Go/npm dependency CVE monitoring not automated. **Fix:** govulncheck + npm audit in CI.
Go/npm dependency CVE monitoring not automated. Fix: govulncheck + npm audit in CI.