OSV pip issues + Updated dependabot workflow

Signed-off-by: Effi-S <effi.szt@gmail.com>

Author: Effi-S

.github/dependabot.yml

@@ -47,10 +47,20 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    # Collapse routine bumps into a single PR to keep review noise low; a major
-    # version bump (which may carry breaking changes) still gets its own PR.
+    # Split bumps into two group PRs: majors (which may carry breaking changes)
+    # get their own PR for careful review, while minor + patch bumps collapse
+    # into a separate low-risk PR. Dependabot evaluates groups top-to-bottom, so
+    # the major group claims major bumps first and the routine group takes the
+    # rest.
     groups:
-      github-actions:
+      github-actions-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+      github-actions-minor:
+        patterns:
+          - "*"
         update-types:
           - "minor"
           - "patch"

.github/workflows/docs.yml

@@ -55,8 +55,7 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements.txt
+          pip install -r requirements.txt --require-hashes
 
       - name: Build documentation (Strict Mode)
         run: |

.github/workflows/token-validation-benchmark.yml

@@ -224,7 +224,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install parser dependencies
-        run: pip install pandas
+        run: pip install pandas==3.0.5
 
       - name: Build comparison report
         id: report

requirements.in

@@ -0,0 +1,7 @@
+mkdocs>=1.6.1
+mkdocs-material>=9.7.7
+pymdown-extensions>=11.0.1
+
+# Transitive dependency (mkdocs-material -> requests -> idna)
+# idna < 3.15 has a denial-of-service issue (PYSEC-2026-215 / CVE-2024-3651)
+idna>=3.15