Commit 2704e0a
authored
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
build(deps): Bump the actions group with 3 updates (#108)
Bumps the actions group with 3 updates:
[actions/checkout](https://github.com/actions/checkout),
[github/codeql-action](https://github.com/github/codeql-action) and
[hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attacker).
Updates `actions/checkout` from 4.2.2 to 6.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by <a
href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p>
<h2>v6.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update all references from v5 and v4 to v6 by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
<li>Clarify v6 README by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>v6-beta by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
<li>update readme/changelog for v6 by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
<h2>v6-beta</h2>
<h2>What's Changed</h2>
<p>Updated persist-credentials to store the credentials under
<code>$RUNNER_TEMP</code> instead of directly in the local git
config.</p>
<p>This requires a minimum Actions Runner version of <a
href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a>
to access the persisted credentials for <a
href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker
container action</a> scenarios.</p>
<h2>v5.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a>
Update changelog for v6.0.3 (<a
href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824"><code>1cce339</code></a>
Fix checkout init for SHA-256 repositories (<a
href="https://redirect.github.com/actions/checkout/issues/2439">#2439</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231"><code>900f221</code></a>
fix: expand merge commit SHA regex and add SHA-256 test cases (<a
href="https://redirect.github.com/actions/checkout/issues/2414">#2414</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98"><code>0c366fd</code></a>
Update changelog (<a
href="https://redirect.github.com/actions/checkout/issues/2357">#2357</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd"><code>de0fac2</code></a>
Fix tag handling: preserve annotations and explicit fetch-tags (<a
href="https://redirect.github.com/actions/checkout/issues/2356">#2356</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49"><code>064fe7f</code></a>
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is
set (...</li>
<li><a
href="https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8"><code>8e8c483</code></a>
Clarify v6 README (<a
href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1"><code>033fa0d</code></a>
Add worktree support for persist-credentials includeIf (<a
href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5"><code>c2d88d3</code></a>
Update all references from v5 and v4 to v6 (<a
href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a>
update readme/changelog for v6 (<a
href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/v4.2.2...v6.0.3">compare
view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 4.36.0 to 4.36.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.36.1</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/87557b9c84dde89fdd9b10e88954ac2f4248e463"><code>87557b9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3940">#3940</a>
from github/update-v4.36.1-2a1689ed4</li>
<li><a
href="https://github.com/github/codeql-action/commit/94310119648b77e2153bf970fd244062806781de"><code>9431011</code></a>
Update changelog for v4.36.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/2a1689ed43ccdf7eea07e03a75371ce6801d28e6"><code>2a1689e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3939">#3939</a>
from github/henrymercer/skip-overlay-revert-when-exp...</li>
<li><a
href="https://github.com/github/codeql-action/commit/524532393a46071bdfc81527a811ffa69e16723a"><code>5245323</code></a>
Disable missing diff-ranges fallback when overlay enabled manually</li>
<li><a
href="https://github.com/github/codeql-action/commit/d1eb1207b45130d2edf64a0aa1c93be23510592f"><code>d1eb120</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3933">#3933</a>
from github/update-supported-enterprise-server-versions</li>
<li><a
href="https://github.com/github/codeql-action/commit/115001ba8d0198846992657731666b08686c8ded"><code>115001b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3934">#3934</a>
from github/dependabot/npm_and_yarn/npm-minor-86fb5c...</li>
<li><a
href="https://github.com/github/codeql-action/commit/cef2e7a910879f4626a24b251504bde16bfe4e76"><code>cef2e7a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3925">#3925</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/5e6adf70ed0299cdf20f90e4e37ac5dd30ab7501"><code>5e6adf7</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3936">#3936</a>
from github/dependabot/npm_and_yarn/tmp-0.2.7</li>
<li><a
href="https://github.com/github/codeql-action/commit/ad170e6c4eaf671895978420267d6cb49b66b706"><code>ad170e6</code></a>
Merge branch 'main' into
dependabot/github_actions/dot-github/workflows/actio...</li>
<li><a
href="https://github.com/github/codeql-action/commit/6a37b3a57ac457a679b84930a67c233c15f5ac41"><code>6a37b3a</code></a>
Rebuild</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...87557b9c84dde89fdd9b10e88954ac2f4248e463">compare
view</a></li>
</ul>
</details>
<br />
Updates
`hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml`
from ea88be7da68e07249ae7df8b948ecb8ecfb9664c to
2dc1393c0ac982dbad98ba07f78a580d319456a5
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>[Unreleased]</h2>
<h2>[2.5.5] — 2026-06-02</h2>
<p>Release of the v2.5.5 cohort that landed across 11 PRs in
panic-attack + wiki + gitbot-fleet on 2026-06-02 PM. Tagged 2026-06-02
PM-evening.</p>
<h3>Added (2026-06-02 PM) — v2.5.5 context-awareness cohort + v3.0.0
Chapel→VeriSimDB push + PROOF-PROGRAMME</h3>
<p>Eight PRs landed in one cohort closing the v2.5.5 ROADMAP section, a
v3.0.0 item, and opening the first proof slice of the new
PROOF-PROGRAMME.</p>
<p><strong>v2.5.5 — Attack Surface Widening (false-positive
reduction)</strong></p>
<ul>
<li><strong><code>test_context</code> foundation</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/102">#102</a>):
new <code>src/test_context.rs</code> module with cross-language
test-path classification (Rust / Python / Go / JavaScript / Julia / Zig
/ Elixir / docs-examples). New <code>WeakPoint.test_context:
Option<TestContext></code> field (Production / TestOnly / Doc)
plumbed through 137 construction sites. Content-based promotion via
<code>use ExUnit.Case</code> / <code>unittest.TestCase</code> /
<code>pytest.fixture</code> / <code>@testset</code> markers.</li>
<li><strong><code>comment_marker</code> inline suppression</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/105">#105</a>):
new <code>src/comment_marker.rs</code> module recognising <code>//
panic-attack: accepted [- reason]</code> on the same or preceding line.
Cross-language comment leaders: <code>//</code> mid-line for C-family;
<code>#</code> / <code>--</code> / <code>;</code> / <code>%</code> /
<code>///</code> / <code>//!</code> start-of-line for
Python/Haskell/Lisp/Erlang/Rust-doc/Rust-inner-doc. String-literal
aware. Shebang <code>#!</code> excluded.</li>
<li><strong><code>ffi_kind</code> subtyping</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/106">#106</a>):
new <code>src/ffi_kind.rs</code> module subtyping
<code>WeakPointCategory::UnsafeFFI</code> (PA013) into BuildSystem /
RuntimeAbi / TestMock / Unknown. <code>classify_by_path</code>
distinguishes <code>build.zig</code> / <code>build.rs</code>
(BuildSystem, audit-accepted by default) from <code>bindings/</code> /
<code>ffi/</code> / <code>sys/</code> / <code>cdef.zig</code>
(RuntimeAbi, audit-significant) from <code>tests/mocks/</code> /
<code>tests/stubs/</code> (TestMock, also audit-accepted). New
<code>is_audited_boundary(audit_text, file_path)</code> parses
<code>audits/audit-ffi-unsafe.md</code> <code>## Approved
boundaries</code> markdown.</li>
<li><strong><code>jit_context</code> classifier</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/107">#107</a>):
new <code>src/jit_context.rs</code> module classifying JIT frameworks —
Cranelift / Llvm / Wasm / Javascript / None. Factors existing inline
Cranelift detection at <code>analyzer.rs:1117..1129</code> into reusable
surface. <code>transmute_targets_fn_ptr</code> made tolerant of <code>=
unsafe { ... transmute(..) }</code> wrappers.</li>
<li><strong>Phase 2 analyzer wire-up</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/110">#110</a>):
new <code>apply_v255_context_suppression(&mut report)</code> runs
after the kanren-based rule pass and (a) marker-flips
<code>WeakPoint.suppressed = true</code> when <code>panic-attack:
accepted</code> is on or above the line, (b) auto-suppresses
<code>PanicPath</code> in TestOnly/Doc context, (c) auto-suppresses
<code>UnsafeFFI</code> in BuildSystem/TestMock context. Sets
<code>test_context</code> metadata on every finding with a known file
path.</li>
</ul>
<p><strong>v3.0.0 — Distributed Scanning (HTTP push from
Chapel)</strong></p>
<ul>
<li><strong><code>panic-attack verisim-push <hexad></code>
subcommand</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/108">#108</a>):
new <code>Commands::VerisimPush</code> gated on the <code>http</code>
Cargo feature. Reads a JSON hexad (typically what Chapel
<code>takeSnapshot</code> just wrote), POSTs to
<code>$VERISIMDB_URL</code> (default <code>http://localhost:8080</code>)
via the existing <code>storage::push_hexad_http_with_retry</code>.
<code>--fallback-dir</code> writes a JSON copy on HTTP failure for
offline replay.</li>
<li><strong>Chapel <code>takeSnapshot</code> overload</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/108">#108</a>):
new 6-arg form accepting <code>verisimPushUrl</code> +
<code>panicAttackBin</code> parameters. Spawns <code>panic-attack
verisim-push --url <url> --retry <hexad></code> after local
hexad write. Local writes remain authoritative; push is additive. Closes
the <code>[ ]</code> ROADMAP item.</li>
</ul>
<p><strong>PROOF-PROGRAMME — first-principles soundness</strong></p>
<ul>
<li><strong><code>PROOF-PROGRAMME.md</code></strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/104">#104</a>):
3-layer landscape (Surface / Engine / Persistence) covering all 25
PA-code soundness proofs + miniKanren correctness + bridge reachability
+ attestation chain unforgeability. 9-phase sequencing (~16 weeks).
Identifies <code>proven</code> cross-fit candidates: only
<code>SafePath</code> + <code>SafeUrl</code> qualify as port-to-Rust
(perf-neutral, semantic-equivalent); <code>SafeJson</code> /
<code>SafeRegex</code> / <code>SafeDateTime</code> /
<code>SafeCommand</code> / <code>SafeEnv</code> / <code>SafeUUID</code>
marked skip (already total / semantic mismatch).</li>
<li><strong>Layer 1.0 partial</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/111">#111</a>):
new <code>src/abi/Stripping.idr</code> Qed-closing the foundation lemmas
for line-comment stripping — <code>stripBodyProducesStrippedShape</code>
(every body output satisfies <code>IsStrippedBody</code>) + base cases
of <code>stripLineCommentsIdempotent</code> (empty + non-slash-headed
input). Open: the slash-slash inductive closure
<code>stripIsIdentityOnStrippedBody</code> (recorded as the next
Layer-1.0 slice in <code>PROOF-NEEDS.md</code>).</li>
</ul>
<h3>Changed (2026-06-02) — truthfulness audit (humans + machines)</h3>
<ul>
<li><strong>README badge + Status block</strong> corrected: 402 →
<strong>782 runnable tests</strong>
(per <code>cargo test --release -- --list</code>; the underlying 539
<code>#[test]</code>
annotations expand via doctests + integration tiers). The badge had
not tracked actual count for several releases. Wiki Home was
<code>282+</code>.</li>
<li><strong>chapel-ci <code>chapel-multilocale</code> gate</strong>
robustified (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/100">#100</a>
collateral):
pinned <code>CHPL_UNWIND=system</code> explicitly + moved
<code>libunwind-dev</code> install
to always-run (not gated on cache-hit). On cache-hit runs without
libunwind-dev, chpl auto-inferred <code>CHPL_UNWIND=bundled</code> and
aborted
with "no runtime for bundled" because the cached runtime was
built
with <code>system</code>. Cache-gen counter bumped <code>v1</code> →
<code>v2</code> to discard the
inconsistent cache. Fifth Chapel-2.8.0 sharp edge from <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/99">#99</a>
Wave 2.</li>
<li><strong>ROADMAP v2.2.0</strong>: downgraded "Per-project
VeriSimDB instance:
<code>deploy/panic-attack/fly.toml</code> for
<code>verisim-panic-api</code>" from <code>[x]</code> to
<code>[~]</code> — the API runs but the toml file is NOT in this repo
