chore(deps): update semgrep/semgrep docker digest to 32e4599

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
semgrep/semgrep	container	digest	acaac22 → 32e4599

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Chores
  • Updated the automated security scanning configuration. This maintenance change does not affect app features, functionality, or the experience of using the product. No user-facing changes are included in this release.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ada510a7-3820-4370-92f8-4062096a649f

📥 Commits

Reviewing files that changed from the base of the PR and between c2c7c6a and 845f417.

📒 Files selected for processing (1)

• .github/workflows/security.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The security workflow updates the pinned container image digest used by the Semgrep job.

Changes

Semgrep image pin

Layer / File(s)	Summary
Update Semgrep image digest .github/workflows/security.yml	The Semgrep job now uses a different pinned container image digest.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 845f4

The Semgrep image update preserves the scan job’s expected command, and the exact digest resolves in the registry. No actionable merge-blocking risk remains.

Architecture Summary

Architecture risk: 🔵 Low · up to 845f4

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/security.yml: The Semgrep container image digest changes from acaac22f…d81198 to 32e45996…42786b.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description clearly states the digest update and Renovate configuration, but it does not use the repository template. It omits the Summary, Type of change, and Checklist sections.	Add the repository template sections. Include a one- or two-sentence summary, mark chore as the change type, and complete the applicable checklist items.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the maintenance change: updating the pinned Semgrep container digest. It follows the repository's conventional commit format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}