chore(deps): bump the actions group with 3 updates

[dependabot]

Bumps the actions group with 3 updates: github/codeql-action, taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates github/codeql-action from 4.37.7 to 4.37.8

Release notes

Sourced from github/codeql-action's releases.

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action's changelog.

4.37.8 - 21 Aug 2026

No user facing changes.

Commits

• db488dd Merge pull request #4102 from github/update-v4.37.8-9ee088e13
• 1845f5b Update changelog for v4.37.8
• 9ee088e Merge pull request #4080 from github/henrymercer/studious-giggle
• 1aef003 Address review feedback on overlay disk flags
• 508b83b Merge main into overlay minimum disk feature branch
• d97b342 Merge pull request #4098 from github/mbg/permission-error-as-configuration-error
• 47fa622 Make EACCES a ConfigurationError
• 45693cc Refactor ENOSPC check into isDiskConfigurationError function
• c2fd8f5 Merge pull request #4081 from github/mario-campos/version-cache-to-disk
• c56f48e Log unexpected conditions during caching CLI output
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.86.4 to 2.86.7

Release notes

Sourced from taiki-e/install-action's releases.

2.86.7

• Update tombi@latest to 1.4.1.

• Update rafn@latest to 0.1.5.

• Update cargo-binstall@latest to 1.22.0.

2.86.6

• Update dprint@latest to 0.56.1.

• Update cargo-lambda@latest to 1.9.2.

• Update biome@latest to 2.5.10.

2.86.5

• Update zola@latest to 0.23.4.

• Update wasm-tools@latest to 1.257.1.

• Update protoc@latest to 3.36.0.

• Update mise@latest to 2026.8.10.

• Update cargo-dinghy@latest to 0.8.6.

• Update wasmtime@latest to 48.0.0.

Changelog

Sourced from taiki-e/install-action's changelog.

[2.86.7] - 2026-08-24

• Update tombi@latest to 1.4.1.

• Update rafn@latest to 0.1.5.

• Update cargo-binstall@latest to 1.22.0.

[2.86.6] - 2026-08-23

• Update dprint@latest to 0.56.1.

• Update cargo-lambda@latest to 1.9.2.

• Update biome@latest to 2.5.10.

[2.86.5] - 2026-08-21

• Update zola@latest to 0.23.4.

• Update wasm-tools@latest to 1.257.1.

• Update protoc@latest to 3.36.0.

• Update mise@latest to 2026.8.10.

• Update cargo-dinghy@latest to 0.8.6.

• Update wasmtime@latest to 48.0.0.

Commits

• b6ff580 Release 2.86.7
• a4b7b62 Update tombi@latest to 1.4.1
• 7f5d2c4 Update rafn@latest to 0.1.5
• 0223cb3 Update mise manifest
• 80434f8 Update kingfisher manifest
• 45d93f4 Update cargo-zigbuild manifest
• 7754905 Update cargo-binstall@latest to 1.22.0
• 6cd1350 Release 2.86.6
• 0110a1e Update tombi manifest
• 48a83f9 Update rafn manifest
• Additional commits viewable in compare view

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 0d531555f4c04f086f0af58ec34e1bb27145fdbe to 363418220e76b4f193cc876161b4f86ed4dc54c5

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

== Changelog

=== [Unreleased]

==== Fixed — assail detector precision (false-positive reduction, 2026-06-24)

Three +assail+ analyzer fixes, all conservative (no new false negatives), found while triaging hyperpolymath/proven#68 and JoshuaJewell/paint-type#86:

• UncheckedAllocation (C) is now NULL-check aware. The detector previously flagged every +malloc(...)+ and emitted a line-less, file-level finding. It now scans per line, skips a malloc whose result is NULL-checked within a short window (+if (p == NULL)+, +if (!p)+, +nullptr+), and attaches a line number — which also lets an inline +// panic-attack: accepted+ marker suppress a reviewed site (marker suppression is line-gated). A genuinely-unchecked malloc still fires. This is why a real null-check fix (proven +stubs.c+) previously failed to clear.
• DynamicCodeExecution (JS/Python) is word-boundary aware. +contains("eval(")+ matched FFI symbol names like +proven_calculator_eval(+. Now +\beval\s*\(+ (and +\b(?:eval|exec)\s*\(+ for Python); a genuine +eval(+ still fires.
• CommandInjection (Shell) no longer matches the +--eval+ CLI flag. +contains("eval ")+ matched +--eval+/+-eval+. Now the eval builtin is matched only in statement position (+(?m)(?:^|[\s;&|(])eval[ \t]+).

Verified end-to-end: proven 1→0 active Critical/High (+stubs.c+ clears), paint-type 36→35 (gossamer +--eval+ benchmark FP clears; genuinely-unsafe vendored FFI + the irreducible +believe_me+ axiom correctly remain). 4 new tests in +tests/analyzer_tests.rs+; full analyzer suite green; zero warnings. PR #134. Refs #32.

==== Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME §3.2)

• +src/abi/AttestationUnforgeability.idr+: Idris2 proof that the intent→evidence→seal attestation chain is unforgeable. Models +chain_hash = H(intent‖evidence‖report)+ + the Ed25519 signature with the cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA message- and signer-binding, signature correctness) as a +parameters+ block — hypotheses, not +postulate+ (PA021 bans escape hatches), so it is an honest conditional theorem. Under +%default total+ it Qed-closes +integrity+ (tampering any phase invalidates the seal), +authenticity+ (a verifying seal comes from the matching key), and +nonRepudiation+ (a genuine seal verifies), plus two corollaries. Typechecks under Idris2 0.8.0. Closes #123.

==== Added — contractile registry (INDEX.a2ml)

• +.machine_readable/contractiles/INDEX.a2ml+: the

... (truncated)

Commits

• 3634182 feat(labels): estate label tooling + auto-triage for new issues (#190)
• 3301258 fix(ci): unbreak workflow YAML and add a complete actions.lock (#188)
• 337d799 Fix/assail affine deserialization checks (#187)
• 01920ee fix(assail): retain AffineScript deserialization checks (#186)
• 3d261eb fix(assail): recognize canonical AffineScript extension (#185)
• 6aacab5 refactor: migrate Markdown to AsciiDoc (#184)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR updates several GitHub Actions to their latest versions, including CodeQL and the install-action utility. According to Codacy analysis, the repository remains up to standards; however, the review identified a high-priority security improvement. Specifically, third-party actions in the smoke test and S4 loop workflows are currently pinned to mutable version tags rather than immutable commit SHAs. This practice is recommended to mitigate supply chain risks. Developers should consider updating these references to use SHAs while keeping the version number as a comment. All updates should be verified against the provided test plan to ensure CI stability.

Test suggestions

• Verify CodeQL initialization and analysis steps (v4.37.8) execute successfully in CI for both 'javascript-typescript' and 'actions' languages.
• Verify taiki-e/install-action@v2.86.7 successfully installs 'just' version 1.51.0 and that subsequent 'just' commands succeed.
• Confirm the security scan workflow at the updated commit SHA (3634182) initializes correctly and passes secrets as expected.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify CodeQL initialization and analysis steps (v4.37.8) execute successfully in CI for both 'javascript-typescript' and 'actions' languages.
2. Verify taiki-e/install-action@v2.86.7 successfully installs 'just' version 1.51.0 and that subsequent 'just' commands succeed.
3. Confirm the security scan workflow at the updated commit SHA (3634182) initializes correctly and passes secrets as expected.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Pinning GitHub Actions to a commit SHA ensures that the version remains immutable. This ensures the action you've audited is the exact one being executed in your pipeline, preventing risks associated with mutable tags.

See Issue in Codacy

[codacy-production]

_{🔴 HIGH RISK}

Pinning GitHub Actions to a commit SHA ensures that the version remains immutable. This aligns with security best practices by ensuring the execution environment is strictly version-locked and protected against potential tag redirection or hijacking.

See Issue in Codacy

[hyperpolymath]

\