[dependabot]

Bumps the actions group with 4 updates: hyperpolymath/cicd-squabbler/.github/actions/squabble, step-security/harden-runner, taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates hyperpolymath/cicd-squabbler/.github/actions/squabble from 541ab9bc21a776d55eb46611877521a824d6319c to 193349090edb29f4ed1ef82142c207e22e1715c9

Changelog

Sourced from hyperpolymath/cicd-squabbler/.github/actions/squabble's changelog.

== Changelog

All notable changes to this project will be documented in this file.

The format is based on https://keepachangelog.com/en/1.1.0/[Keep a Changelog], and this project adheres to https://semver.org/spec/v2.0.0.html[Semantic Versioning].

=== [Unreleased]

==== Added

• .github/actions/squabble — a composite action that installs the squabble v0.1.0 release binary for other workflows and, optionally, runs it. It refuses any download whose sha256 is not the pinned digest, or whose build attestation does not name this repository's release.yml, the v0.1.0 tag and its source commit, on a GitHub-hosted runner; nothing runs until both pass. tests/squabble_action_test.sh (27 cases, with planted tampered downloads and planted action.yml mutants) runs in the new squabble-action.yml workflow. Linux x86_64 only.
• squabble chains — read-only cross-repo CI dependency chains (Phase A of docs/proposals/squabble-modes-and-app-layer.adoc). Pure analysis in squabble-core::chains: cycles and dead upstreams (blocking), diamonds, pin skew and tag/branch pins (warnings), an upstreams-first landing order, and the longest chain (a max-plus longest path, hop-weighted for now). Sources mix freely: local checkouts, and gh:owner/repo read through GitHub GraphQL. --follow N probes upstreams; action repos are probed for existence only, and reusable-workflow upstreams contribute only the files actually called. New exit code 4 = blocking chain finding.
• squabble-forge crate — GitHub GraphQL via gh api graphql, batched with aliases, owner/name passed as variables. Every query is validated in tests against a committed schema snapshot (graphql/github-schema.graphql, refresh with just graphql-schema-refresh). Records rateLimit cost; an exhausted budget marks the remaining repos unavailable rather than guessing. Truncated or binary blobs and renamed repos are reported as notes.
• scripts/install-toolchain.sh no longer pipes a network response into a shell. rustup is bootstrapped from the official rustup-init binary whose published SHA-256 is fetched over TLS from the same origin and verified before execution; a tampered, malformed or missing digest is a refusal. Creusot is cloned at the commit its tag pointed to and the checkout is verified before ./INSTALL runs; a version with no pinned commit is refused instead of being cloned from a moving tag.
• docs/CREUSOT.adoc — the toolchain split into the four layers that actually gate a verdict (manager, toolchain, cargo creusot, Why3 + solver), and a measured account of an environment that reaches only some of them: the rustup wheel on PyPI installs from an allow-listed channel, every dist server still refuses (tls handshake eof), and rust-lang/rust publishes no binary assets, so GitHub cannot stand in for one. Records what the status of the obligations is in that environment — unchanged — rather than a skip.
• fetch: PinWorkflowActions, ReconcileActionsPolicy and

... (truncated)

Commits

• 1933490 chore(deps): bump rustls from 0.23.45 to 0.23.46 in the cargo group across 1 ...
• bd18c6e chore(deps): bump rustls
• b625e05 Zero-job startup failures as first-class classes; chains resolves canonical u...
• be2128b refactor(fight,cli): carry verified_allowed through the policy facts
• 5f5aed4 test(zero-job): a startup_failure without a usable id is refused, not skipped
• df6fff3 fix: review findings — 404 ambiguity, blocking moves, no-silent-skip, overflo...
• 5aeb95a fix(creusot): prevent overflow in acceptance count sums
• 1116372 fix(forge): validate an API path before it reaches gh argv
• 905771e fix(install): bootstrap rustup from a digest-verified binary and pin Creusot ...
• 9105c7a docs(reports): record the zero-job diagnosis: the callee owner is not admitted
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.22.2 to 2.22.3

