From 7ca297cb507631433c27dec821b1676a02cb6f7f Mon Sep 17 00:00:00 2001
From: Tim Dixon <157529682+timdixon82@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:43:08 +0100
Subject: [PATCH] chore: sync template to v1.6.3

---
 .claude/template-version                      |  2 +-
 .github/accessibility-tools/package-lock.json | 26 +++++++++++++------
 .github/workflows/codeql.yml                  |  9 +++++--
 .github/workflows/security.yml                | 12 ++++++++-
 4 files changed, 37 insertions(+), 12 deletions(-)

diff --git a/.claude/template-version b/.claude/template-version
index fdd3be6..266146b 100644
--- a/.claude/template-version
+++ b/.claude/template-version
@@ -1 +1 @@
-1.6.2
+1.6.3
diff --git a/.github/accessibility-tools/package-lock.json b/.github/accessibility-tools/package-lock.json
index 9234504..3f81f98 100644
--- a/.github/accessibility-tools/package-lock.json
+++ b/.github/accessibility-tools/package-lock.json
@@ -1117,17 +1117,17 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -1460,10 +1460,20 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ea49751..44e87b3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,3 +1,10 @@
+# ── PRIVATE REPOS: REMOVE THIS WORKFLOW ────────────────────────────────────────
+# CodeQL requires GitHub Advanced Security. On a private repository without
+# Advanced Security enabled, this workflow will fail with a 403 error.
+# Delete this file from any private project repository.
+# Keep it only for public repos or private repos with Advanced Security enabled.
+# ───────────────────────────────────────────────────────────────────────────────
+
 # CodeQL static analysis.
 #
 # Action versions were verified against GitHub and pinned to commit SHAs
@@ -11,8 +18,6 @@
 name: CodeQL
 on:
   pull_request:
-  push:
-    branches: [main]
   schedule:
     - cron: '0 6 * * 1'  # weekly, Monday morning
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index fd15d08..8853226 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -17,12 +17,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - name: Cache pip packages for Semgrep
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-semgrep-1.166.0
       - name: Semgrep
         # semgrep scan runs locally with the default ruleset and exits non-zero
         # on any finding. semgrep ci requires a SEMGREP_APP_TOKEN and uses
         # cloud-based CI mode; it is not used here to avoid token dependency.
         run: |
-          pip install semgrep
+          pip install semgrep==1.166.0
           semgrep scan --config p/default --error
 
   trivy:
@@ -36,6 +41,11 @@ jobs:
           severity: CRITICAL,HIGH
           exit-code: '1'
 
+  # ── PRIVATE REPOS: REMOVE THIS JOB ──────────────────────────────────────────
+  # dependency-review requires GitHub Advanced Security. On a private repository
+  # without Advanced Security, this job will fail with a 403 error.
+  # Remove it from any private project repository.
+  # ─────────────────────────────────────────────────────────────────────────────
   dependency-review:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'