chore(nix): bump rust-overlay from `5b5c521` to `47ab6c7` by dependabot[bot] · Pull Request #88 · hyperpolymath/reasonably-good-token-vault

dependabot · 2026-05-25T20:06:58Z

Bumps rust-overlay from 5b5c521 to 47ab6c7.

Commits

47ab6c7 manifest: update
3a58b19 manifest: update
d9973e2 manifest: update
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [rust-overlay](https://github.com/oxalica/rust-overlay) from `5b5c521` to `47ab6c7`. - [Commits](oxalica/rust-overlay@5b5c521...47ab6c7) --- updated-dependencies: - dependency-name: rust-overlay dependency-version: 47ab6c7b3c6a68beac60067490240efa32ae344c dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-25T20:06:59Z

Labels

The following labels could not be found: nix. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-05-25T20:07:51Z

🔍 Hypatia Security Scan

Findings: 84 issues detected

Severity	Count
🔴 Critical	0
🟠 High	58
🟡 Medium	26

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "mirror.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "mem::forget leaks memory by skipping Drop (1 occurrences, CWE-401)",
    "type": "mem_forget",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/rgtv-cli/src/main.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/vault-worker/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in reasonably-good-token-vault: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 3 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA001 -- Hypatia code_scanning_alerts: CSA001 -- 0 day(s) old",
    "type": "CSA001",
    "file": ".github/workflows/mirror.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA001 -- Hypatia code_scanning_alerts: CSA001 -- 0 day(s) old",
    "type": "CSA001",
    "file": ".github/workflows/lockdown.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-05-25T21:38:29Z

🔍 Hypatia Security Scan

Findings: 86 issues detected

Severity	Count
🔴 Critical	0
🟠 High	59
🟡 Medium	27

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "mirror.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "mem::forget leaks memory by skipping Drop (1 occurrences, CWE-401)",
    "type": "mem_forget",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/rgtv-cli/src/main.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/vault-worker/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in reasonably-good-token-vault: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/reasonably-good-token-vault/reasonably-good-token-vault",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 3 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA003 -- Hypatia code_scanning_alerts: CSA003 -- 0 day(s) old",
    "type": "CSA001",
    "file": "quality.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA003 -- Hypatia code_scanning_alerts: CSA003 -- 0 day(s) old",
    "type": "CSA001",
    "file": "governance.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_scanning_alerts/CSA003 -- Hypatia code_scanning_alerts: CSA003 -- 0 day(s) old",
    "type": "CSA001",
    "file": "mirror.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

PR #82 bumped ureq 2.12.1 → 3.3.0 in /rgtv-cli but did not migrate the call sites, leaving main red since 2026-05-22 (`Check / Fmt / Clippy / Test (rgtv-cli)` failing on every PR including dependabot bumps #87, #88). The TODO in Cargo.toml flagged the remaining work. This commit completes the migration: - AgentBuilder → Agent::config_builder().build().into() - timeout_read/timeout_write → timeout_recv_body/timeout_send_body - http_status_as_error(false) keeps 4xx/5xx as Ok responses so the broker's structured error body is still surfaceable - RequestBuilder::set → RequestBuilder::header - Response::into_string / into_json → body_mut().read_to_string() then serde_json::from_str, factored into parse_response() so the broker error-body fast path lives in one place - POST with no body now uses send_empty() (call() is WithoutBody-only in v3) - ureq_err() simplified to the transport-error path; HTTP-status errors flow through parse_response() Verified locally (matches the Rust CI pipeline): - cargo fmt --check OK - cargo check --all-targets OK - cargo clippy --all-targets -- -D warnings OK - cargo test OK After this lands, `@dependabot rebase` on #87 (nixpkgs) and #88 (rust-overlay) should bring them green; the only remaining failing check on those PRs is `analyze (javascript-typescript, none)` (CodeQL workflow drift, not caused by the dependabot bumps). Foundational follow-up (NOT in this PR, flagged for owner action): the underlying reason a red-CI dependabot PR ever reached main is that `main` branch protection has no `required_status_checks` block — see `gh api repos/.../branches/main/protection`. Adding the Rust CI checks to required status checks would prevent another silent red-bump merge. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…) (#89) ## Summary PR #82 bumped `ureq` 2.12.1 → 3.3.0 in `/rgtv-cli` but didn't migrate the call sites. Main has been red on `Check / Fmt / Clippy / Test (rgtv-cli)` since 2026-05-22, and that's the actual blocker on the open dependabot PRs (#87 nixpkgs, #88 rust-overlay) — they inherit the baseline red, the bumps themselves are clean. This PR completes the migration: - `AgentBuilder` → `Agent::config_builder().build().into()` - `timeout_read` / `timeout_write` → `timeout_recv_body` / `timeout_send_body` - `http_status_as_error(false)` keeps 4xx/5xx as `Ok` responses so the broker's structured error body is still surfaceable - `RequestBuilder::set` → `RequestBuilder::header` - `Response::into_string` / `into_json` → `body_mut().read_to_string()` + `serde_json::from_str`, factored into `parse_response()` so the broker error-body fast path lives in one place - POST with no body now uses `send_empty()` (`call()` is `WithoutBody`-only in v3) - `ureq_err()` simplified to the transport-error path; HTTP-status errors flow through `parse_response()` ## Test plan Verified locally (matches the Rust CI pipeline `working-directory: rgtv-cli`): - [x] `cargo fmt --check` - [x] `cargo check --all-targets` - [x] `RUSTFLAGS="-D warnings" cargo clippy --all-targets -- -D warnings` - [x] `cargo test` vault-broker / vault-worker were already green and are unchanged. ## Unblocking #87 and #88 Once this merges, comment `@dependabot rebase` on each. The only remaining failing check on those PRs is `analyze (javascript-typescript, none)` (CodeQL workflow drift, unrelated to the dep bumps). ## Foundational follow-up — flagged, not done here The reason a red-CI dependabot PR ever reached main is that **`main` branch protection has no `required_status_checks` block**: ``` gh api repos/hyperpolymath/reasonably-good-token-vault/branches/main/protection # no required_status_checks key present ``` Adding the four Rust CI checks (`Check / Fmt / Clippy / Test (rgtv-cli)`, `Check / Fmt / Clippy / Test (vault-broker)`, `vault-worker WASM build`, plus `cargo check` for confidence) to required status checks on `main` would prevent another silent red-bump merge. I haven't touched branch protection here — that's a shared-state owner-level action and wants explicit approval. I'm also propagating a Hypatia rule that detects this estate-wide so other repos missing required-status-checks get flagged automatically — separate PR on the hypatia repo. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dependabot · 2026-05-27T05:30:24Z

A newer version of rust-overlay exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

dependabot Bot added the dependencies Pull requests that update a dependency file label May 25, 2026

Merge branch 'main' into dependabot/nix/rust-overlay-47ab6c7

6f541c4

hyperpolymath mentioned this pull request May 25, 2026

fix(rgtv-cli): migrate to ureq 3.x API (repairs main; unblocks #87, #88) #89

Merged

4 tasks

hyperpolymath merged commit 6d81b24 into main May 27, 2026
33 of 38 checks passed

hyperpolymath deleted the dependabot/nix/rust-overlay-47ab6c7 branch May 27, 2026 12:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(nix): bump rust-overlay from `5b5c521` to `47ab6c7`#88

chore(nix): bump rust-overlay from `5b5c521` to `47ab6c7`#88
hyperpolymath merged 2 commits into
mainfrom
dependabot/nix/rust-overlay-47ab6c7

dependabot Bot commented on behalf of github May 25, 2026

Uh oh!

dependabot Bot commented on behalf of github May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

dependabot Bot commented on behalf of github May 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 25, 2026

Uh oh!

dependabot Bot commented on behalf of github May 25, 2026

Labels

Uh oh!

github-actions Bot commented May 25, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented May 25, 2026

🔍 Hypatia Security Scan

Uh oh!

dependabot Bot commented on behalf of github May 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant