build: bump the docs-dependencies group in /docs with 2 updates #519

	name: Dependency Review

	# Runs on every PR (no paths-ignore) so changes to docs/pnpm-lock.yaml are
	# scanned too — the root CI workflow path-ignores docs/**, which previously
	# left docs dependency bumps unreviewed.
	on:
	pull_request:
	branches: [master]

	concurrency:
	group: dep-review-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	dependency-review:
	name: Dependency Review
	runs-on: ubuntu-latest
	permissions:
	contents: read
	pull-requests: write
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
	with:
	egress-policy: audit
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- name: Dependency Review
	uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
	with:
	comment-summary-in-pr: on-failure
	# Block newly-introduced moderate+ advisories in both runtime
	# AND development scopes (the default only fails on runtime/high).
	fail-on-severity: moderate
	fail-on-scopes: runtime, development

Navigation Menu