chore(deps): update all non-major dependencies #572

	name: Semgrep

	on:
	# Scan changed files in PRs, block on new issues only (existing issues ignored)
	pull_request: {}

	jobs:
	semgrep:
	name: Scan
	runs-on: ubuntu-latest
	# Skip any PR created by dependabot to avoid permission issues
	if: (github.actor != 'dependabot[bot]')
	container:
	image: semgrep/semgrep:1.168.0@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e
	steps:
	# Fetch project source
	- uses: actions/checkout@v7

	- name: Run Semgrep
	run: \|
	semgrep scan \
	--sarif \
	--output=semgrep.sarif \
	--config="p/security-audit" \
	--config="p/secrets" \
	--config="p/ci" \
	--config="p/default" \
	--config="p/docker" \
	--config="p/dockerfile" \
	--config="p/command-injection"

	# Upload findings to GitHub Advanced Security Dashboard [step 2/2]
	- name: Upload SARIF file for GitHub Advanced Security Dashboard
	uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
	with:
	sarif_file: semgrep.sarif

Provide feedback