[dependabot]

Bumps the actions group with 7 updates in the / directory:

Package	From	To
actions/upload-artifact	7.0.1	7.0.2
hyperpolymath/cicd-squabbler/.github/actions/squabble	14f853fde902ab2d7631070d87a9dc9122e01013	541ab9bc21a776d55eb46611877521a824d6319c
github/codeql-action/init	4.39.0	4.39.1
github/codeql-action/analyze	4.39.0	4.39.1
github/codeql-action/upload-sarif	4.39.0	4.39.1
taiki-e/install-action	2.87.29	2.87.30
hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml	b5530834a839734d1d181bfe6edb0d43d4233cf4	b22bed4f8c6dce82fde639aa0dab9ce79d1006f5

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates hyperpolymath/cicd-squabbler/.github/actions/squabble from 14f853fde902ab2d7631070d87a9dc9122e01013 to 541ab9bc21a776d55eb46611877521a824d6319c

Changelog

Sourced from hyperpolymath/cicd-squabbler/.github/actions/squabble's changelog.

== Changelog

All notable changes to this project will be documented in this file.

The format is based on https://keepachangelog.com/en/1.1.0/[Keep a Changelog], and this project adheres to https://semver.org/spec/v2.0.0.html[Semantic Versioning].

=== [Unreleased]

==== Added

• .github/actions/squabble — a composite action that installs the squabble v0.1.0 release binary for other workflows and, optionally, runs it. It refuses any download whose sha256 is not the pinned digest, or whose build attestation does not name this repository's release.yml, the v0.1.0 tag and its source commit, on a GitHub-hosted runner; nothing runs until both pass. tests/squabble_action_test.sh (27 cases, with planted tampered downloads and planted action.yml mutants) runs in the new squabble-action.yml workflow. Linux x86_64 only.
• squabble chains — read-only cross-repo CI dependency chains (Phase A of docs/proposals/squabble-modes-and-app-layer.adoc). Pure analysis in squabble-core::chains: cycles and dead upstreams (blocking), diamonds, pin skew and tag/branch pins (warnings), an upstreams-first landing order, and the longest chain (a max-plus longest path, hop-weighted for now). Sources mix freely: local checkouts, and gh:owner/repo read through GitHub GraphQL. --follow N probes upstreams; action repos are probed for existence only, and reusable-workflow upstreams contribute only the files actually called. New exit code 4 = blocking chain finding.
• squabble-forge crate — GitHub GraphQL via gh api graphql, batched with aliases, owner/name passed as variables. Every query is validated in tests against a committed schema snapshot (graphql/github-schema.graphql, refresh with just graphql-schema-refresh). Records rateLimit cost; an exhausted budget marks the remaining repos unavailable rather than guessing. Truncated or binary blobs and renamed repos are reported as notes.
• fetch: PinWorkflowActions, ReconcileActionsPolicy and SetActionsAllowedAll moves, plus the Actions-policy why-probe (actions/permissions + .../selected-actions) that fires when a required context resolves to STARTUP_FAILURE — issue #15. Includes examples/actions-policy-deadlock.json offline fixture coverage.
• Structural scan now surfaces latent Actions-policy deadlocks (empty/gappy selected allowlists, tag-pinned uses: under sha_pinning_required) before any run refuses to start.
• ADR 0002 (docs/decisions/), the spec for representing vacuous greens in the Outcome contract — the spec-first remainder of issue #58.

==== Fixed

• verify-satisfied: a PR with an unsigned or unverified commit no longer reads as done when the base requires signed commits. GitHub blocks that

... (truncated)

Commits

• 541ab9b docs(squabble action): record the permissions and token model for the v0.1.0 ...
• ab315f0 docs(squabble action): record the permissions and token model for the v0.1.0 ...
• See full diff in compare view

Updates github/codeql-action/init from 4.39.0 to 4.39.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.39.0 to 4.39.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.39.0 to 4.39.1

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.39.1

• Update default CodeQL bundle version to 2.27.3. #4256

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.39.1 - 21 Oct 2026

• Update default CodeQL bundle version to 2.27.3. #4256

4.39.0 - 15 Oct 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

... (truncated)

Commits

• 9b32540 Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0f
• b5e1ed9 Trigger workflows
• 20f5ec3 Update changelog for v4.39.1
• c5a2f4b Merge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching
• 61a5a80 Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.3
• 3dd33f8 Merge pull request #4249 from github/mbg/upload-improvements-for-4223
• b96e339 Change comment for getConfig call in upload-sarif
• 7fa4518 Use shouldSkipSarifUpload in analyze-action.ts
• a69c7cb Document that setting the env vars to false takes precedence
• 74ddcd9 Fix typo in comment
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.29 to 2.87.30

Release notes

Sourced from taiki-e/install-action's releases.

2.87.30

• Update zizmor@latest to 1.31.1.

• Update wasmtime@latest to 50.0.0.

• Update vacuum@latest to 0.33.2.

• Update uv@latest to 0.13.4.

• Update trunk@latest to 0.22.0.

• Update tombi@latest to 1.8.9.

• Update syft@latest to 1.55.0.

• Update release-plz@latest to 0.3.173.

• Update prek@latest to 0.5.6.

• Update mise@latest to 2026.10.15.

• Update knope@latest to 0.23.1.

• Update kingfisher@latest to 2.14.0.

• Update kache@latest to 1.2.2.

• Update dprint@latest to 0.64.1.

• Update cosign@latest to 3.1.4.

• Update cargo-crap@latest to 0.9.0.

• Update cargo-binstall@latest to 1.26.0.

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.30] - 2026-10-21

• Update zizmor@latest to 1.31.1.

• Update wasmtime@latest to 50.0.0.

• Update vacuum@latest to 0.33.2.

• Update uv@latest to 0.13.4.

• Update trunk@latest to 0.22.0.

• Update tombi@latest to 1.8.9.

• Update syft@latest to 1.55.0.

• Update release-plz@latest to 0.3.173.

• Update prek@latest to 0.5.6.

• Update mise@latest to 2026.10.15.

• Update knope@latest to 0.23.1.

• Update kingfisher@latest to 2.14.0.

• Update kache@latest to 1.2.2.

• Update dprint@latest to 0.64.1.

• Update cosign@latest to 3.1.4.

• Update cargo-crap@latest to 0.9.0.

• Update cargo-binstall@latest to 1.26.0.

Commits

• a4d3f3f Release 2.87.30
• 5aaaac2 Update dprint@latest to 0.64.1
• b95191e ci: Skip xbuild on ubuntu:rolling
• 8e7750e Update zizmor@latest to 1.31.1
• 603609a Update xh manifest
• aa84e6a Update wasmtime@latest to 50.0.0
• 897035e Update vacuum@latest to 0.33.2
• 59f22e2 Update uv@latest to 0.13.4
• 2594181 Update trunk@latest to 0.22.0
• fc0df34 Update trivy manifest
• Additional commits viewable in compare view

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from b5530834a839734d1d181bfe6edb0d43d4233cf4 to b22bed4f8c6dce82fde639aa0dab9ce79d1006f5

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

== Changelog

=== [Unreleased]

==== Added — .kyaml input (estate YAML policy D280/D307)

• Attack profiles, ambush timelines, amuck specs, +diff+ reports and a2ml bundles now accept the +.kyaml+ extension alongside +.yaml+ and +.yml+. KYAML is a strict subset of YAML, so the same parser reads it. The extension list lives in one place, +crate::yaml::EXTENSIONS+.
• +assemblyline+ fingerprints +.kyaml+ files, so editing one triggers a rescan.
• The example attack profiles are in estate formats: +profiles/attack-profile.example.kyaml+ (KYAML, renamed from +.yaml+) and +profiles/attack-profile.example.json+ (I-JSON/JCS). A test keeps the two in agreement.

==== Fixed — analysis of files whose path is not valid UTF-8

• Language detection now consults +Path::extension()+ rather than a lossy +to_str()+ conversion (+Language::detect_path+; +Language::detect+ delegates to it). A file such as +invalid-\xFF.php+ has an ASCII extension even when its stem is not UTF-8, so it is now analysed instead of being filed away as unsupported — or, worse, excluded, which is not a coverage gap and so let a scan report +complete+ while skipping source it had been asked to scan. +invalid-\xFF.rs+ was affected the same way.

==== Fixed — a bound on reading hexad ledgers

• +load_hexad_dir+ no longer allocates from the file's own size. +HEXAD_FILE_READ_LIMIT+ (64 MiB — two orders of magnitude above any real ledger) is checked from metadata before opening, and the read itself is capped, so a malformed or hostile file in the VeriSimDB directory costs a bounded amount of memory and is reported on stderr instead of being consumed whole.

==== Changed — MSRV 1.89 → 1.90

• The exact pin on +tree-sitter+ 0.27 sets the floor: it declares +rust-version = "1.90"+. The +msrv+ CI job builds with exactly the declared version on every pull request, so this cannot drift silently again.

==== Fixed — YAML parser replaced with safe Rust (RUSTSEC-2024-0449)

• +serde_yaml+ → +serde-saphyr+ 2.0. +serde_yaml+ 0.9 is deprecated and pulled in +unsafe-libyaml+, an archived c2rust translation of libyaml flagged unmaintained by RUSTSEC-2024-0449. +serde-saphyr+ is +#![forbid(unsafe_code)]+. All YAML now goes through +src/yaml.rs+: hand-written configs (attack profiles, timelines, amuck specs) keep the parser's default resource budget; machine-written reports get a node/event budget scaled to input

... (truncated)

Commits

• b22bed4 fix(ci): merge the lockfile, never rebuild it — restores the lockfile blocks ...
• df96e43 CI/CD foundation + PR #241 consolidation (coverage, PHP, estate conformance) ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: hyperpolymath/verisimdb
• Branch: main
• File: .coderabbit.yaml
• Commit: 923ea4d
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 90d583a9-fa65-43a4-aca0-e7967de78f1f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}