From 9f9b9e0997f8cfef94a5d96a131c0101834870a3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 05:15:44 +0000
Subject: [PATCH 1/3] Bump org.json:json from 20210307 to 20231013

Bumps [org.json:json](https://github.com/douglascrockford/JSON-java) from 20210307 to 20231013.
- [Release notes](https://github.com/douglascrockford/JSON-java/releases)
- [Changelog](https://github.com/stleary/JSON-java/blob/master/docs/RELEASES.md)
- [Commits](https://github.com/douglascrockford/JSON-java/compare/20210307...20231013)

---
updated-dependencies:
- dependency-name: org.json:json
  dependency-version: '20231013'
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 2d64c31..c07eada 100644
--- a/pom.xml
+++ b/pom.xml
@@ -21,7 +21,7 @@
         <playwright.version>1.55.0</playwright.version>
         <browserstack-local-java.version>1.0.6</browserstack-local-java.version>
         <snakeyaml.version>2.0</snakeyaml.version>
-        <json.version>20210307</json.version>
+        <json.version>20231013</json.version>
         <maven-surefire-plugin.version>3.0.0-M5</maven-surefire-plugin.version>
     </properties>
 

From d17dd241aab5e3ed17ba47ceaa15bd7f71360446 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 05:15:45 +0000
Subject: [PATCH 2/3] Bump org.testng:testng from 7.4.0 to 7.5.1

Bumps [org.testng:testng](https://github.com/cbeust/testng) from 7.4.0 to 7.5.1.
- [Release notes](https://github.com/cbeust/testng/releases)
- [Changelog](https://github.com/testng-team/testng/blob/master/CHANGES.txt)
- [Commits](https://github.com/cbeust/testng/compare/7.4.0...7.5.1)

---
updated-dependencies:
- dependency-name: org.testng:testng
  dependency-version: 7.5.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 2d64c31..3ff8254 100644
--- a/pom.xml
+++ b/pom.xml
@@ -17,7 +17,7 @@
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
         <cucumber.version>7.4.1</cucumber.version>
-        <testng.version>7.4.0</testng.version>
+        <testng.version>7.5.1</testng.version>
         <playwright.version>1.55.0</playwright.version>
         <browserstack-local-java.version>1.0.6</browserstack-local-java.version>
         <snakeyaml.version>2.0</snakeyaml.version>

From 8dd69a23ac4b35ad519649f40ffcdf37830b8aa5 Mon Sep 17 00:00:00 2001
From: bstack-security-github
 <116066275+bstack-security-github@users.noreply.github.com>
Date: Fri, 19 Jun 2026 18:41:25 +0530
Subject: [PATCH 3/3] semgrep workflow: pin Docker image and actions to version
 tags

Pin returntocorp/semgrep container image to a specific version
and GitHub Actions to major version tags to prevent :latest
tag resolution and reduce supply-chain attack surface.

Fixes: LCNC-15821

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/Semgrep.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/Semgrep.yml b/.github/workflows/Semgrep.yml
index ab2ae7e..626e093 100644
--- a/.github/workflows/Semgrep.yml
+++ b/.github/workflows/Semgrep.yml
@@ -27,8 +27,7 @@ jobs:
 
     container:
       # A Docker image with Semgrep installed. Do not change this.
-      image: returntocorp/semgrep
-
+      image: returntocorp/semgrep:1.166.0
     # Skip any PR created by dependabot to avoid permission issues:
     if: (github.actor != 'dependabot[bot]')