name: Dependency Review
on:
  pull_request:

permissions:
  contents: read

jobs:
  review:
    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
    with:
      # brace-expansion OOM DoS: no in-range fix (patch only in 5.0.8; @11ty/recursive-copy
      # pins minimatch <10.0.3). Build-time-only exposure, adjudicated in
      # .security-review/suppressions.json — remove when recursive-copy bumps minimatch.
      allow-ghsas: GHSA-mh99-v99m-4gvg