chore(deps): bump the actions group with 5 updates (#290)

dependabot[bot] · hyperpolymath · web-flow · commit d29898110cc1 · 2026-07-01T11:50:40.000Z
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps the actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.0.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.4.0` | `4.1.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.0` | `2.82.4` | | [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail) | `6e502825a508b867ab2954ad6343b68787624c01` | `994f270325d4f7257aff241a35488ef54ba364a4` | | [hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack) | `3f7d0bbed133629b62052fd181a84e4e1c774f9a` | `1c38f3379a3491504c3ea8bf80c3ddc48a497af7` | Updates `actions/cache` from 5.0.5 to 6.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant &quot;Cache save failed&quot; warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li><a href="https://github.com/actions/cache/commit/b9bf592b98b6a5d0cad9929c76247de1cac78abe"><code>b9bf592</code></a> Update documentation for v6 release</li> <li><a href="https://github.com/actions/cache/commit/80f777761d0990932f64ed2740522d7226a49062"><code>80f7777</code></a> Update packages, migrate to ESM</li> <li>See full diff in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...2c8a9bd7457de244a408f35966fab2fb45fda9c8">compare view</a></li> </ul> </details> <br /> Updates `actions/attest-build-provenance` from 2.4.0 to 4.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/attest-build-provenance/releases">actions/attest-build-provenance's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <blockquote> <p>[!NOTE] As of version 4, <code>actions/attest-build-provenance</code> is simply a wrapper on top of <a href="https://github.com/actions/attest"><code>actions/attest</code></a>.</p> <p>Existing applications may continue to use the <code>attest-build-provenance</code> action, but new implementations should use <code>actions/attest</code> instead.</p> </blockquote> <h2>What's Changed</h2> <ul> <li>Update RELEASE.md docs by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/836">actions/attest-build-provenance#836</a></li> <li>Bump <code>actions/attest</code> from 4.0.0 to 4.1.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/838">actions/attest-build-provenance#838</a> <ul> <li>Bump <code>@actions/attest</code> from 3.0.0 to 3.1.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/362">actions/attest#362</a></li> <li>Bump <code>@actions/attest</code> from 3.1.0 to 3.2.0 by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/365">actions/attest#365</a></li> <li>Add new <code>subject-version</code> input for inclusion in storage record by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/364">actions/attest#364</a></li> <li>Add storage record content to README by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest/pull/366">actions/attest#366</a></li> </ul> </li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0">https://github.com/actions/attest-build-provenance/compare/v4.0.0...v4.1.0</a></p> <h2>v4.0.0</h2> <blockquote> <p>[!NOTE] As of version 4, <code>actions/attest-build-provenance</code> is simply a wrapper on top of <a href="https://github.com/actions/attest"><code>actions/attest</code></a>.</p> <p>Existing applications may continue to use the <code>attest-build-provenance</code> action, but new implementations should use <code>actions/attest</code> instead.</p> </blockquote> <h2>What's Changed</h2> <ul> <li>Prepare v4 release by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/835">actions/attest-build-provenance#835</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0">https://github.com/actions/attest-build-provenance/compare/v3.2.0...v4.0.0</a></p> <h2>v3.2.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@​actions/core</code> from 1.11.1 to 2.0.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/776">actions/attest-build-provenance#776</a></li> <li>Add more documentation on Artifact Metadata Storage Records by <a href="https://github.com/malancas"><code>@​malancas</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/797">actions/attest-build-provenance#797</a></li> <li>Update actions/attest to latest version v3.2.0 by <a href="https://github.com/malancas"><code>@​malancas</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/812">actions/attest-build-provenance#812</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0">https://github.com/actions/attest-build-provenance/compare/v3.1.0...v3.2.0</a></p> <h2>v3.1.0</h2> <h2>What's Changed</h2> <ul> <li>Prepare v3 release by <a href="https://github.com/bdehamer"><code>@​bdehamer</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/697">actions/attest-build-provenance#697</a></li> <li>Bump js-yaml from 3.14.1 to 3.14.