chore(deps): bump the actions group across 1 directory with 3 updates

[dependabot]

Bumps the actions group with 3 updates in the / directory: github/codeql-action, taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates github/codeql-action from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action's changelog.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.3 to 2.87.12

Release notes

Sourced from taiki-e/install-action's releases.

2.87.12

• Update wasmtime@latest to 48.0.2.

• Update wasm-tools@latest to 1.259.0.

• Update uv@latest to 0.12.13.

• Update release-plz@latest to 0.3.165.

• Update protoc-gen-connect-openapi@latest to 0.27.1.

• Update mise@latest to 2026.9.5.

• Update cargo-nextest@latest to 0.9.144.

2.87.11

• Update biome@latest to 2.5.13.

• Update uv@latest to 0.12.12.

• Update mise@latest to 2026.9.4.

• Update kache@latest to 0.19.0.

2.87.10

• Update zizmor@latest to 1.30.1.

• Update uv@latest to 0.12.11.

• Update tombi@latest to 1.5.4.

• Update release-plz@latest to 0.3.164.

• Update mise@latest to 2026.9.3.

• Update kingfisher@latest to 2.2.0.

2.87.9

• Update oxfmt@latest to 1.82.0.

• Update mise@latest to 2026.9.2.

• Update kache@latest to 0.18.0.

• Update d2@latest to 0.9.0.

• Update bpf-linker@latest to 0.11.1.

2.87.8

• Update shfmt@latest to 3.14.1.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.12] - 2026-09-12

• Update wasmtime@latest to 48.0.2.

• Update wasm-tools@latest to 1.259.0.

• Update uv@latest to 0.12.13.

• Update release-plz@latest to 0.3.165.

• Update protoc-gen-connect-openapi@latest to 0.27.1.

• Update mise@latest to 2026.9.5.

• Update cargo-nextest@latest to 0.9.144.

[2.87.11] - 2026-09-11

• Update biome@latest to 2.5.13.

• Update uv@latest to 0.12.12.

• Update mise@latest to 2026.9.4.

• Update kache@latest to 0.19.0.

[2.87.10] - 2026-09-10

• Update zizmor@latest to 1.30.1.

• Update uv@latest to 0.12.11.

• Update tombi@latest to 1.5.4.

• Update release-plz@latest to 0.3.164.

• Update mise@latest to 2026.9.3.

• Update kingfisher@latest to 2.2.0.

[2.87.9] - 2026-09-09

• Update oxfmt@latest to 1.82.0.

• Update mise@latest to 2026.9.2.

• Update kache@latest to 0.18.0.

• Update d2@latest to 0.9.0.

... (truncated)

Commits

• 3f74d7c Release 2.87.12
• e7f36aa Update wasmtime manifest
• b208ecf Update zola manifest
• 4972682 Update wasmtime@latest to 48.0.2
• 9f978f5 Update wasm-tools@latest to 1.259.0
• 01d9694 Update uv@latest to 0.12.13
• 7af43af Update release-plz@latest to 0.3.165
• 5ebe8aa Update protoc-gen-connect-openapi@latest to 0.27.1
• c054431 Update mise@latest to 2026.9.5
• 2ad5cec Update cargo-nextest@latest to 0.9.144
• Additional commits viewable in compare view

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 540dbc72d23119b28a22251179c5938bca72109c to 2e043bb87e371d710cd4afcca0ea070b6d7c4252

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

== Changelog

=== [Unreleased]

==== Fixed — assail detector precision (false-positive reduction, 2026-06-24)

Three +assail+ analyzer fixes, all conservative (no new false negatives), found while triaging hyperpolymath/proven#68 and JoshuaJewell/paint-type#86:

• UncheckedAllocation (C) is now NULL-check aware. The detector previously flagged every +malloc(...)+ and emitted a line-less, file-level finding. It now scans per line, skips a malloc whose result is NULL-checked within a short window (+if (p == NULL)+, +if (!p)+, +nullptr+), and attaches a line number — which also lets an inline +// panic-attack: accepted+ marker suppress a reviewed site (marker suppression is line-gated). A genuinely-unchecked malloc still fires. This is why a real null-check fix (proven +stubs.c+) previously failed to clear.
• DynamicCodeExecution (JS/Python) is word-boundary aware. +contains("eval(")+ matched FFI symbol names like +proven_calculator_eval(+. Now +\beval\s*\(+ (and +\b(?:eval|exec)\s*\(+ for Python); a genuine +eval(+ still fires.
• CommandInjection (Shell) no longer matches the +--eval+ CLI flag. +contains("eval ")+ matched +--eval+/+-eval+. Now the eval builtin is matched only in statement position (+(?m)(?:^|[\s;&|(])eval[ \t]+).

Verified end-to-end: proven 1→0 active Critical/High (+stubs.c+ clears), paint-type 36→35 (gossamer +--eval+ benchmark FP clears; genuinely-unsafe vendored FFI + the irreducible +believe_me+ axiom correctly remain). 4 new tests in +tests/analyzer_tests.rs+; full analyzer suite green; zero warnings. PR #134. Refs #32.

==== Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME §3.2)

• +src/abi/AttestationUnforgeability.idr+: Idris2 proof that the intent→evidence→seal attestation chain is unforgeable. Models +chain_hash = H(intent‖evidence‖report)+ + the Ed25519 signature with the cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA message- and signer-binding, signature correctness) as a +parameters+ block — hypotheses, not +postulate+ (PA021 bans escape hatches), so it is an honest conditional theorem. Under +%default total+ it Qed-closes +integrity+ (tampering any phase invalidates the seal), +authenticity+ (a verifying seal comes from the matching key), and +nonRepudiation+ (a genuine seal verifies), plus two corollaries. Typechecks under Idris2 0.8.0. Closes #123.

==== Added — contractile registry (INDEX.a2ml)

• +.machine_readable/contractiles/INDEX.a2ml+: the

... (truncated)

Commits

• 2e043bb chore(ci): bump governance-reusable pin to standards main (#193)
• f21f73b chore(deps): bump the rust-minor group across 1 directory with 2 updates (#191)
• See full diff in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: eec68078-3906-4c4f-a9cb-a7bd2917e6ce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}