chore(infra): add dependabot.yml and OSV-Scanner weekly vulnerability monitoring (#561)

* chore(infra): add dependabot.yml and OSV-Scanner weekly vulnerability monitoring

Add two security configurations:
1. dependabot.yml: enables Dependabot updates for GitHub Actions and
   git submodules with weekly schedule, assigned to kcenon.

2. osv-scanner.yml: adds weekly OSV-Scanner workflow to complement
   the existing Trivy daily scan. Scans vcpkg.json manifest against
   the Open Source Vulnerabilities (OSV) database. Results are
   uploaded to GitHub Security tab as SARIF.

Part of kcenon/common_system#408

* fix(core): resolve TSAN data race in start_timeout_timer weak_ptr destruction

Release state_weak explicitly while the strong reference s is still alive
to prevent a ThreadSanitizer-detected data race on the shared_ptr control
block. Previously, the captured weak_ptr was destroyed as part of the lambda
closure after s went out of scope, causing a concurrent operator delete
(from ~weak_ptr on zero weak count) to race with the token destructor's
__release_shared read on the same control block address.

By calling state_weak.reset() before s is released, the weak ref-count
decrement occurs while a strong reference still exists, ensuring the control
block is freed deterministically on the main thread rather than racing with
the timer thread.

Fixes: ThreadSanitizer warning in enhanced_cancellation_token_test.LinkedWithTimeoutParentCancel

Author: kcenon

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  # Enable version updates for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    assignees:
+      - "kcenon"
+    labels:
+      - "dependencies"
+      - "github-actions"
+
+  # Enable version updates for git submodules
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    assignees:
+      - "kcenon"
+    labels:
+      - "dependencies"
+      - "submodules"

.github/workflows/osv-scanner.yml

@@ -0,0 +1,76 @@
+name: OSV Vulnerability Scan
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'vcpkg.json'
+      - 'vcpkg-configuration.json'
+      - '.github/workflows/osv-scanner.yml'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'vcpkg.json'
+      - 'vcpkg-configuration.json'
+  schedule:
+    # Run every Sunday at 3:17 AM UTC (offset from Trivy daily scan at 2 AM)
+    - cron: '17 3 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+# OSV-Scanner complements the existing Trivy scan (cve-scan.yml):
+#   - Trivy:       filesystem scan, runs daily on push/PR
+#   - OSV-Scanner: dependency manifest scan, runs weekly + on vcpkg.json changes
+#
+# OSV-Scanner uses the Open Source Vulnerabilities (OSV) database which covers
+# vcpkg ecosystem packages, GitHub Advisory Database, and more.
+# See: https://github.com/kcenon/common_system/issues/408
+
+jobs:
+  osv-scan:
+    name: OSV Scanner
+    runs-on: ubuntu-latest
+    if: github.ref != 'refs/heads/gh-pages'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run OSV-Scanner on vcpkg manifest
+        uses: google/osv-scanner-action/osv-scanner-action@v2
+        with:
+          scan-args: |-
+            --lockfile=vcpkg.json
+            --format=sarif
+            --output=osv-results.sarif
+        continue-on-error: true
+
+      - name: Run OSV-Scanner filesystem scan (fallback)
+        if: hashFiles('osv-results.sarif') == ''
+        uses: google/osv-scanner-action/osv-scanner-action@v2
+        with:
+          scan-args: |-
+            --recursive
+            .
+            --format=sarif
+            --output=osv-results.sarif
+        continue-on-error: true
+
+      - name: Upload OSV SARIF to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        if: always() && hashFiles('osv-results.sarif') != ''
+        continue-on-error: true
+        with:
+          sarif_file: osv-results.sarif
+          category: osv-scanner
+
+      - name: Upload OSV results artifact
+        uses: actions/upload-artifact@v4
+        if: always() && hashFiles('osv-results.sarif') != ''
+        with:
+          name: osv-scan-results-${{ github.sha }}
+          path: osv-results.sarif
+          retention-days: 30

src/core/enhanced_cancellation_token.cpp

@@ -476,7 +476,7 @@ namespace kcenon::thread
 		std::chrono::steady_clock::time_point deadline_point) -> void
 	{
 		std::thread timer_thread(
-			[state_weak, deadline_point]()
+			[state_weak, deadline_point]() mutable
 			{
 				auto s = state_weak.lock();
 				if (!s)
@@ -544,6 +544,13 @@ namespace kcenon::thread
 				}
 
 				s->timer_active.store(false, std::memory_order_release);
+
+				// Release the weak_ptr while the strong reference (s) is still alive.
+				// This ensures ~weak_ptr() decrements the weak ref-count before the
+				// last shared_ptr is released, preventing a data race on the control
+				// block between this thread's operator delete and the token destructor's
+				// __release_shared read (ThreadSanitizer: data race).
+				state_weak.reset();
 			});
 
 		timer_thread.detach();