Remove pnpm audit CI job in favor of Socket.dev

[lkostrowski]

Drop the audit job from main.yml that ran pnpm audit on every PR, and add ADR 0003 documenting the decision to use Socket.dev for dependency security instead.

Scope of the PR

Related issues

Checklist

• I added changesets and read good practices.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a816752

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dummy-payment-app	Ready	Preview, Comment	Jun 29, 2026 8:07am
saleor-app-anonymizer	Ready	Preview, Comment	Jun 29, 2026 8:07am
saleor-app-onboarding	Ready	Preview, Comment	Jun 29, 2026 8:07am

9 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
saleor-app-avatax	Ignored	Preview, Comment	Jun 29, 2026 8:07am
saleor-app-cms	Ignored	Preview, Comment	Jun 29, 2026 8:07am
saleor-app-klaviyo	Ignored	Preview	Jun 29, 2026 8:07am
saleor-app-payment-np-atobarai	Ignored	Preview, Comment	Jun 29, 2026 8:07am
saleor-app-payment-stripe	Ignored	Preview	Jun 29, 2026 8:07am
saleor-app-products-feed	Ignored	Preview, Comment	Jun 29, 2026 8:07am
saleor-app-search	Ignored	Preview, Comment	Jun 29, 2026 8:07am
saleor-app-segment	Ignored	Preview, Comment	Jun 29, 2026 8:07am
saleor-app-smtp	Ignored	Preview, Comment	Jun 29, 2026 8:07am

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.15%. Comparing base (1baff6d) to head (a816752).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2385   +/-   ##
=======================================
  Coverage   38.15%   38.15%           
=======================================
  Files        1048     1048           
  Lines       67116    67116           
  Branches     3598     3598           
=======================================
  Hits        25605    25605           
  Misses      41121    41121           
  Partials      390      390           

Flag	Coverage Δ
avatax	57.58% <ø> (ø)
cms	21.85% <ø> (ø)
domain	100.00% <ø> (ø)
dynamo-config-repository	79.29% <ø> (ø)
errors	92.00% <ø> (ø)
logger	28.81% <ø> (ø)
np-atobarai	72.66% <ø> (ø)
products-feed	6.01% <ø> (ø)
search	32.31% <ø> (ø)
segment	33.65% <ø> (ø)
shared	56.07% <ø> (ø)
smtp	36.32% <ø> (ø)
stripe	70.89% <ø> (ø)
webhook-utils	21.35% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[stmpn]

I am going to assume socket.dev workflow/pipeline will be added at later stage via separate PR

[lkostrowski]

I am going to assume socket.dev workflow/pipeline will be added at later stage via separate PR

@stmpn it's already installed as App so no workflow needed