name: Dependency Review
on:
  pull_request:

permissions:
  contents: read

jobs:
  review:
    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@af0f002e14a08cdbfd879c1183bfe7eb2604bce9 # v1.0.8
    with:
      # GHSA-rgw5-rvv9-x895 (brace-expansion DoS bypass of CVE-2026-14257):
      # bundled transitive inside aws-cdk-lib (inBundle, not overridable via
      # lockfile); adjudicated in .security-review/suppressions.json.
      # aws-cdk-lib 2.263.0 bundles 5.0.8 (fixes GHSA-3jxr-9vmj-r5cp). Remove
      # when aws-cdk-lib bundles >=5.0.9.
      allow-ghsas: GHSA-rgw5-rvv9-x895