From 2fba6fa9af65fdc28250c318a387294a3acb77c3 Mon Sep 17 00:00:00 2001
From: Mark Rapson <git@lzstealth.com>
Date: Thu, 22 Oct 2026 17:28:24 +0100
Subject: [PATCH] chore: secure dependencies and bump version to 2.1.13

---
 .gitea/workflows/security.yml | 26 ++++++++++++++++++++++++++
 package-lock.json             | 16 ++++++++--------
 package.json                  |  2 +-
 3 files changed, 35 insertions(+), 9 deletions(-)
 create mode 100644 .gitea/workflows/security.yml

diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
new file mode 100644
index 0000000..16d6a30
--- /dev/null
+++ b/.gitea/workflows/security.yml
@@ -0,0 +1,26 @@
+name: dependency-security
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 9 * * 1'
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '26'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit dependencies
+        run: npm audit
\ No newline at end of file
diff --git a/package-lock.json b/package-lock.json
index c2eb4a4..8f06c1b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "google-sheets-rate-assistant",
-  "version": "2.1.12",
+  "version": "2.1.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "google-sheets-rate-assistant",
-      "version": "2.1.12",
+      "version": "2.1.13",
       "dependencies": {
         "csv-stringify": "^6.0.0",
         "googleapis": "^173.0.0",
@@ -557,9 +557,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -1273,9 +1273,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
+      "version": "6.16.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",
diff --git a/package.json b/package.json
index 7e3e709..d291372 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "google-sheets-rate-assistant",
-  "version": "2.1.12",
+  "version": "2.1.13",
   "description": "Pull Google Sheets data and export to CSV with configurable schedules and rate limiting.",
   "main": "index.js",
   "bin": "index.js",