From 0130be2712199e5dd771e65894d8283cc2b6e148 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 5 Jul 2026 05:16:58 +0000 Subject: [PATCH 1/2] ci: bump the actions group with 7 updates Bumps the actions group with 7 updates: | Package | From | To | | --- | --- | --- | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `67ef31d5b988238dd797d409d6f9574278e20537` | `fa04a1451ff1842e2626ccb99004d0195b455a88` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.5` | `2.82.8` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.1.0` | `4.2.0` | Updates `dorny/paths-filter` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](https://github.com/dorny/paths-filter/compare/fbd0ab8f3e69293af611ebaee6363fc25e6d187d...7b450fff21473bca461d4b92ce414b9d0420d706) Updates `dtolnay/rust-toolchain` from 67ef31d5b988238dd797d409d6f9574278e20537 to fa04a1451ff1842e2626ccb99004d0195b455a88 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/compare/67ef31d5b988238dd797d409d6f9574278e20537...fa04a1451ff1842e2626ccb99004d0195b455a88) Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `taiki-e/install-action` from 2.82.5 to 2.82.8 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/bffeee26d4db9be238a4ea78d8826604ebcb594d...c93ccc03e00cd0e08e494f5fd058a6c55a6a1907) Updates `github/codeql-action/init` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8) --- updated-dependencies: - dependency-name: dorny/paths-filter dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dtolnay/rust-toolchain dependency-version: fa04a1451ff1842e2626ccb99004d0195b455a88 dependency-type: direct:production dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.82.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 38 ++++++++++++------------- .github/workflows/codeql.yml | 4 +-- .github/workflows/mutation-test.yml | 4 +-- .github/workflows/pages.yml | 4 +-- .github/workflows/python-cli-wheels.yml | 4 +-- .github/workflows/release.yml | 30 +++++++++---------- .github/workflows/scorecard.yml | 2 +- .github/workflows/smoke-dryrun.yml | 2 +- 8 files changed, 44 insertions(+), 44 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8a295a92..fc2f1363 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,7 +45,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 + - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 id: filter with: filters: | @@ -67,7 +67,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable components: rustfmt @@ -91,7 +91,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable components: clippy @@ -139,7 +139,7 @@ jobs: # the build on warnings regardless of this step. - name: Upload SARIF to code scanning if: always() && hashFiles('rust-clippy-results.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: sarif_file: rust-clippy-results.sarif category: clippy @@ -153,7 +153,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 @@ -216,11 +216,11 @@ jobs: with: fetch-depth: 1 submodules: recursive - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-nextest # nextest runs the lib / bins / integration tests and writes the JUnit @@ -270,7 +270,7 @@ jobs: submodules: recursive # llvm-tools-preview supplies llvm-profdata/llvm-cov for source-based # coverage instrumentation. - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable components: llvm-tools-preview @@ -280,7 +280,7 @@ jobs: - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: key: coverage - - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-nextest,cargo-llvm-cov # nextest is the same runner the `test` job uses, so instrumenting it @@ -331,7 +331,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # 1.94 + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # 1.94 with: toolchain: "1.94" - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 @@ -374,7 +374,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 @@ -405,11 +405,11 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-about@0.8.4 # Fails if any dep in either binary crate's transitive closure @@ -444,7 +444,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable components: clippy @@ -472,7 +472,7 @@ jobs: tar -xzf /tmp/rumdl.tgz -C /tmp rumdl install -m 0755 /tmp/rumdl /usr/local/bin/rumdl rumdl --version - - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: taplo-cli@0.10.0,shellcheck@0.10.0,shfmt@3.12.0 # actionlint 1.7.12's prebuilt binary is not yet in @@ -611,7 +611,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable with: toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 @@ -701,7 +701,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable with: toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 @@ -802,7 +802,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable with: toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 @@ -862,7 +862,7 @@ jobs: with: fetch-depth: 1 submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2d18108d..73b82d5a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,12 +38,12 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: category: /language:${{ matrix.language }} diff --git a/.github/workflows/mutation-test.yml b/.github/workflows/mutation-test.yml index 18763fd1..85cd7370 100644 --- a/.github/workflows/mutation-test.yml +++ b/.github/workflows/mutation-test.yml @@ -35,7 +35,7 @@ jobs: submodules: recursive - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable @@ -43,7 +43,7 @@ jobs: uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - name: Install cargo-mutants - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-mutants diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 2f9e86b4..ec548100 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -195,7 +195,7 @@ jobs: # Swatinem/rust-cache below keeps the cold-build cost # bounded — warm runs are dominated by incremental relink, # not full recompile. - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable # `shared-key` (vs `key`) lets Swatinem fall back to @@ -349,7 +349,7 @@ jobs: # distinct analysis from ci.yml's `category: clippy` upload. - name: Upload self-scan SARIF to code scanning if: always() && hashFiles('bca.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: sarif_file: bca.sarif category: bca diff --git a/.github/workflows/python-cli-wheels.yml b/.github/workflows/python-cli-wheels.yml index 6255c18c..eb403422 100644 --- a/.github/workflows/python-cli-wheels.yml +++ b/.github/workflows/python-cli-wheels.yml @@ -146,13 +146,13 @@ jobs: # on the host; the `targets:` add lets cargo-about's # `--filter-platform` resolve a cross target (e.g. x86_64 on the # arm64 macOS runner) without a full target install. - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: ${{ env.RUST_TOOLCHAIN }} targets: ${{ matrix.target }} - name: Install cargo-about - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-about@${{ env.CARGO_ABOUT_VERSION }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 61d116fb..7ab88bbc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -92,7 +92,7 @@ jobs: persist-credentials: false ref: ${{ steps.tag.outputs.tag }} - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: ${{ env.RUST_TOOLCHAIN }} @@ -253,19 +253,19 @@ jobs: persist-credentials: false ref: ${{ needs.preflight.outputs.ref }} - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: ${{ env.RUST_TOOLCHAIN }} targets: ${{ matrix.target }} - name: Install cross (Linux cross-compile) if: matrix.cross - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cross@${{ env.CROSS_VERSION }} - name: Install cargo-about - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-about@${{ env.CARGO_ABOUT_VERSION }} @@ -494,12 +494,12 @@ jobs: persist-credentials: false ref: ${{ needs.preflight.outputs.ref }} - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: ${{ env.RUST_TOOLCHAIN }} targets: ${{ matrix.target }} - - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-deb@${{ env.CARGO_DEB_VERSION }} @@ -579,12 +579,12 @@ jobs: persist-credentials: false ref: ${{ needs.preflight.outputs.ref }} - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: ${{ env.RUST_TOOLCHAIN }} targets: ${{ matrix.target }} - - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-generate-rpm@${{ env.CARGO_GENERATE_RPM_VERSION }} @@ -704,7 +704,7 @@ jobs: # cross-arch builds (aarch64 on an x86_64 runner), run the Alpine # container under qemu for the target architecture so abuild's # CARCH matches. - - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 if: matrix.apk_arch != 'x86_64' - name: Build .apk inside alpine:3.20 container @@ -800,7 +800,7 @@ jobs: image: [ubuntu:22.04, ubuntu:24.04, debian:12] arch: [amd64, arm64] steps: - - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 if: matrix.arch == 'arm64' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -857,7 +857,7 @@ jobs: image: [rockylinux:9, fedora:latest, amazonlinux:2023] arch: [x86_64, aarch64] steps: - - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 if: matrix.arch == 'aarch64' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -908,7 +908,7 @@ jobs: matrix: arch: [x86_64, aarch64] steps: - - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 if: matrix.arch == 'aarch64' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -1121,10 +1121,10 @@ jobs: fi ls -la release/ - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: ${{ env.RUST_TOOLCHAIN }} - - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 + - uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-cyclonedx@${{ env.CARGO_CYCLONEDX_VERSION }} @@ -1418,7 +1418,7 @@ jobs: persist-credentials: false ref: ${{ needs.preflight.outputs.ref }} - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: ${{ env.RUST_TOOLCHAIN }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 37edb78c..2cd89c3e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -52,6 +52,6 @@ jobs: retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: sarif_file: results.sarif diff --git a/.github/workflows/smoke-dryrun.yml b/.github/workflows/smoke-dryrun.yml index 5071e8ce..f662f00d 100644 --- a/.github/workflows/smoke-dryrun.yml +++ b/.github/workflows/smoke-dryrun.yml @@ -72,7 +72,7 @@ jobs: with: submodules: false - - uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable tip + - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable tip with: toolchain: stable From 9698db072f76c659a6c69a3c2d5f9f9ad5fe59d1 Mon Sep 17 00:00:00 2001 From: Elijah Zupancic Date: Mon, 6 Jul 2026 18:54:14 -0700 Subject: [PATCH 2/2] fix(deps): clear RUSTSEC advisories blocking cargo-deny The cargo-deny gate (and the aggregate `ci` required check that depends on it) went red on advisories unrelated to this branch's GitHub Actions bump: - crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204): invalid pointer dereference in the `fmt::Pointer` impl. Ships transitively via `crossbeam`, a library dependency; lockfile-only bump. - quick-xml 0.39 -> 0.41 (RUSTSEC-2026-0194 quadratic duplicate- attribute check, RUSTSEC-2026-0195 unbounded namespace allocation in `NsReader`). Dev-only test dependency. The quick-xml bump deprecates `Attribute::unescape_value()`; under `-D warnings` that fails the build. The XML-validation test helpers migrate to `normalized_value(XmlVersion::Implicit1_0)`, which is the exact code path the deprecated method delegated to (same version, depth, and predefined-entity resolver), so decoding behavior is unchanged. cargo-deny (advisories/bans/licenses/sources), clippy, rustfmt, rumdl, and the full test suite all pass locally with no snapshot drift. --- CHANGELOG.md | 13 +++++++++++++ Cargo.lock | 8 ++++---- Cargo.toml | 2 +- big-code-analysis-cli/Cargo.toml | 2 +- .../tests/common/validators.rs | 11 +++++++---- src/output/checkstyle_tests.rs | 2 +- tests/common/validators.rs | 17 +++++++++++------ 7 files changed, 38 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 62eaabee..f6fde4b1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -55,6 +55,19 @@ for historical reference. nightly (`--cfg docsrs`), so the published rendering can be verified before a release rather than discovered broken after publish. +### Security + +- Cleared three RUSTSEC advisories flagged by the `cargo-deny` gate. + `crossbeam-epoch` (a shipped transitive dependency via `crossbeam`) + moves `0.9.18` → `0.9.20` for the invalid-pointer-dereference in its + `fmt::Pointer` impl (RUSTSEC-2026-0204). The dev-only `quick-xml` + test dependency moves `0.39` → `0.41` for the quadratic + duplicate-attribute check (RUSTSEC-2026-0194) and the unbounded + namespace-declaration allocation in `NsReader` (RUSTSEC-2026-0195); + the XML-validation test helpers migrate from the now-deprecated + `Attribute::unescape_value()` to `normalized_value(XmlVersion::Implicit1_0)`, + which is its exact behavioral equivalent. + ## [2.0.0] - 2026-06-29 The project's first major version bump since `1.0`, and the first diff --git a/Cargo.lock b/Cargo.lock index 027665b3..78e69f24 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -884,9 +884,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ] @@ -3397,9 +3397,9 @@ dependencies = [ [[package]] name = "quick-xml" -version = "0.39.4" +version = "0.41.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e" +checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1" dependencies = [ "memchr", ] diff --git a/Cargo.toml b/Cargo.toml index b271d3e4..cc1d1865 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -343,7 +343,7 @@ insta = { version = "1.29.0", features = ["yaml", "json", "redactions"] } jsonschema = "^0.46" tempfile.workspace = true pretty_assertions = "^1.3" -quick-xml = "^0.39" +quick-xml = "^0.41" # Test-only: the integration corpus harness and the concurrent_files # unit tests walk fixture trees; production code no longer walks (#495). walkdir = "^2.3" diff --git a/big-code-analysis-cli/Cargo.toml b/big-code-analysis-cli/Cargo.toml index 79fc8e1e..adbf5ba2 100644 --- a/big-code-analysis-cli/Cargo.toml +++ b/big-code-analysis-cli/Cargo.toml @@ -48,7 +48,7 @@ csv.workspace = true insta = "1.29.0" jsonschema = "^0.46" predicates = "^3.0" -quick-xml = "^0.39" +quick-xml = "^0.41" # Debian/Ubuntu packaging — consumed by `cargo deb` in release CI. # The binary asset path `target/release/bca` is rewritten by cargo-deb diff --git a/big-code-analysis-cli/tests/common/validators.rs b/big-code-analysis-cli/tests/common/validators.rs index 91ac0825..bdad2bec 100644 --- a/big-code-analysis-cli/tests/common/validators.rs +++ b/big-code-analysis-cli/tests/common/validators.rs @@ -230,10 +230,13 @@ fn attr_value(start: &quick_xml::events::BytesStart<'_>, name: &str) -> Option, name: &str) -> Option