name: Dependency Review

on:
  pull_request:

permissions:
  contents: read

jobs:
  review:
    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
    with:
      # brace-expansion OOM DoS: no in-range fix (patch only in 5.0.8; @11ty/recursive-copy
      # pins minimatch <10.0.3). Build-time-only exposure, adjudicated in
      # .security-review/suppressions.json — remove when recursive-copy bumps minimatch.
      allow-ghsas: GHSA-mh99-v99m-4gvg