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.3

What's Changed

• Added support for Avrea-hosted runners (enterprise tier)
• Fixed unexpected blocking of allowed connections caused by GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners
• Added a feature flag to disable implicit AWS endpoint allowances on self-hosted Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.2...v2.22.3

Commits

• 46b06ce Merge pull request #711 from step-security/rc-46
• f82eb4b Merge pull request #710 from h0x0er/jatin/tp-avrea
• 665b85a update agent-self-hosted, agent-bravo to v1.9.5 and agent to v0.18.0
• 80fffe1 detect avrea runners
• See full diff in compare view

Updates taiki-e/install-action from 2.87.30 to 2.88.0

Release notes

Sourced from taiki-e/install-action's releases.

2.88.0

• Support similarity-rs. (#2017, thanks @​HardMax71)

2.87.33

• Update vacuum@latest to 0.35.4.

• Update uv@latest to 0.13.6.

• Update trunk@latest to 0.22.1.

• Update tombi@latest to 1.9.6.

• Update release-plz@latest to 0.4.2.

• Update mise@latest to 2026.10.21.

• Update cargo-nextest@latest to 0.9.150.

• Update cargo-about@latest to 0.9.3.

2.87.32

• Update wild@latest to 0.11.0.

• Update vacuum@latest to 0.35.2.

• Update tombi@latest to 1.9.5.

• Update sccache@latest to 0.19.0.

• Update release-plz@latest to 0.4.1.

• Update mise@latest to 2026.10.19.

• Update knope@latest to 0.23.2.

• Update dprint@latest to 0.64.3.

• Update cargo-vet@latest to 0.10.3.

• Update cargo-sort@latest to 2.1.4.

• Update cargo-binstall@latest to 1.26.1.

• Update biome@latest to 2.6.3.

2.87.31

• Downgrade cargo-sort@latest to 2.1.3.

• Update vacuum@latest to 0.35.0.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.88.0] - 2026-10-28

• Support similarity-rs. (#2017, thanks @​HardMax71)

[2.87.33] - 2026-10-28

• Update vacuum@latest to 0.35.4.

• Update uv@latest to 0.13.6.

• Update trunk@latest to 0.22.1.

• Update tombi@latest to 1.9.6.

• Update release-plz@latest to 0.4.2.

• Update mise@latest to 2026.10.21.

• Update cargo-nextest@latest to 0.9.150.

• Update cargo-about@latest to 0.9.3.

[2.87.32] - 2026-10-26

• Update wild@latest to 0.11.0.

• Update vacuum@latest to 0.35.2.

• Update tombi@latest to 1.9.5.

• Update sccache@latest to 0.19.0.

• Update release-plz@latest to 0.4.1.

• Update mise@latest to 2026.10.19.

• Update knope@latest to 0.23.2.

• Update dprint@latest to 0.64.3.

• Update cargo-vet@latest to 0.10.3.

• Update cargo-sort@latest to 2.1.4.

• Update cargo-binstall@latest to 1.26.1.

• Update biome@latest to 2.6.3.

[2.87.31] - 2026-10-23

... (truncated)

Commits

• 86f7a0f Release 2.88.0
• 90d1803 Update changelog
• 7328460 Support similarity-rs (#2017)
• 645d1ab Release 2.87.33
• 4c6c821 Update vacuum@latest to 0.35.4
• 2412e4d Update uv@latest to 0.13.6
• d370c27 Update trunk@latest to 0.22.1
• 9145af1 Update tombi@latest to 1.9.6
• 6b400b6 Update release-plz@latest to 0.4.2
• bdef194 Update mise@latest to 2026.10.21
• Additional commits viewable in compare view

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from b22bed4f8c6dce82fde639aa0dab9ce79d1006f5 to be6ac46716eaf049570ec4966f4ae4699b319689

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

== Changelog

=== [Unreleased]

==== Fixed — KYAML keys holding a line separator

• KYAML output now escapes U+2028 (LS) and U+2029 (PS) as +\uXXXX+, as it already did for NEL (U+0085). go-yaml, the parser behind +yq+, reads all three as line breaks, so a raw one in a key made the document unparseable by +yq+ and by standards' +kyaml-format.sh+. +crate::yaml+ (serde-saphyr) read these files correctly before and after.

