Dependabot security updates are disabled repo-wide while 15 alerts are open

[lazyants]

What

Vulnerability alerts are enabled, but automated security fixes are off:

GET /repos/lazyants/lexware-mcp-server/vulnerability-alerts   -> 204 (enabled)
GET /repos/lazyants/lexware-mcp-server/automated-security-fixes -> {"enabled": false, "paused": false}

So GitHub detects vulnerable dependencies and reports them, but never opens a PR to fix any of them. Pushes currently report 15 open alerts (3 high, 11 moderate, 1 low).

Why it matters

Two independent gaps compound:

1. No automated remediation. Every advisory has to be noticed and actioned by hand. Nothing in the weekly version-update flow closes a security alert — those PRs bump to the newest version on the configured channel, not to the minimum patched version, and are subject to the ignore rules.
2. CI cannot see most of it. The Tests workflow gates on npm audit --audit-level=moderate --omit=dev, which is production dependencies only. This project has three runtime deps (@modelcontextprotocol/sdk, axios, zod); everything else — the whole toolchain — is a devDependency and therefore invisible to that gate.

The result is that a devDependency advisory is reported by alerts, ignored by CI, and never PR'd.

Interaction with the ignore rules

.github/dependabot.yml ignores semver-major for @types/node and typescript (#95). Per GitHub's Dependabot options reference, ignore also affects security-update PRs and has no applies-to key, so those rules would suppress a security PR requiring a major bump — if security updates were enabled at all. Right now they are not, which is the larger issue and the reason that residual risk is currently moot.

If security updates get enabled, re-read both ignore rules first.

Suggested actions

• Triage the 15 open alerts; establish how many are dev-only vs runtime.
• Decide whether to enable automated security fixes (Settings → Code security).
• If enabled, re-evaluate the two ignore rules against security-update suppression.
• Consider whether the CI audit gate should also run a dev-inclusive npm audit in report-only mode, so devDependency advisories are at least visible.

Found during the security review of #96/#97/#98.