Fail-closed npm and PyPI vulnerability checks in n8n A dependency scan is only useful when it answers two different questions: Did the public vulnerability sources report a finding for the exact version I run? Did every required source answer successfully? Treating a timeout as "zero vulnerabilities" makes a dashboard look clean at the exact moment it has stopped checking. This workflow keeps those states separate and can run on a daily n8n schedule without maintaining a scanne...