Audit Artifacts
Audit results are generated and uploaded as CI artifacts
Enables visibility and traceability of detected issues
🤖 Dependabot Setup
Enabled Dependabot for:
npm (Node.js)
pip (Python)
cargo (Rust)
Automated PRs for dependency updates and security fixes
Testing
Triggered CI with vulnerable dependencies to confirm:
Build fails on high/critical CVEs
Verified audit reports are generated and accessible as artifacts
Confirmed Dependabot PRs are created for outdated/insecure packages
Acceptance Criteria
npm audit, pip-audit, and cargo audit run in CI
High/critical vulnerabilities block PR merge
Audit results uploaded as CI artifacts
Dependabot enabled for all ecosystems
Notes
Improves overall security posture across all services
Ensures early detection and remediation of vulnerabilities
No impact on application runtime behavior
Example Commit Message
chore(security): add dependency vulnerability audits across all services

[drips-wave]

@Ugasutun Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits