You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
chore(deps): bump the actions group with 2 updates (#340)
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps the actions group with 2 updates:
[taiki-e/install-action](https://github.com/taiki-e/install-action) and
[hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack).
Updates `taiki-e/install-action` from 2.85.2 to 2.85.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's
releases</a>.</em></p>
<blockquote>
<h2>2.85.3</h2>
<ul>
<li>
<p>Update <code>xh@latest</code> to 0.26.2.</p>
</li>
<li>
<p>Update <code>ubi@latest</code> to 0.10.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.14.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.13.0.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.3.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.21.1.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this
file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic
Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.85.5] - 2026-07-30</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.0.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.50.0.</p>
</li>
<li>
<p>Update <code>sccache@latest</code> to 0.17.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.16.</p>
</li>
</ul>
<h2>[2.85.4] - 2026-07-29</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.11.33.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.15.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.6.</p>
</li>
</ul>
<h2>[2.85.3] - 2026-07-28</h2>
<ul>
<li>
<p>Update <code>xh@latest</code> to 0.26.2.</p>
</li>
<li>
<p>Update <code>ubi@latest</code> to 0.10.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.14.</p>
</li>
<li>
<p>Update <code>martin@latest</code> to 1.13.0.</p>
</li>
<li>
<p>Update <code>cargo-shear@latest</code> to 1.13.3.</p>
</li>
<li>
<p>Update <code>cargo-binstall@latest</code> to 1.21.1.</p>
</li>
</ul>
<h2>[2.85.2] - 2026-07-26</h2>
<ul>
<li>
<p>Update <code>prek@latest</code> to 0.4.11.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.7.13.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/taiki-e/install-action/commit/18b1216eba7f8039b0f8d131d5473787f0edce68"><code>18b1216</code></a>
Release 2.85.3</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/3a7eb9d7de04335647f871d88d8831485be842be"><code>3a7eb9d</code></a>
Update <code>xh@latest</code> to 0.26.2</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/3d4a0c1c709bc0f907c2a23b1a17cf6296b08298"><code>3d4a0c1</code></a>
Update uv manifest</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/9e4a53cd83bbbd84b17bc14008d4b067b9e99edb"><code>9e4a53c</code></a>
Update <code>ubi@latest</code> to 0.10.0</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/9f2f6a3c937466e1abfae58f471a04b8835bc6de"><code>9f2f6a3</code></a>
Update <code>mise@latest</code> to 2026.7.14</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/e026bd26eeb6a9542c62d43e1f98ced8d56ac346"><code>e026bd2</code></a>
Update <code>martin@latest</code> to 1.13.0</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/f72efa0e99d8d9c15bf7fa6f14f0d4eb369fd084"><code>f72efa0</code></a>
Update <code>cargo-shear@latest</code> to 1.13.3</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/d19664f75e59dd9c49e306b357f78fcb72cd2711"><code>d19664f</code></a>
Update <code>cargo-binstall@latest</code> to 1.21.1</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/4d9bbfb56af57e022493493eecb97d07bf4fddd5"><code>4d9bbfb</code></a>
Update biome manifest</li>
<li>See full diff in <a
href="https://github.com/taiki-e/install-action/compare/41049aa56687c35e0afa74eed4f09cec4f9afabf...18b1216eba7f8039b0f8d131d5473787f0edce68">compare
view</a></li>
</ul>
</details>
<br />
Updates
`hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from
38e2d15c9535b3e0bfd86a01f13825ce5adfc482 to
774dceb6373d798ad4d96a9e40c3993942c2836e
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's
changelog</a>.</em></p>
<blockquote>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<h1>Changelog</h1>
<h2>[Unreleased]</h2>
<h3>Fixed — assail detector precision (false-positive reduction,
2026-06-24)</h3>
<p>Three <code>assail</code> analyzer fixes, all conservative (no new
false negatives), found
while triaging <a
href="https://redirect.github.com/hyperpolymath/proven/issues/68">hyperpolymath/proven#68</a>
and <a
href="https://redirect.github.com/JoshuaJewell/paint-type/issues/86">JoshuaJewell/paint-type#86</a>:</p>
<ul>
<li><strong>UncheckedAllocation (C) is now NULL-check aware.</strong>
The detector previously
flagged <em>every</em> <code>malloc(...)</code> and emitted a line-less,
file-level finding. It
now scans per line, skips a malloc whose result is NULL-checked within a
short
window (<code>if (p == NULL)</code>, <code>if (!p)</code>,
<code>nullptr</code>), and attaches a line number —
which also lets an inline <code>// panic-attack: accepted</code> marker
suppress a
reviewed site (marker suppression is line-gated). A genuinely-unchecked
malloc
still fires. This is why a real null-check fix (proven
<code>stubs.c</code>) previously
failed to clear.</li>
<li><strong>DynamicCodeExecution (JS/Python) is word-boundary
aware.</strong> <code>contains("eval(")</code>
matched FFI symbol names like <code>proven_calculator_eval(</code>. Now
<code>\beval\s*\(</code>
(and <code>\b(?:eval|exec)\s*\(</code> for Python); a genuine
<code>eval(</code> still fires.</li>
<li><strong>CommandInjection (Shell) no longer matches the
<code>--eval</code> CLI flag.</strong>
<code>contains("eval ")</code> matched
<code>--eval</code>/<code>-eval</code>. Now the eval builtin is matched
only in statement position (<code>(?m)(?:^|[\s;&|(])eval[
\t]</code>).</li>
</ul>
<p>Verified end-to-end: proven 1→0 active Critical/High
(<code>stubs.c</code> clears),
paint-type 36→35 (gossamer <code>--eval</code> benchmark FP clears;
genuinely-unsafe
vendored FFI + the irreducible <code>believe_me</code> axiom correctly
remain). 4 new
tests in <code>tests/analyzer_tests.rs</code>; full analyzer suite
green; zero warnings.
PR <a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/134">#134</a>.
Refs <a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/32">#32</a>.</p>
<h3>Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME
§3.2)</h3>
<ul>
<li><strong><code>src/abi/AttestationUnforgeability.idr</code></strong>:
Idris2 proof that the
intent→evidence→seal attestation chain is unforgeable. Models
<code>chain_hash = H(intent‖evidence‖report)</code> + the Ed25519
signature with the
cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA
message- and signer-binding, signature correctness) as a
<code>parameters</code>
block — hypotheses, <strong>not</strong> <code>postulate</code> (PA021
bans escape hatches), so it
is an honest <em>conditional</em> theorem. Under <code>%default
total</code> it Qed-closes
<code>integrity</code> (tampering any phase invalidates the seal),
<code>authenticity</code>
(a verifying seal comes from the matching key), and
<code>nonRepudiation</code>
(a genuine seal verifies), plus two corollaries. Typechecks under Idris2
0.8.0. Closes <a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/123">#123</a>.</li>
</ul>
<h3>Added — contractile registry (INDEX.a2ml)</h3>
<ul>
<li><strong><code>.machine_readable/contractiles/INDEX.a2ml</code></strong>:
the previously-missing
contractile registry, modelled on echidna's canonical INDEX. Catalogues
all</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/774dceb6373d798ad4d96a9e40c3993942c2836e"><code>774dceb</code></a>
chore(deps): bump the rust-minor group with 3 updates (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/166">#166</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/870fed7d37bee251d0c9ef9f1bcfa6df0bac6119"><code>870fed7</code></a>
feat(ci): add fail_on_severity so the scan gate can actually fail (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/169">#169</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/d0321858103cbf307ef1e1c928ec1bdfaa4a396f"><code>d032185</code></a>
ci: vendor validation scripts and remove remote action pins</li>
<li>See full diff in <a
href="https://github.com/hyperpolymath/panic-attack/compare/38e2d15c9535b3e0bfd86a01f13825ce5adfc482...774dceb6373d798ad4d96a9e40c3993942c2836e">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Copy file name to clipboardExpand all lines: .github/workflows/security-scan.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -20,6 +20,6 @@ permissions:
20
20
21
21
jobs:
22
22
scan:
23
-
uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@38e2d15c9535b3e0bfd86a01f13825ce5adfc482# main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
23
+
uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@774dceb6373d798ad4d96a9e40c3993942c2836e# main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
0 commit comments