build(deps): bump actions/cache from 4.3.0 to 5.0.5 by dependabot[bot] · Pull Request #62 · hyperpolymath/maa-framework

dependabot · 2026-05-22T22:36:43Z

Bumps actions/cache from 4.3.0 to 5.0.5.

Release notes

Sourced from actions/cache's releases.

v5.0.5

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in actions/cache#1747

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

Full Changelog: actions/cache@v5...v5.0.3

v.5.0.2

v5.0.2

What's Changed

When creating cache entries, 429s returned from the cache service will not be retried.

v5.0.1

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

If you are using self-hosted runners, ensure they are updated before upgrading.

v5.0.1

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

27d5ce7 Merge pull request #1747 from actions/yacaovsnc/update-dependency
f280785 licensed changes
619aeb1 npm run build generated dist files
bcf16c2 Update ts-http-runtime to 0.3.5
6682284 Merge pull request #1738 from actions/prepare-v5.0.4
e340396 Update RELEASES
8a67110 Add licenses
1865903 Update dependencies & patch security vulnerabilities
5656298 Merge pull request #1722 from RyPeck/patch-1
4e380d1 Fix cache key in examples.md for bun.lock
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@0057852...27d5ce7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-05-23T06:16:11Z

🔍 Hypatia Security Scan

Findings: 29 issues detected

Severity	Count
🔴 Critical	3
🟠 High	6
🟡 Medium	20

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Go file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/maa-framework/maa-framework/absolute-zero/examples/go/nop.go",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "User-defined Coq axiom -- not verified by kernel (3 occurrences, CWE-704)",
    "type": "coq_axiom",
    "file": "/home/runner/work/maa-framework/maa-framework/absolute-zero/proofs/coq/quantum/QuantumMechanicsExact.v",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "User-defined Coq axiom -- not verified by kernel (33 occurrences, CWE-704)",
    "type": "coq_axiom",
    "file": "/home/runner/work/maa-framework/maa-framework/absolute-zero/proofs/coq/quantum/QuantumCNO.v",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "User-defined Coq axiom -- not verified by kernel (3 occurrences, CWE-704)",
    "type": "coq_axiom",
    "file": "/home/runner/work/maa-framework/maa-framework/absolute-zero/proofs/coq/lambda/LambdaCNO.v",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "User-defined Coq axiom -- not verified by kernel (1 occurrences, CWE-704)",
    "type": "coq_axiom",
    "file": "/home/runner/work/maa-framework/maa-framework/absolute-zero/proofs/coq/category/CNOCategory.v",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "User-defined Coq axiom -- not verified by kernel (4 occurrences, CWE-704)",
    "type": "coq_axiom",
    "file": "/home/runner/work/maa-framework/maa-framework/absolute-zero/proofs/coq/common/CNO.v",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "User-defined Coq axiom -- not verified by kernel (13 occurrences, CWE-704)",
    "type": "coq_axiom",
    "file": "/home/runner/work/maa-framework/maa-framework/absolute-zero/proofs/coq/filesystem/FilesystemCNO.v",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

… + 16-commit catch-up) (#83) ## Summary Re-syncs maa-framework's vendored `absolute-zero/` tree from its previous snapshot (16+ commits behind) up to current upstream HEAD (commit `ab35c07`). ## Primary motivation: pull in standards#203 trusted-base work | Upstream PR | Phase | Contents | |-------------|-------|----------| | absolute-zero#52 | seed | `docs/proof-debt.md` per standards#203 schema | | absolute-zero#58 | 1 | per-axiom triage of 72 Coq Axioms (`docs/proof-debt-triage.md`) | | absolute-zero#59 | 1 cleanup | post-#58 cross-refs + STATE/META updates | | absolute-zero#60 | 2a | Lambda cluster — Coq + Lean inline `AXIOM:` annotations | | absolute-zero#61 | 2b | `CNOCategory.v:323` `hom_functor` §(d) DEBT entry | | absolute-zero#62 | 2c | Filesystem cluster — 26 inline annotations + 8 §(d) DEBT entries | **Cumulative trusted-base state**: 41 / 129 escape hatches documented (35.7% covered). Remaining 88 belong to Quantum + Physics clusters (future Phase 2d/2e PRs upstream). ## Side effects of the full re-vendor Because the vendored tree was 16+ commits behind, the sync also pulls in unrelated upstream work: - Estate-policy / governance / hypatia / language-policy workflow updates (~15 `.github/workflows/*` files). - MPL-2.0 SPDX header migration from PMPL-1.0-or-later (~20 files). - `.machine_readable/` A2ML updates. - ReScript interpreter removal (per estate language-policy ban — `interpreters/rescript/*` deleted). - Verification scripts moved to `verification/` subdir. - Old session debris pruned (`SONNET-HANDOFF.md`, `STACK_AUDIT.txt`, `ROADMAP-V1-TO-V12.adoc`, `ROADMAP-UPDATED.adoc`, etc.). ## Preserved (maa-framework-specific, NOT in upstream) Three Agda extensions were added in maa-framework directly (commits `0538283` + `e80c5fb`) and survive the re-vendor via rsync filters: - `proofs/agda/EchoBridgeCNO.agda` - `proofs/agda/EchoBridgeScaffold.agda` - `proofs/agda/README.adoc` ## Verification ``` $ bash ~/developer/repos/standards/scripts/check-trusted-base.sh absolute-zero [INFO] Found 129 soundness-relevant escape hatch(es). [ERROR] 88/129 escape hatch(es) are undocumented. ``` Matches upstream exactly. The 41 documented entries are Lambda (5) + CNOCategory (1) + already-passing (1) + Filesystem (34). ## Scope warning This is a large PR (168 files changed) because of the catch-up. If desired, I can re-do this as two PRs: 1. proofs/ + docs/proof-debt*.md only (the trusted-base subset) 2. Everything else (workflows + machine_readable + cleanups) But that requires hand-curating the file list. The single-PR shape matches the "full re-vendor" option from the planning question. Refs absolute-zero#52, #58, #59, #60, #61, #62; standards#203. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 22, 2026

dependabot Bot requested a review from hyperpolymath as a code owner May 22, 2026 22:36

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 22, 2026

hyperpolymath approved these changes May 22, 2026

View reviewed changes

Merge branch 'main' into dependabot/github_actions/actions/cache-5.0.5

986ed9a

hyperpolymath merged commit 1944bd5 into main May 22, 2026
12 of 15 checks passed

hyperpolymath deleted the dependabot/github_actions/actions/cache-5.0.5 branch May 22, 2026 22:49

hyperpolymath mentioned this pull request May 27, 2026

sync: re-vendor absolute-zero/ subtree to upstream HEAD (trusted-base + 16-commit catch-up) #83

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump actions/cache from 4.3.0 to 5.0.5#62

build(deps): bump actions/cache from 4.3.0 to 5.0.5#62
hyperpolymath merged 2 commits into
mainfrom
dependabot/github_actions/actions/cache-5.0.5

dependabot Bot commented on behalf of github May 22, 2026

Uh oh!

Uh oh!

github-actions Bot commented May 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 22, 2026

v5.0.5

What's Changed

v5.0.4

What's Changed

New Contributors

v5.0.3

What's Changed

v.5.0.2

v5.0.2

What's Changed

v5.0.1

v5.0.1

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

Uh oh!

Uh oh!

github-actions Bot commented May 23, 2026

🔍 Hypatia Security Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant