Skip to content

chore(deps): bump the actions group across 1 directory with 3 updates - #361

Merged
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-1bef3beed3
Aug 23, 2026
Merged

chore(deps): bump the actions group across 1 directory with 3 updates#361
hyperpolymath merged 1 commit into
mainfrom
dependabot/github_actions/actions-1bef3beed3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 3 updates in the / directory: github/codeql-action, taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates github/codeql-action from 4.37.6 to 4.37.7

Release notes

Sourced from github/codeql-action's releases.

v4.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085
Changelog

Sourced from github/codeql-action's changelog.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085
Commits
  • ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
  • 951a133 Update changelog for v4.37.7
  • be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
  • 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
  • b4d8a54 Rebuild
  • ab5db25 Bump the npm-minor group across 1 directory with 8 updates
  • 38055a3 Drop logger from databaseInitCluster in interface
  • 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
  • dc1b98a Make logger available to getCodeQLForCmd
  • 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
  • Additional commits viewable in compare view

Updates taiki-e/install-action from 2.85.11 to 2.86.4

Release notes

Sourced from taiki-e/install-action's releases.

2.86.4

  • Update oxfmt@latest to 1.79.0.

  • Update mise@latest to 2026.8.8.

  • Update martin@latest to 1.14.0.

  • Update dprint@latest to 0.56.0.

  • Update cargo-about@latest to 0.9.2.

  • Update biome@latest to 2.5.9.

2.86.3

  • Update prek@latest to 0.4.14.

  • Update osv-scanner@latest to 2.5.1.

  • Update cargo-llvm-cov@latest to 0.9.0.

2.86.2

  • Update uv@latest to 0.12.5.

  • Update mise@latest to 2026.8.6.

  • Update cargo-tarpaulin@latest to 0.37.2.

2.86.1

  • Fix an issue where oxfmt was　accidentally installed as oxfmt-{target}{exe}. (#1969)

2.86.0

2.85.14

  • Update uv@latest to 0.12.4.

  • Update trivy@latest to 0.74.0.

  • Update tombi@latest to 1.4.0.

  • Update mdbook-mermaid@latest to 0.17.1.

  • Update cargo-xwin@latest to 0.23.1.

2.85.13

  • Update tombi@latest to 1.3.3.

  • Update mise@latest to 2026.8.5.

  • Update kingfisher@latest to 1.113.0.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.86.4] - 2026-08-20

  • Update oxfmt@latest to 1.79.0.

  • Update mise@latest to 2026.8.8.

  • Update martin@latest to 1.14.0.

  • Update dprint@latest to 0.56.0.

  • Update cargo-about@latest to 0.9.2.

  • Update biome@latest to 2.5.9.

[2.86.3] - 2026-08-18

  • Update prek@latest to 0.4.14.

  • Update osv-scanner@latest to 2.5.1.

  • Update cargo-llvm-cov@latest to 0.9.0.

[2.86.2] - 2026-08-17

  • Update uv@latest to 0.12.5.

  • Update mise@latest to 2026.8.6.

  • Update cargo-tarpaulin@latest to 0.37.2.

[2.86.1] - 2026-08-15

  • Fix an issue where oxfmt was　accidentally installed as oxfmt-{target}{exe}. (#1969)

[2.86.0] - 2026-08-15

[2.85.14] - 2026-08-15

  • Update uv@latest to 0.12.4.

  • Update trivy@latest to 0.74.0.

  • Update tombi@latest to 1.4.0.

  • Update mdbook-mermaid@latest to 0.17.1.

  • Update cargo-xwin@latest to 0.23.1.

... (truncated)

Commits

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 887ca863ab0837be4d0002d33389862be8c7bee5 to 0d531555f4c04f086f0af58ec34e1bb27145fdbe

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

Changelog

[Unreleased]

Fixed — assail detector precision (false-positive reduction, 2026-06-24)

Three assail analyzer fixes, all conservative (no new false negatives), found while triaging hyperpolymath/proven#68 and JoshuaJewell/paint-type#86:

  • UncheckedAllocation (C) is now NULL-check aware. The detector previously flagged every malloc(...) and emitted a line-less, file-level finding. It now scans per line, skips a malloc whose result is NULL-checked within a short window (if (p == NULL), if (!p), nullptr), and attaches a line number — which also lets an inline // panic-attack: accepted marker suppress a reviewed site (marker suppression is line-gated). A genuinely-unchecked malloc still fires. This is why a real null-check fix (proven stubs.c) previously failed to clear.
  • DynamicCodeExecution (JS/Python) is word-boundary aware. contains("eval(") matched FFI symbol names like proven_calculator_eval(. Now \beval\s*\( (and \b(?:eval|exec)\s*\( for Python); a genuine eval( still fires.
  • CommandInjection (Shell) no longer matches the --eval CLI flag. contains("eval ") matched --eval/-eval. Now the eval builtin is matched only in statement position ((?m)(?:^|[\s;&|(])eval[ \t]).

Verified end-to-end: proven 1→0 active Critical/High (stubs.c clears), paint-type 36→35 (gossamer --eval benchmark FP clears; genuinely-unsafe vendored FFI + the irreducible believe_me axiom correctly remain). 4 new tests in tests/analyzer_tests.rs; full analyzer suite green; zero warnings. PR #134. Refs #32.

Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME §3.2)

  • src/abi/AttestationUnforgeability.idr: Idris2 proof that the intent→evidence→seal attestation chain is unforgeable. Models chain_hash = H(intent‖evidence‖report) + the Ed25519 signature with the cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA message- and signer-binding, signature correctness) as a parameters block — hypotheses, not postulate (PA021 bans escape hatches), so it is an honest conditional theorem. Under %default total it Qed-closes integrity (tampering any phase invalidates the seal), authenticity (a verifying seal comes from the matching key), and nonRepudiation (a genuine seal verifies), plus two corollaries. Typechecks under Idris2 0.8.0. Closes #123.

Added — contractile registry (INDEX.a2ml)

  • .machine_readable/contractiles/INDEX.a2ml: the previously-missing contractile registry, modelled on echidna's canonical INDEX. Catalogues all

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the actions group across 1 directory with 3 updates
569da2b 
Bumps the actions group with 3 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action), [taiki-e/install-action](https://github.com/taiki-e/install-action) and [hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack).


Updates `github/codeql-action` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v4.37.6...v4.37.7)

Updates `taiki-e/install-action` from 2.85.11 to 2.86.4
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@v2.85.11...v2.86.4)

Updates `hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from 887ca863ab0837be4d0002d33389862be8c7bee5 to 0d531555f4c04f086f0af58ec34e1bb27145fdbe
- [Release notes](https://github.com/hyperpolymath/panic-attack/releases)
- [Changelog](https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md)
- [Commits](hyperpolymath/panic-attack@887ca86...0d53155)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.86.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml
  dependency-version: 0d531555f4c04f086f0af58ec34e1bb27145fdbe
  dependency-type: direct:production
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 23, 2026
@hyperpolymath
hyperpolymath merged commit dddacf2 into main Aug 23, 2026
24 of 31 checks passed
@hyperpolymath
hyperpolymath deleted the dependabot/github_actions/actions-1bef3beed3 branch August 23, 2026 19:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hyperpolymath hyperpolymath hyperpolymath approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath