chore(nix): bump nixpkgs from nixos-25.11 to nixos-26.05 by dependabot[bot] · Pull Request #87 · hyperpolymath/reasonably-good-token-vault

dependabot · 2026-05-25T20:06:53Z

Bumps nixpkgs from nixos-25.11 to nixos-26.05.

Commits

705e992 26.05 beta release
e6d53f7 pihole-ftl: 6.6.1 -> 6.6.2 (#523335)
987b916 otfcc: fix build (#523361)
a0fc422 python31{3,4}Packages.ecdsa: fix build failure (#523363)
14f0a59 python3Packages.salmon-mail: fix test_main exit code on click 8.2+ (#523372)
aa91ecf doc/release-notes: move enteries to correct release (#523459)
e397801 treewide: replace lib.trivial.release with hardcode version (hack) (#517985)
b3bb8a9 python3Packages.solidpython2: skip example 18 with missing reference fixture ...
b1a57b9 home-assistant-custom-components.waste_collection_schedule: 2.24.0 -> 2.25.0 ...
56a234d teams-for-linux: 2.9.0 -> 2.10.0 (#523399)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [nixpkgs](https://github.com/NixOS/nixpkgs) from nixos-25.11 to nixos-26.05. - [Commits](NixOS/nixpkgs@687f05a...705e992) --- updated-dependencies: - dependency-name: nixpkgs dependency-version: 705e9929918b43bd7b715dc0a878ac870449bb03 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-25T20:06:54Z

Labels

The following labels could not be found: nix. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-05-25T20:07:48Z

🔍 Hypatia Security Scan

Findings: 84 issues detected

Severity	Count
🔴 Critical	0
🟠 High	58
🟡 Medium	26

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "mirror.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "mem::forget leaks memory by skipping Drop (1 occurrences, CWE-401)",
    "type": "mem_forget",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/rgtv-cli/src/main.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/vault-worker/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in reasonably-good-token-vault: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 3 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA001 -- Hypatia code_scanning_alerts: CSA001 -- 0 day(s) old",
    "type": "CSA001",
    "file": ".github/workflows/mirror.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA001 -- Hypatia code_scanning_alerts: CSA001 -- 0 day(s) old",
    "type": "CSA001",
    "file": ".github/workflows/lockdown.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-05-25T21:21:39Z

🔍 Hypatia Security Scan

Findings: 86 issues detected

Severity	Count
🔴 Critical	0
🟠 High	59
🟡 Medium	27

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "mirror.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "mem::forget leaks memory by skipping Drop (1 occurrences, CWE-401)",
    "type": "mem_forget",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/rgtv-cli/src/main.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/vault-worker/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in reasonably-good-token-vault: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 3 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA003 -- Hypatia code_scanning_alerts: CSA003 -- 0 day(s) old",
    "type": "CSA001",
    "file": "quality.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA003 -- Hypatia code_scanning_alerts: CSA003 -- 0 day(s) old",
    "type": "CSA001",
    "file": "governance.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA003 -- Hypatia code_scanning_alerts: CSA003 -- 0 day(s) old",
    "type": "CSA001",
    "file": "mirror.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

PR #82 bumped ureq 2.12.1 → 3.3.0 in /rgtv-cli but did not migrate the call sites, leaving main red since 2026-05-22 (`Check / Fmt / Clippy / Test (rgtv-cli)` failing on every PR including dependabot bumps #87, #88). The TODO in Cargo.toml flagged the remaining work. This commit completes the migration: - AgentBuilder → Agent::config_builder().build().into() - timeout_read/timeout_write → timeout_recv_body/timeout_send_body - http_status_as_error(false) keeps 4xx/5xx as Ok responses so the broker's structured error body is still surfaceable - RequestBuilder::set → RequestBuilder::header - Response::into_string / into_json → body_mut().read_to_string() then serde_json::from_str, factored into parse_response() so the broker error-body fast path lives in one place - POST with no body now uses send_empty() (call() is WithoutBody-only in v3) - ureq_err() simplified to the transport-error path; HTTP-status errors flow through parse_response() Verified locally (matches the Rust CI pipeline): - cargo fmt --check OK - cargo check --all-targets OK - cargo clippy --all-targets -- -D warnings OK - cargo test OK After this lands, `@dependabot rebase` on #87 (nixpkgs) and #88 (rust-overlay) should bring them green; the only remaining failing check on those PRs is `analyze (javascript-typescript, none)` (CodeQL workflow drift, not caused by the dependabot bumps). Foundational follow-up (NOT in this PR, flagged for owner action): the underlying reason a red-CI dependabot PR ever reached main is that `main` branch protection has no `required_status_checks` block — see `gh api repos/.../branches/main/protection`. Adding the Rust CI checks to required status checks would prevent another silent red-bump merge. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…) (#89) ## Summary PR #82 bumped `ureq` 2.12.1 → 3.3.0 in `/rgtv-cli` but didn't migrate the call sites. Main has been red on `Check / Fmt / Clippy / Test (rgtv-cli)` since 2026-05-22, and that's the actual blocker on the open dependabot PRs (#87 nixpkgs, #88 rust-overlay) — they inherit the baseline red, the bumps themselves are clean. This PR completes the migration: - `AgentBuilder` → `Agent::config_builder().build().into()` - `timeout_read` / `timeout_write` → `timeout_recv_body` / `timeout_send_body` - `http_status_as_error(false)` keeps 4xx/5xx as `Ok` responses so the broker's structured error body is still surfaceable - `RequestBuilder::set` → `RequestBuilder::header` - `Response::into_string` / `into_json` → `body_mut().read_to_string()` + `serde_json::from_str`, factored into `parse_response()` so the broker error-body fast path lives in one place - POST with no body now uses `send_empty()` (`call()` is `WithoutBody`-only in v3) - `ureq_err()` simplified to the transport-error path; HTTP-status errors flow through `parse_response()` ## Test plan Verified locally (matches the Rust CI pipeline `working-directory: rgtv-cli`): - [x] `cargo fmt --check` - [x] `cargo check --all-targets` - [x] `RUSTFLAGS="-D warnings" cargo clippy --all-targets -- -D warnings` - [x] `cargo test` vault-broker / vault-worker were already green and are unchanged. ## Unblocking #87 and #88 Once this merges, comment `@dependabot rebase` on each. The only remaining failing check on those PRs is `analyze (javascript-typescript, none)` (CodeQL workflow drift, unrelated to the dep bumps). ## Foundational follow-up — flagged, not done here The reason a red-CI dependabot PR ever reached main is that **`main` branch protection has no `required_status_checks` block**: ``` gh api repos/hyperpolymath/reasonably-good-token-vault/branches/main/protection # no required_status_checks key present ``` Adding the four Rust CI checks (`Check / Fmt / Clippy / Test (rgtv-cli)`, `Check / Fmt / Clippy / Test (vault-broker)`, `vault-worker WASM build`, plus `cargo check` for confidence) to required status checks on `main` would prevent another silent red-bump merge. I haven't touched branch protection here — that's a shared-state owner-level action and wants explicit approval. I'm also propagating a Hypatia rule that detects this estate-wide so other repos missing required-status-checks get flagged automatically — separate PR on the hypatia repo. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-26T00:59:47Z

🔍 Hypatia Security Scan

Findings: 94 issues detected

Severity	Count
🔴 Critical	0
🟠 High	63
🟡 Medium	31

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "mirror.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "mem::forget leaks memory by skipping Drop (1 occurrences, CWE-401)",
    "type": "mem_forget",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/rgtv-cli/src/main.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/vault-worker/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in reasonably-good-token-vault: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 3 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA001 -- Hypatia code_scanning_alerts: CSA001 -- 0 day(s) old",
    "type": "CSA001",
    "file": "governance.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA001 -- Hypatia code_scanning_alerts: CSA001 -- 0 day(s) old",
    "type": "CSA001",
    "file": "mirror.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA001 -- Hypatia code_scanning_alerts: CSA001 -- 0 day(s) old",
    "type": "CSA001",
    "file": "reasonably-good-token-vault",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

dependabot Bot added the dependencies Pull requests that update a dependency file label May 25, 2026

dependabot Bot requested a review from hyperpolymath as a code owner May 25, 2026 20:06

dependabot Bot added the dependencies Pull requests that update a dependency file label May 25, 2026

hyperpolymath approved these changes May 25, 2026

View reviewed changes

Merge branch 'main' into dependabot/nix/nixpkgs-nixos-26.05

4f44926

hyperpolymath mentioned this pull request May 25, 2026

fix(rgtv-cli): migrate to ureq 3.x API (repairs main; unblocks #87, #88) #89

Merged

4 tasks

Merge branch 'main' into dependabot/nix/nixpkgs-nixos-26.05

cfe9809

hyperpolymath merged commit bf6db5b into main May 26, 2026
39 checks passed

hyperpolymath deleted the dependabot/nix/nixpkgs-nixos-26.05 branch May 26, 2026 01:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(nix): bump nixpkgs from nixos-25.11 to nixos-26.05#87

chore(nix): bump nixpkgs from nixos-25.11 to nixos-26.05#87
hyperpolymath merged 3 commits into
mainfrom
dependabot/nix/nixpkgs-nixos-26.05

dependabot Bot commented on behalf of github May 25, 2026

Uh oh!

dependabot Bot commented on behalf of github May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 25, 2026

Uh oh!

dependabot Bot commented on behalf of github May 25, 2026

Labels

Uh oh!

github-actions Bot commented May 25, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented May 25, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented May 26, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant