Adam Moussa b056a29ba6 ci(security): allow GHSA-3jxr-9vmj-r5cp in dependency review (#16) ... brace-expansion 5.0.7 ships inBundle inside aws-cdk-lib and cannot be overridden via the lockfile; dependency-review (fail-on-severity: high) blocks any PR whose diff moves the bundled copy, currently Dependabot #15 (aws-cdk-lib 2.261.0 -> 2.262.1, bundled 5.0.6 -> 5.0.7). - bump callable-dependency-review pin to org main HEAD (adds the allow-ghsas input, absent at the old fd60e4c9 pin) - pass allow-ghsas scoped to this single advisory - adjudicate the accepted risk in .security-review/suppressions.json per the org workflow input contract (synth-time-only exposure) Remove the allow + suppression when aws-cdk-lib bundles >=5.0.8.		2026-07-28 15:47:30 -04:00
..
suppressions.json	ci(security): allow GHSA-3jxr-9vmj-r5cp in dependency review (#16)	2026-07-28 15:47:30 -04:00