chore(deps): bump the actions group with 3 updates

[dependabot]

Bumps the actions group with 3 updates: github/codeql-action, taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates github/codeql-action from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action's changelog.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.3 to 2.87.13

Release notes

Sourced from taiki-e/install-action's releases.

2.87.13

• Update zola@latest to 0.23.6.

• Update vacuum@latest to 0.30.5.

• Update tombi@latest to 1.5.5.

• Update release-plz@latest to 0.3.167.

• Update protoc-gen-connect-openapi@latest to 0.27.2.

• Update prek@latest to 0.5.3.

• Update osv-scanner@latest to 2.6.0.

• Update mise@latest to 2026.9.7.

• Update kache@latest to 0.21.0.

• Update cargo-leptos@latest to 0.3.8.

• Update cargo-auditable@latest to 0.7.6.

2.87.12

• Update wasmtime@latest to 48.0.2.

• Update wasm-tools@latest to 1.259.0.

• Update uv@latest to 0.12.13.

• Update release-plz@latest to 0.3.165.

• Update protoc-gen-connect-openapi@latest to 0.27.1.

• Update mise@latest to 2026.9.5.

• Update cargo-nextest@latest to 0.9.144.

2.87.11

• Update biome@latest to 2.5.13.

• Update uv@latest to 0.12.12.

• Update mise@latest to 2026.9.4.

• Update kache@latest to 0.19.0.

2.87.10

• Update zizmor@latest to 1.30.1.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.13] - 2026-09-15

• Update zola@latest to 0.23.6.

• Update vacuum@latest to 0.30.5.

• Update tombi@latest to 1.5.5.

• Update release-plz@latest to 0.3.167.

• Update protoc-gen-connect-openapi@latest to 0.27.2.

• Update prek@latest to 0.5.3.

• Update osv-scanner@latest to 2.6.0.

• Update mise@latest to 2026.9.7.

• Update kache@latest to 0.21.0.

• Update cargo-leptos@latest to 0.3.8.

• Update cargo-auditable@latest to 0.7.6.

[2.87.12] - 2026-09-12

• Update wasmtime@latest to 48.0.2.

• Update wasm-tools@latest to 1.259.0.

• Update uv@latest to 0.12.13.

• Update release-plz@latest to 0.3.165.

• Update protoc-gen-connect-openapi@latest to 0.27.1.

• Update mise@latest to 2026.9.5.

• Update cargo-nextest@latest to 0.9.144.

[2.87.11] - 2026-09-11

• Update biome@latest to 2.5.13.

• Update uv@latest to 0.12.12.

• Update mise@latest to 2026.9.4.

• Update kache@latest to 0.19.0.

... (truncated)

Commits

• 26e9283 Release 2.87.13
• 04a4a82 Update zola@latest to 0.23.6
• b9c60f1 Update vacuum@latest to 0.30.5
• b31d41a Update uv manifest
• 1b200db Update tombi@latest to 1.5.5
• d3a7a77 Update sccache manifest
• 3e3c2df Update release-plz@latest to 0.3.167
• d444673 Update protoc-gen-connect-openapi@latest to 0.27.2
• e75a66b Update prek@latest to 0.5.3
• 034ed19 Update oxfmt manifest
• Additional commits viewable in compare view

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 2b7202dbd5d545b0fbf79c8d43f80c3d6f4489d0 to a030ef32c571b4aa22bbcd4a41acbdd9a801d366

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

== Changelog

=== [Unreleased]

==== Fixed — assail detector precision (false-positive reduction, 2026-06-24)

Three +assail+ analyzer fixes, all conservative (no new false negatives), found while triaging hyperpolymath/proven#68 and JoshuaJewell/paint-type#86:

• UncheckedAllocation (C) is now NULL-check aware. The detector previously flagged every +malloc(...)+ and emitted a line-less, file-level finding. It now scans per line, skips a malloc whose result is NULL-checked within a short window (+if (p == NULL)+, +if (!p)+, +nullptr+), and attaches a line number — which also lets an inline +// panic-attack: accepted+ marker suppress a reviewed site (marker suppression is line-gated). A genuinely-unchecked malloc still fires. This is why a real null-check fix (proven +stubs.c+) previously failed to clear.
• DynamicCodeExecution (JS/Python) is word-boundary aware. +contains("eval(")+ matched FFI symbol names like +proven_calculator_eval(+. Now +\beval\s*\(+ (and +\b(?:eval|exec)\s*\(+ for Python); a genuine +eval(+ still fires.
• CommandInjection (Shell) no longer matches the +--eval+ CLI flag. +contains("eval ")+ matched +--eval+/+-eval+. Now the eval builtin is matched only in statement position (+(?m)(?:^|[\s;&|(])eval[ \t]+).

Verified end-to-end: proven 1→0 active Critical/High (+stubs.c+ clears), paint-type 36→35 (gossamer +--eval+ benchmark FP clears; genuinely-unsafe vendored FFI + the irreducible +believe_me+ axiom correctly remain). 4 new tests in +tests/analyzer_tests.rs+; full analyzer suite green; zero warnings. PR #134. Refs #32.

==== Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME §3.2)

• +src/abi/AttestationUnforgeability.idr+: Idris2 proof that the intent→evidence→seal attestation chain is unforgeable. Models +chain_hash = H(intent‖evidence‖report)+ + the Ed25519 signature with the cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA message- and signer-binding, signature correctness) as a +parameters+ block — hypotheses, not +postulate+ (PA021 bans escape hatches), so it is an honest conditional theorem. Under +%default total+ it Qed-closes +integrity+ (tampering any phase invalidates the seal), +authenticity+ (a verifying seal comes from the matching key), and +nonRepudiation+ (a genuine seal verifies), plus two corollaries. Typechecks under Idris2 0.8.0. Closes #123.

==== Added — contractile registry (INDEX.a2ml)

• +.machine_readable/contractiles/INDEX.a2ml+: the

... (truncated)

Commits

• a030ef3 chore(deps): bump eframe from 0.35.0 to 0.36.2 (#196)
• b3aa86d chore(deps): bump dirs from 6.0.0 to 7.0.0 (#195)
• 3bc5753 chore(deps): bump the rust-minor group with 2 updates (#194)
• 27b8de5 fix(ci): make the dogfood gate .deed-aware (#197)
• 2e043bb chore(ci): bump governance-reusable pin to standards main (#193)
• f21f73b chore(deps): bump the rust-minor group across 1 directory with 2 updates (#191)
• 540dbc7 fix(ci): the invisible-character gate never matched anything (#189)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: cbdca8a8-229f-4936-a73b-308d4b56a220

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}