Dependency Updates Checklist

Whenever any package.json (root, client/, or sas/) or lockfile is modified, run the same checks CI runs before pushing:

npm audit (must be clean for prod deps):
```
npm audit --omit=dev            # in repo root
cd sas && npm audit --omit=dev
cd ../client && npm audit --omit=dev
```
Fix with npm audit fix, targeted overrides in package.json, or version bumps — never npm audit fix --force blindly, as it can introduce breaking changes.
License checker (client only):
```
cd client && npm run license-checker
```
If a new dependency fails, either add its SPDX id to the onlyAllow list in client/licenseChecker.js (if the license is acceptable, e.g. permissive ones like BlueOak-1.0.0) or add the specific package to excludePackages with justification. Data Controller ships on-prem, so only OSI-approved permissive licenses are acceptable for production dependencies.

Both checks run in .gitea/workflows/build.yaml (Check audit and Licence checker steps) and will fail the build if skipped locally.