chore(deps): bump hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from e25cf0e7560e453c099bbe924c5e3701eb1822bd to d0321858103cbf307ef1e1c928ec1bdfaa4a396f in the actions group (#200)

dependabot[bot] · web-flow · commit 14df42270def · 2026-07-28T00:03:18.000+01:00
Bumps the actions group with 1 update: [hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack). Updates `hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from e25cf0e7560e453c099bbe924c5e3701eb1822bd to d0321858103cbf307ef1e1c928ec1bdfaa4a396f <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog</a>.</em></p> <blockquote>   <h1>Changelog</h1> <h2>[Unreleased]</h2> <h3>Fixed — assail detector precision (false-positive reduction, 2026-06-24)</h3> <p>Three <code>assail</code> analyzer fixes, all conservative (no new false negatives), found while triaging <a href="https://redirect.github.com/hyperpolymath/proven/issues/68">hyperpolymath/proven#68</a> and <a href="https://redirect.github.com/JoshuaJewell/paint-type/issues/86">JoshuaJewell/paint-type#86</a>:</p> <ul> <li><strong>UncheckedAllocation (C) is now NULL-check aware.</strong> The detector previously flagged <em>every</em> <code>malloc(...)</code> and emitted a line-less, file-level finding. It now scans per line, skips a malloc whose result is NULL-checked within a short window (<code>if (p == NULL)</code>, <code>if (!p)</code>, <code>nullptr</code>), and attaches a line number — which also lets an inline <code>// panic-attack: accepted</code> marker suppress a reviewed site (marker suppression is line-gated). A genuinely-unchecked malloc still fires. This is why a real null-check fix (proven <code>stubs.c</code>) previously failed to clear.</li> <li><strong>DynamicCodeExecution (JS/Python) is word-boundary aware.</strong> <code>contains(&quot;eval(&quot;)</code> matched FFI symbol names like <code>proven_calculator_eval(</code>. Now <code>\beval\s*\(</code> (and <code>\b(?:eval|exec)\s*\(</code> for Python); a genuine <code>eval(</code> still fires.</li> <li><strong>CommandInjection (Shell) no longer matches the <code>--eval</code> CLI flag.</strong> <code>contains(&quot;eval &quot;)</code> matched <code>--eval</code>/<code>-eval</code>. Now the eval builtin is matched only in statement position (<code>(?m)(?:^|[\s;&amp;|(])eval[ \t]</code>).</li> </ul> <p>Verified end-to-end: proven 1→0 active Critical/High (<code>stubs.c</code> clears), paint-type 36→35 (gossamer <code>--eval</code> benchmark FP clears; genuinely-unsafe vendored FFI + the irreducible <code>believe_me</code> axiom correctly remain). 4 new tests in <code>tests/analyzer_tests.rs</code>; full analyzer suite green; zero warnings. PR <a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/134">#134</a>. Refs <a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/32">#32</a>.</p> <h3>Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME §3.2)</h3> <ul> <li><strong><code>src/abi/AttestationUnforgeability.idr</code></strong>: Idris2 proof that the intent→evidence→seal attestation chain is unforgeable. Models <code>chain_hash = H(intent‖evidence‖report)</code> + the Ed25519 signature with the cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA message- and signer-binding, signature correctness) as a <code>parameters</code> block — hypotheses, <strong>not</strong> <code>postulate</code> (PA021 bans escape hatches), so it is an honest <em>conditional</em> theorem. Under <code>%default total</code> it Qed-closes <code>integrity</code> (tampering any phase invalidates the seal), <code>authenticity</code> (a verifying seal comes from the matching key), and <code>nonRepudiation</code> (a genuine seal verifies), plus two corollaries. Typechecks under Idris2 0.8.0. Closes <a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/123">#123</a>.</li> </ul> <h3>Added — contractile registry (INDEX.a2ml)</h3> <ul> <li><strong><code>.machine_readable/contractiles/INDEX.a2ml</code></strong>: the previously-missing contractile registry, modelled on echidna's canonical INDEX. Catalogues all</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/d0321858103cbf307ef1e1c928ec1bdfaa4a396f"><code>d032185</code></a> ci: vendor validation scripts and remove remote action pins</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/38e2d15c9535b3e0bfd86a01f13825ce5adfc482"><code>38e2d15</code></a> fix(ci): re-point validate-action references at the ecosystem repos (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/167">#167</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/3c0e28e3073b1d196f8894eb4841c0a6452cbc6e"><code>3c0e28e</code></a> feat: wire cargo-deny output into weak_points emission (<a href="https://redirect.github.com/hyperpolymath/panic-attack/issues/165">#165</a>)</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/2cad8bdc74e3fc372d6723d3e273f892b942a0ca"><code>2cad8bd</code></a> feat: wire cargo-deny output into weak_points emission</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/0f5786cbb939ed77ae7310507507b68492780c06"><code>0f5786c</code></a> sweep4: add C-A-G-M files</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/2157a6fcf86328f75afc52acc44549ddf634e151"><code>2157a6f</code></a> sweep3: add license files and SPDX identifiers</li> <li><a href="https://github.com/hyperpolymath/panic-attack/commit/73a0abc26d2a8e63ca3f576ae9c62266f9b3f726"><code>73a0abc</code></a> sweep2: add config files (mise.toml)</li> <li>See full diff in <a href="https://github.com/hyperpolymath/panic-attack/compare/e25cf0e7560e453c099bbe924c5e3701eb1822bd...d0321858103cbf307ef1e1c928ec1bdfaa4a396f">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
@@ -38,6 +38,6 @@ jobs:
     # Pin refreshed at the same time: the previous pin (2dc1393c, 2026-05-20)
     # predates the upstream fix that skips the cross-repo dispatch when
     # VERISIMDB_PAT is absent and that chunks oversized payloads.
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@e25cf0e7560e453c099bbe924c5e3701eb1822bd # main 2026-07-19
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@d0321858103cbf307ef1e1c928ec1bdfaa4a396f # main 2026-07-19
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}
