[dependabot]

Bumps the actions group with 1 update: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 8c2f1989a23521974f9f673bf73a6f39d68f3a4e to 6933654592debdf0ed9157843a3771c252a63574

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

== Changelog

=== [Unreleased]

==== Added — .kyaml input (estate YAML policy D280/D307)

• Attack profiles, ambush timelines, amuck specs, +diff+ reports and a2ml bundles now accept the +.kyaml+ extension alongside +.yaml+ and +.yml+. KYAML is a strict subset of YAML, so the same parser reads it. The extension list lives in one place, +crate::yaml::EXTENSIONS+.
• +assemblyline+ fingerprints +.kyaml+ files, so editing one triggers a rescan.
• The example attack profiles are in estate formats: +profiles/attack-profile.example.kyaml+ (KYAML, renamed from +.yaml+) and +profiles/attack-profile.example.json+ (I-JSON/JCS). A test keeps the two in agreement.

==== Fixed — YAML parser replaced with safe Rust (RUSTSEC-2024-0449)

• +serde_yaml+ → +serde-saphyr+ 2.0. +serde_yaml+ 0.9 is deprecated and pulled in +unsafe-libyaml+, an archived c2rust translation of libyaml flagged unmaintained by RUSTSEC-2024-0449. +serde-saphyr+ is +#![forbid(unsafe_code)]+. All YAML now goes through +src/yaml.rs+: hand-written configs (attack profiles, timelines, amuck specs) keep the parser's default resource budget; machine-written reports get a node/event budget scaled to input length, so large-scan reports still load while alias expansion stays bounded.
• MSRV raised from 1.85.0 to 1.89. No maintained safe-Rust serde YAML crate builds on 1.85 (serde-saphyr needs 1.89, noyalib 1.86+), and the committed lockfile already required 1.88.
• YAML output is equivalent but not byte-identical. Quoting switches from +'…'+ to +"…"+ and multi-line strings use +|+ blocks. Reports written by earlier versions still load. A bare +~+/+null+ in a string field is now rejected (YAML 1.2 null); quote it.

==== Fixed — assail detector precision (false-positive reduction, 2026-06-24)

Three +assail+ analyzer fixes, all conservative (no new false negatives), found while triaging hyperpolymath/proven#68 and JoshuaJewell/paint-type#86:

• UncheckedAllocation (C) is now NULL-check aware. The detector previously flagged every +malloc(...)+ and emitted a line-less, file-level finding. It now scans per line, skips a malloc whose result is NULL-checked within a short window (+if (p == NULL)+, +if (!p)+, +nullptr+), and attaches a line number — which also lets an inline +// panic-attack: accepted+ marker suppress a reviewed site (marker suppression is line-gated). A genuinely-unchecked malloc still fires. This is why a real null-check fix (proven +stubs.c+) previously failed

... (truncated)

Commits

• 6933654 chore(profiles): convert the example profiles to KYAML and I-JSON/JCS (#236)
• e1c9a2b feat(json): write JSON report artefacts as I-JSON/JCS (#237)
• 2d118b0 feat(yaml): accept the .kyaml extension in every YAML loader (#235)
• 323a2cf Unify PA rule IDs into one canonical table (#232)
• 97a5b35 fix(deps): replace serde_yaml with safe-Rust serde-saphyr (#234)
• 8955f61 ci: give dtolnay/rust-toolchain a valid toolchain input (#219)
• b1c349f fix: flatten stacked readiness, audit, and K9 fixes (#233)
• 5c5dddb fix(ci): pin scan-and-report's rust-toolchain to current v1 and repair action...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5ac135e5-3af4-42ab-9471-f487b8cd81af

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

Superseded by #319, which pins hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml to b5530834a839734d1d181bfe6edb0d43d4233cf4 (newer than the 6933654… proposed here), in lockstep with the same tool's pin in bridge-gate.yml and the new deep-recon.yml, and regenerates actions.lock transitively (including the nested Swatinem/rust-cache@v2.9.3 record a bare YAML bump cannot produce — that desync class is what silences CI estate-wide). Safe to close once #319 lands; if #319 stalls, this PR still needs a manual gh actions-lock regeneration before merge.

[dependabot]

Looks like hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml is updatable in another way, so this is no longer needed.