(lives in
the <code>verisimdb</code> deployment tree). The <code>[x]</code>
checkbox previously
pointed at a path that didn't exist on <code>main</code>.</li>
<li><strong>ROADMAP front matter + Wiki Home</strong>: "500+
repositories" replaced
with the empirically verifiable "303-repo hyperpolymath estate
(2026-04-12)" — the number that appears in</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/2dc1393c0ac982dbad98ba07f78a580d319456a5"><code>2dc1393</code></a>
feat(safe_path): port proven SafePath as pure-Rust + add traversal guard
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/11">#11</a>...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/833f3949500040bb860bc85fd7084fa61401765f"><code>833f394</code></a>
proofs(Layer 1.0): close slash-slash inductive case via mutual recursion
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/11">#11</a>...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/d5f3a4ff497c3ab7b77585662e702ac7ef602e07"><code>d5f3a4f</code></a>
release(v2.5.5): tag the 11-PR context-awareness cohort (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/118">#118</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/2fc73bd6f3b087effdf61428a20db1bfce00ab73"><code>2fc73bd</code></a>
docs(closeout): v2.5.5 cohort + v3.0.0 verisim-push + PROOF-PROGRAMME
compreh...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/ad1faf63878c25a748f72c0fd7e58c3a8dd682cc"><code>ad1faf6</code></a>
proofs(Layer 1.0): Idris2 stripping foundation — base cases + shape
lemma (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/111">#111</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/ad72e0687b42183a283c735d2e5d87c47a881601"><code>ad72e06</code></a>
feat(suppression): v2.5.5 Phase 2 — analyzer wire-up (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/110">#110</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/600bf516653bab0d3d4b138599c85cae2968087b"><code>600bf51</code></a>
ci(codeql): cron weekly→monthly (cut 3, standards#288) (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/109">#109</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/d25210da6521e5a716dd7df992e58aba667523f5"><code>d25210d</code></a>
feat(ffi_kind): v2.5.5 FFI subtyping (BuildSystem / RuntimeAbi /
TestMock) (#...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/62c98cc2f49d8ec15226398eb3052090b9da166f"><code>62c98cc</code></a>
feat(v3.0.0): Chapel→VeriSimDB HTTP push via panic-attack verisim-push
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/108">#108</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/f0b646385fa503c5324dd7bc5b6ae972b00b417c"><code>f0b6463</code></a>
feat(jit_context): v2.5.5 JIT-framework classifier
(Cranelift/LLVM/Wasm/JS) (...</li>
<li>Additional commits viewable in <a
href="https://github.com/hyperpolymath/panic-attacker/compare/ea88be7da68e07249ae7df8b948ecb8ecfb9664c...2dc1393c0ac982dbad98ba07f78a580d319456a5">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent f0b4cc3 commit 2704e0a
9 files changed
Lines changed: 27 additions & 27 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
15 | 15 | | |
16 | 16 | | |
17 | 17 | | |
18 | | - | |
| 18 | + | |
19 | 19 | | |
20 | 20 | | |
21 | 21 | | |
| |||
27 | 27 | | |
28 | 28 | | |
29 | 29 | | |
30 | | - | |
| 30 | + | |
31 | 31 | | |
32 | 32 | | |
33 | 33 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
35 | 35 | | |
36 | 36 | | |
37 | 37 | | |
38 | | - | |
| 38 | + | |
39 | 39 | | |
40 | 40 | | |
41 | | - | |
| 41 | + | |
42 | 42 | | |
43 | 43 | | |
44 | 44 | | |
45 | 45 | | |
46 | 46 | | |
47 | | - | |
| 47 | + | |
48 | 48 | | |
49 | 49 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
31 | 31 | | |
32 | 32 | | |
33 | 33 | | |
34 | | - | |
| 34 | + | |
35 | 35 | | |
36 | 36 | | |
37 | 37 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
28 | | - | |
| 28 | + | |
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
38 | 38 | | |
39 | 39 | | |
40 | 40 | | |
41 | | - | |
| 41 | + | |
42 | 42 | | |
43 | 43 | | |
44 | 44 | | |
| |||
63 | 63 | | |
64 | 64 | | |
65 | 65 | | |
66 | | - | |
| 66 | + | |
67 | 67 | | |
68 | 68 | | |
69 | 69 | | |
| |||
90 | 90 | | |
91 | 91 | | |
92 | 92 | | |
93 | | - | |
| 93 | + | |
94 | 94 | | |
95 | 95 | | |
96 | 96 | | |
| |||
116 | 116 | | |
117 | 117 | | |
118 | 118 | | |
119 | | - | |
| 119 | + | |
120 | 120 | | |
121 | 121 | | |
122 | 122 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
28 | | - | |
| 28 | + | |
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
| |||
40 | 40 | | |
41 | 41 | | |
42 | 42 | | |
43 | | - | |
| 43 | + | |
44 | 44 | | |
45 | 45 | | |
46 | 46 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
28 | 28 | | |
29 | 29 | | |
30 | 30 | | |
31 | | - | |
| 31 | + | |
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
| |||
38 | 38 | | |
39 | 39 | | |
40 | 40 | | |
41 | | - | |
| 41 | + | |
42 | 42 | | |
43 | 43 | | |
44 | 44 | | |
| |||
49 | 49 | | |
50 | 50 | | |
51 | 51 | | |
52 | | - | |
| 52 | + | |
53 | 53 | | |
54 | 54 | | |
55 | 55 | | |
| |||
60 | 60 | | |
61 | 61 | | |
62 | 62 | | |
63 | | - | |
| 63 | + | |
64 | 64 | | |
65 | 65 | | |
66 | 66 | | |
| |||
69 | 69 | | |
70 | 70 | | |
71 | 71 | | |
72 | | - | |
| 72 | + | |
73 | 73 | | |
74 | 74 | | |
75 | 75 | | |
| |||
78 | 78 | | |
79 | 79 | | |
80 | 80 | | |
81 | | - | |
| 81 | + | |
82 | 82 | | |
83 | 83 | | |
84 | 84 | | |
| |||
87 | 87 | | |
88 | 88 | | |
89 | 89 | | |
90 | | - | |
| 90 | + | |
91 | 91 | | |
92 | 92 | | |
93 | 93 | | |
| |||
96 | 96 | | |
97 | 97 | | |
98 | 98 | | |
99 | | - | |
| 99 | + | |
100 | 100 | | |
101 | 101 | | |
102 | 102 | | |
| |||
122 | 122 | | |
123 | 123 | | |
124 | 124 | | |
125 | | - | |
| 125 | + | |
126 | 126 | | |
127 | 127 | | |
128 | 128 | | |
| |||
155 | 155 | | |
156 | 156 | | |
157 | 157 | | |
158 | | - | |
| 158 | + | |
159 | 159 | | |
160 | 160 | | |
161 | 161 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
26 | 26 | | |
27 | 27 | | |
28 | 28 | | |
29 | | - | |
| 29 | + | |
30 | 30 | | |
31 | 31 | | |
32 | 32 | | |
| |||
38 | 38 | | |
39 | 39 | | |
40 | 40 | | |
41 | | - | |
| 41 | + | |
42 | 42 | | |
43 | 43 | | |
44 | 44 | | |
| |||
61 | 61 | | |
62 | 62 | | |
63 | 63 | | |
64 | | - | |
| 64 | + | |
65 | 65 | | |
66 | 66 | | |
67 | 67 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
17 | | - | |
| 17 | + | |
18 | 18 | | |
19 | 19 | | |
0 commit comments