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/749">actions/attest-build-provenance#749</a></li> <li>Bump tar from 7.5.1 to 7.5.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/753">actions/attest-build-provenance#753</a></li> <li>Bump glob from 10.4.5 to 10.5.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/754">actions/attest-build-provenance#754</a></li> <li>Bump <code>@​types/node</code> from 24.10.1 to 25.0.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/774">actions/attest-build-provenance#774</a></li> <li>Bump <code>@​actions/attest</code> from 1.6.0 to 2.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/736">actions/attest-build-provenance#736</a></li> <li>Bump <code>@​actions/attest</code> from 2.0.0 to 2.1.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/775">actions/attest-build-provenance#775</a></li> <li>Add support for creating artifact metadata storage records by <a href="https://github.com/malancas"><code>@​malancas</code></a> in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/779">actions/attest-build-provenance#779</a></li> </ul> <h2>New Contributors</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/attest-build-provenance/commit/a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32"><code>a2bbfa2</code></a> bump actions/attest from 4.0.0 to 4.1.0 (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/838">#838</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/0856891a35570e4ac506b510f0358a4308f82385"><code>0856891</code></a> update RELEASE.md docs (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/836">#836</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/e4d4f7c39adfa4c260fb5c147f0622000aa14b99"><code>e4d4f7c</code></a> prepare v4 release (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/835">#835</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/02a49bdc410a809733602220c6f6275925d6b578"><code>02a49bd</code></a> Bump github/codeql-action in the actions-minor group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/824">#824</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/7c757df4145fcd233331998e58b20b422c833a00"><code>7c757df</code></a> Bump the npm-development group with 2 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/825">#825</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/c44148e5bf178192efd8947e07a0d439a356c60b"><code>c44148e</code></a> Bump github/codeql-action in the actions-minor group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/818">#818</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/32343527f2ec94583cf7b31280de0f60dc9f0bf9"><code>3234352</code></a> Bump <code>@​types/node</code> from 25.0.10 to 25.2.0 in the npm-development group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/819">#819</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/18db12979d4cecda10c1cf295bcb159f3e59866d"><code>18db129</code></a> Bump tar from 7.5.6 to 7.5.7 (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/816">#816</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/90fadfae6ba2e2ef59f8d38e61ec3cf16443a18e"><code>90fadfa</code></a> Bump <code>@​actions/core</code> from 2.0.1 to 2.0.2 in the npm-production group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/799">#799</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/57db8ba356515a4c8608990f2aa27a6972235ccc"><code>57db8ba</code></a> Bump the npm-development group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/808">#808</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/attest-build-provenance/compare/e8998f949152b193b063cb0ec769d69d929409be...a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32">compare view</a></li> </ul> </details> <br /> Updates `taiki-e/install-action` from 2.82.0 to 2.82.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.82.4</h2> <ul> <li> <p>Update <code>uv@latest</code> to 0.11.24.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.13.</p> </li> <li> <p>Update <code>just@latest</code> to 1.54.0.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.1.</p> </li> </ul> <h2>2.82.3</h2> <ul> <li> <p>Update <code>zizmor@latest</code> to 1.26.1.</p> </li> <li> <p>Update <code>wasmtime@latest</code> to 46.0.0.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.1.5.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.12.</p> </li> <li> <p>Update <code>kingfisher@latest</code> to 1.104.0.</p> </li> <li> <p>Update <code>cargo-tarpaulin@latest</code> to 0.35.5.</p> </li> <li> <p>Update <code>cargo-nextest@latest</code> to 0.9.138.</p> </li> <li> <p>Update <code>cargo-crap@latest</code> to 0.3.0.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.20.1.</p> </li> <li> <p>Update <code>cargo-rdme@latest</code> to 2.0.1.</p> </li> </ul> <h2>2.82.2</h2> <ul> <li> <p>Update <code>xh@latest</code> to 0.26.1.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.23.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.71.2.</p> </li> <li> <p>Update <code>sccache@latest</code> to 0.16.0.</p> </li> </ul> <h2>2.82.1</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.4.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.22.</p> </li> <li> <p>Update <code>osv-scanner@latest</code> to 2.4.0.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.11.</p> </li> <li> <p>Update <code>martin@latest</code> to 1.11.0.</p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>  <h2>[Unreleased]</h2> <h2>[2.82.4] - 2026-06-25</h2> <ul> <li> <p>Update <code>uv@latest</code> to 0.11.24.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.13.</p> </li> <li> <p>Update <code>just@latest</code> to 1.54.0.</p> </li> <li> <p>Update <code>biome@latest</code> to 2.5.1.</p> </li> </ul> <h2>[2.82.3] - 2026-06-24</h2> <ul> <li> <p>Update <code>zizmor@latest</code> to 1.26.1.</p> </li> <li> <p>Update <code>wasmtime@latest</code> to 46.0.0.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.1.5.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.12.</p> </li> <li> <p>Update <code>kingfisher@latest</code> to 1.104.0.</p> </li> <li> <p>Update <code>cargo-tarpaulin@latest</code> to 0.35.5.</p> </li> <li> <p>Update <code>cargo-nextest@latest</code> to 0.9.138.</p> </li> <li> <p>Update <code>cargo-crap@latest</code> to 0.3.0.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.20.1.</p> </li> <li> <p>Update <code>cargo-rdme@latest</code> to 2.0.1.</p> </li> </ul> <h2>[2.82.2] - 2026-06-21</h2> <ul> <li> <p>Update <code>xh@latest</code> to 0.26.1.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.23.</p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/682e7d9e49c5e653d371fc6adbda67653461378a"><code>682e7d9</code></a> Release 2.82.4</li> <li><a href="https://github.com/taiki-e/install-action/commit/88e83503037db61d4f066a4d9cb32e6fc06b70c2"><code>88e8350</code></a> Update wasmtime manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/cf0e00b44cf05faddafcc8082c6c2366e2a02380"><code>cf0e00b</code></a> Update wasm-bindgen manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/a130ea674166df9065f363cbb53f1f2bc4a6298c"><code>a130ea6</code></a> Update vacuum manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/0bdcc65dc21d0ae46842dc5ad063d69ce8991365"><code>0bdcc65</code></a> Update <code>uv@latest</code> to 0.11.24</li> <li><a href="https://github.com/taiki-e/install-action/commit/3f52215559b820ee57b68e3fa9b38f6cd205e9c8"><code>3f52215</code></a> Update <code>mise@latest</code> to 2026.6.13</li> <li><a href="https://github.com/taiki-e/install-action/commit/294a073b0ebe66401c699c21b98e9ecb5a6da735"><code>294a073</code></a> Update <code>just@latest</code> to 1.54.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/f9bf24932b3cbfe7ae26b5addcd257989e14ec4d"><code>f9bf249</code></a> Update cargo-rdme manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/98288d38cbfc5fa065ff61c6971d50dc3ba7d408"><code>98288d3</code></a> Update <code>biome@latest</code> to 2.5.1</li> <li><a href="https://github.com/taiki-e/install-action/commit/ace6ebe54a6a0c86dfb5f7764b17f793b6925bc3"><code>ace6ebe</code></a> Release 2.82.3</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/b8cecb83565409bcc297b2df6e77f030b2a468d5...682e7d9e49c5e653d371fc6adbda67653461378a">compare view</a></li> </ul> </details> <br /> Updates `dawidd6/action-send-mail` from 6e502825a508b867ab2954ad6343b68787624c01 to 994f270325d4f7257aff241a35488ef54ba364a4 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dawidd6/action-send-mail/commit/994f270325d4f7257aff241a35488ef54ba364a4"><code>994f270</code></a> build(deps): bump undici from 6.24.1 to 6.27.0 (<a href="https://redirect.github.com/dawidd6/action-send-mail/issues/301">#301</a>)</li> <li><a href="https://github.com/dawidd6/action-send-mail/commit/94de994a9f6fffee200243214e17002e2920bb59"><code>94de994</code></a> fix: Use extended HELLO with github.com domain (<a href="https://redirect.github.com/dawidd6/action-send-mail/issues/302">#302</a>)</li> <li>See full diff in <a href="https://github.com/dawidd6/action-send-mail/compare/6e502825a508b867ab2954ad6343b68787624c01...994f270325d4f7257aff241a35488ef54ba364a4">compare view</a></li> </ul> </details> <br /> Updates `hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from 3f7d0bbed133629b62052fd181a84e4e1c774f9a to 1c38f3379a3491504c3ea8bf80c3ddc48a497af7 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog</a>.</em></p> <blockquote>   <h1>Changelog</h1> <h2>[Unreleased]</h2> <h3>Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME §3.2)</h3> <ul> <li><strong><code>src/abi/AttestationUnforgeability.idr</code></strong>: Idris2 proof that the intent→evidence→seal attestation chain is unforgeable. Models <code>chain_hash = H(intent‖evidence‖report)</code> + the Ed25519 signature with the cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA message- and signer-binding, signature correctness) as a <code>parameters</code> block — hypotheses, <strong>not</strong> <code>postulate</code> (PA021 bans escape hatches), so it is an honest <em>conditional</em> theorem. Under <code>%default total</code> it Qed-closes <code>integrity</code> (tampering any phase invalidates the seal), <code>authenticity</code> (a verifying seal comes from the matching key), and <code>nonRepudiation</code> (a genuine seal verifies), plus two corollaries. Typechecks under Idris2 0.8.0. Closes <a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/123">#123</a>.</li> </ul> <h3>Added — contractile registry (INDEX.a2ml)</h3> <ul> <li><strong><code>.machine_readable/contractiles/INDEX.a2ml</code></strong>: the previously-missing contractile registry, modelled on echidna's canonical INDEX. Catalogues all six verbs (must / trust / intend / adjust / bust / dust) with their <em>actual current locations</em> across the three pre-consolidation trees, flags the duplicate <code>trust</code> Trustfile, and records the canonical trident target. The physical consolidation of the three trees stays in <a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/124">#124</a> — it couples to the <code>contractile gen-just</code> generator (which reads the root <code>contractiles/</code> tree) and needs the standards CONTRACTILE-SPEC to do safely.</li> </ul> <h3>Added — <code>assay</code> / <code>assimilate</code> / <code>aggregate</code> proof-integration subcommands</h3> <p>Three new a-themed subcommands that wire panic-attack into the PROOF-PROGRAMME loop (survey → swap → fold-in-proofs):</p> <ul> <li><strong><code>panic-attack assay [TARGET] [--proven DIR]…</code></strong> (<code>src/assay/mod.rs</code>): surveys a target for code that has a formally proven drop-in equivalent in a <code>proven</code> / <code>proven-servers</code> library and reports each candidate with the proof artifact that backs it — operationalising the &quot;Proven cross-fit&quot; table in <code>PROOF-PROGRAMME.md</code> mechanically instead of by hand. Built-in catalogue: <code>SafePath</code> (canonicalize/unwrap pattern) and <code>SafeUrl</code> (<code>VERISIMDB_URL</code>). On this repo: <code>safe-path</code> <strong>Offered</strong> (port present in <code>src/safe_path.rs</code>, call sites still to rewire), <code>safe-url</code> <strong>NoReplacementSource</strong> (not yet ported).</li> <li><strong><code>panic-attack assimilate [TARGET] --candidate ID [--proven DIR] [--from FILE] [--all] [--dry-run]</code></strong>: performs a swap — stages the proven module into the tree, backs up the original (<code>*.orig</code>), and writes a provenance record (source BLAKE3 hash + proof backing + pending call-site rewires) under <code>.assimilated/</code>. Module swaps are automatic; call-site rewiring is reported, never auto-edited</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/1c38f3379a3491504c3ea8bf80c3ddc48a497af7"><code>1c38f33</code></a> chore(clade): backfill [status] lifecycle block (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/144">#144</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/c3bae9fbf88e54d746d2c2a75b3139b18cf5d992"><code>c3bae9f</code></a> chore(ci): add dormant push-email notification workflow (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/145">#145</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/7b0a08be61b6f0917e0d8eb3eacafd6d5be65cac"><code>7b0a08b</code></a> chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair) (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/143">#143</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/25f32b19ae346b9095ed90e761f6639c40d651ac"><code>25f32b1</code></a> chore(ci): bump standards reusable workflow pins (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/142">#142</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/07902dce03a86a3ff376d1b4db0e1805f3f57ef8"><code>07902dc</code></a> chore: extend owner SPDX header to all non-.rs sources (.md/.adoc/.idr/.zig) ...</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/479bf2d0e929343cd8f548450b679e35e69d4e55"><code>479bf2d</code></a> chore: add owner SPDX header to all .rs (satisfy licence-enforcer hook) (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/139">#139</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/3cffe6793727ea7269484faa7c50751adb3427ea"><code>3cffe67</code></a> chore(nix-&gt;guix): remove flake.nix (Guix-only) (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/140">#140</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/826d541d505c1ace30def4389f51a1032ce0d962"><code>826d541</code></a> test(aggregate): ideal Idris2 proof fixture + end-to-end fold test (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/138">#138</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/0d89586e35fa50b1be23298c4aecf11ad74aad46"><code>0d89586</code></a> docs: complete audience→axial rename drift in man page + docs (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/137">#137</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/b26acb08009902cdd10a757c334ae7fa80490bf1"><code>b26acb0</code></a> Claude/unbounded severity v2 (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/135">#135</a>)</li> <li>Additional commits viewable in <a href="https://github.com/hyperpolymath/panic-attack/compare/3f7d0bbed133629b62052fd181a84e4e1c774f9a...1c38f3379a3491504c3ea8bf80c3ddc48a497af7">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
diff --git a/.github/workflows/agda-meta-checker.yml b/.github/workflows/agda-meta-checker.yml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Cache Agda
         if: steps.detect.outputs.relevant == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: |
             ~/.cabal
diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml
@@ -88,14 +88,14 @@ jobs:
       #   gh attest verify oci://ghcr.io/${{ github.repository }}:<tag> \
       #     --repo ${{ github.repository }}
       - name: Attest container provenance (minimal image)
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.min_digest }}
           push-to-registry: true
 
       - name: Attest container provenance (full image)
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.full_digest }}
diff --git a/.github/workflows/mvp-smoke.yml b/.github/workflows/mvp-smoke.yml
@@ -39,7 +39,7 @@ jobs:
         uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # v2
 
       - name: Install just
-        uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
+        uses: taiki-e/install-action@682e7d9e49c5e653d371fc6adbda67653461378a # v2.82.4
         with:
           # Governance R1 requires versioned family-tool pins
           # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned
+        uses: dawidd6/action-send-mail@994f270325d4f7257aff241a35488ef54ba364a4 # pinned
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/s4-loop.yml b/.github/workflows/s4-loop.yml
@@ -39,7 +39,7 @@ jobs:
       - name: Cache Cargo
         uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # v2
       - name: Install just
-        uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
+        uses: taiki-e/install-action@682e7d9e49c5e653d371fc6adbda67653461378a # v2.82.4
         with:
           tool: just@1.51.0
       - name: Install system dependencies
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
@@ -20,6 +20,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@3f7d0bbed133629b62052fd181a84e4e1c774f9a # main 2026-05-20
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@1c38f3379a3491504c3ea8bf80c3ddc48a497af7 # main 2026-05-20
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}