==== Changed — attestation hashes are reproducible JCS

• +assail --attest+ now hashes the intent and evidence records as their JCS (RFC 8785) bytes instead of +serde_json+ struct order, and writes the +.attestation.json+ sidecar itself as I-JSON/JCS. Anyone holding the sidecar can recompute both hashes in any language, for example with +jq -cjS .attestation.intent | sha256sum+.
• The seal gains a +hash_scheme+ field (+jcs-sha256+). The scheme is prefixed to the chain hash, so it is covered by any Ed25519 signature: relabelling a seal as legacy to skip the content check breaks the chain hash.
• +attest verify+ now rehashes the embedded intent and evidence and fails on a mismatch. Before, it checked only that the chain hash matched the three stored digests, so the intent and evidence could be edited after sealing without detection. Sidecars written before this change (no +hash_scheme+) still verify, reported as +not rehashed (legacy hash scheme)+.
• +attest verify+ rejects any digest field that is not exactly 64 lowercase hex characters. Fixed widths keep the legacy and scheme-prefixed chain inputs (192 and 202 bytes) apart; otherwise moving the scheme name into +intent_hash+ would reproduce the signed bytes on the legacy path.

==== Added — KYAML report output

• +--output-format kyaml+ writes reports in KYAML, the estate YAML dialect (+crate::kyaml+). The output is a fixed point of +yq -p yaml -o kyaml+ (v4.54.1), so it passes standards' +scripts/kyaml-format.sh --check+. On the reports checked it is also byte-identical to +yq -p json -o kyaml+ run on the JCS report. (Reading JSON, +yq+ reformats some floats, +1e-7+ to +1e-07+; the KYAML report keeps the JCS form, which +yq+ preserves.)
• Keys and numbers are in JCS order and form, so the KYAML and JSON reports of a scan hold the same data.
• One deliberate difference from +yq+: the YAML non-printables U+007F to U+009F, U+FFFE and U+FFFF are escaped as +\uXXXX+. +yq+ writes them raw, and U+0085 (NEL) then reads back as a line break. +kyaml-format.sh+ refuses such a file rather than judging it, because +yq+'s own rewrite would change the data.
• +README.adoc+ now lists the real +--output-format+ values; it named +markdown+ and +text+, which never existed.

==== Added — .kyaml input (estate YAML policy D280/D307)

... (truncated)

Commits

• be6ac46 Fix Patch Bridge lockfile discovery and empty reports (#254)
• 410a8f8 fix(k9): validate K9 with the canonical validator (#253)
• c34d76a ci(actions-lock): add the missing SLSA generator record (#251)
• ac68bba fix(kyaml): escape U+2028 and U+2029 so keys stay parseable by yq (#250)
• 2285a77 feat(attestation): hash intent and evidence as JCS and bind them on verify (#...
• dd91585 fix(assail): make assail reports deterministic (#245)
• cb50e1b ci(dogfood): include .kyaml files in the dogfood gate's file scans (#246)
• b17deef feat(report): add --output-format kyaml (#248)
• e2eba7d Add explicit assail coverage and native PHP analysis (#241)
• deda819 fix(ci): carry composite-action dependencies onto the SHA-keyed lockfile entr...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: hyperpolymath/verisimdb
• Branch: main
• File: .coderabbit.yaml
• Commit: 2cf7746
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 40440406-6c1d-47dd-bdbf-de9a3271d086

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud