[Frawless]

Type of Change

• Task

Description

Fixes the two remaining OpenSSF Scorecard warnings:

• Pinned-Dependencies – cve-notifier.yml installed Poetry with a plain pip install. It now installs from configs/cve-notifier-requirements.txt with --require-hashes (generated by uv pip compile, regeneration command in the file header). A pip entry in dependabot.yml keeps it updated.
• Token-Permissions – test-snyk.yml granted security-events: write and actions: read at workflow level. They are now set per job, only where needed.

Checklist

• Update documentation
• Write tests
• Make sure all tests pass
• Try your changes inside a Kubernetes cluster, not just from unit tests
• AI assistance was used to create this PR (see the Strimzi AI policy)

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}