chore(deps): bump the actions group with 4 updates

[dependabot]

Bumps the actions group with 4 updates: haskell-actions/setup, github/codeql-action, taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates haskell-actions/setup from 2.12.0 to 2.12.1

Release notes

Sourced from haskell-actions/setup's releases.

v2.12.1

Add Cabal 3.18.1.0 and Stack 3.11.1

What's Changed

• Add Cabal 3.18.1.0 and Stack 3.11.1 by @​andreasabel in haskell-actions/setup#151

Full Changelog: haskell-actions/setup@v2.12.0...v2.12.1

Commits

• 0f8e8c9 Add Cabal 3.18.1.0 and Stack 3.11.1
• See full diff in compare view

Updates github/codeql-action from 4.38.0 to 4.38.1

Release notes

Sourced from github/codeql-action's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Changelog

Sourced from github/codeql-action's changelog.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.13 to 2.87.18

Release notes

Sourced from taiki-e/install-action's releases.

2.87.18

• Update oxfmt@latest to 1.84.0.

• Update mise@latest to 2026.9.12.

• Update kache@latest to 0.26.3.

• Update cargo-tarpaulin@latest to 0.37.4.

• Update cargo-rdme@latest to 2.2.3.

2.87.17

• Update uv@latest to 0.12.17.

• Update release-plz@latest to 0.3.169.

• Update kingfisher@latest to 2.5.0.

• Update kache@latest to 0.25.0.

• Update git-cliff@latest to 2.14.2.

• Update cargo-tarpaulin@latest to 0.37.3.

• Update cargo-leptos@latest to 0.3.9.

2.87.16

• Update uv@latest to 0.12.16.

• Update release-plz@latest to 0.3.168.

• Update protoc@latest to 3.36.2.

• Update mise@latest to 2026.9.11.

2.87.15

• Update syft@latest to 1.52.0.

• Update mise@latest to 2026.9.10.

• Update kingfisher@latest to 2.4.0.

• Update kache@latest to 0.23.1.

• Update coreutils@latest to 0.12.0.

• Update cargo-nextest@latest to 0.9.145.

2.87.14

• Update vacuum@latest to 0.30.6.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.18] - 2026-09-22

• Update oxfmt@latest to 1.84.0.

• Update mise@latest to 2026.9.12.

• Update kache@latest to 0.26.3.

• Update cargo-tarpaulin@latest to 0.37.4.

• Update cargo-rdme@latest to 2.2.3.

[2.87.17] - 2026-09-20

• Update uv@latest to 0.12.17.

• Update release-plz@latest to 0.3.169.

• Update kingfisher@latest to 2.5.0.

• Update kache@latest to 0.25.0.

• Update git-cliff@latest to 2.14.2.

• Update cargo-tarpaulin@latest to 0.37.3.

• Update cargo-leptos@latest to 0.3.9.

[2.87.16] - 2026-09-19

• Update uv@latest to 0.12.16.

• Update release-plz@latest to 0.3.168.

• Update protoc@latest to 3.36.2.

• Update mise@latest to 2026.9.11.

[2.87.15] - 2026-09-18

• Update syft@latest to 1.52.0.

• Update mise@latest to 2026.9.10.

• Update kingfisher@latest to 2.4.0.

• Update kache@latest to 0.23.1.

• Update coreutils@latest to 0.12.0.

... (truncated)

Commits

• dfae9bf Release 2.87.18
• 0fa03e1 Update oxfmt@latest to 1.84.0
• 0f764f8 Update wasmtime manifest
• 2fcc16d Update oxfmt manifest
• ad339b4 Update mise@latest to 2026.9.12
• 1162c3b Update kache@latest to 0.26.3
• 9e2a27b Update cargo-tarpaulin@latest to 0.37.4
• 7542627 Update cargo-shear manifest
• d9ff78f Update cargo-rdme@latest to 2.2.3
• 1d72ff7 Update cargo-nextest manifest
• Additional commits viewable in compare view

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from a030ef32c571b4aa22bbcd4a41acbdd9a801d366 to 27b3d93b11fbfc03cee695e791904d741ce2b24b

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

== Changelog

=== [Unreleased]

==== Fixed — assail detector precision (false-positive reduction, 2026-06-24)

Three +assail+ analyzer fixes, all conservative (no new false negatives), found while triaging hyperpolymath/proven#68 and JoshuaJewell/paint-type#86:

• UncheckedAllocation (C) is now NULL-check aware. The detector previously flagged every +malloc(...)+ and emitted a line-less, file-level finding. It now scans per line, skips a malloc whose result is NULL-checked within a short window (+if (p == NULL)+, +if (!p)+, +nullptr+), and attaches a line number — which also lets an inline +// panic-attack: accepted+ marker suppress a reviewed site (marker suppression is line-gated). A genuinely-unchecked malloc still fires. This is why a real null-check fix (proven +stubs.c+) previously failed to clear.
• DynamicCodeExecution (JS/Python) is word-boundary aware. +contains("eval(")+ matched FFI symbol names like +proven_calculator_eval(+. Now +\beval\s*\(+ (and +\b(?:eval|exec)\s*\(+ for Python); a genuine +eval(+ still fires.
• CommandInjection (Shell) no longer matches the +--eval+ CLI flag. +contains("eval ")+ matched +--eval+/+-eval+. Now the eval builtin is matched only in statement position (+(?m)(?:^|[\s;&|(])eval[ \t]+).

Verified end-to-end: proven 1→0 active Critical/High (+stubs.c+ clears), paint-type 36→35 (gossamer +--eval+ benchmark FP clears; genuinely-unsafe vendored FFI + the irreducible +believe_me+ axiom correctly remain). 4 new tests in +tests/analyzer_tests.rs+; full analyzer suite green; zero warnings. PR #134. Refs #32.

==== Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME §3.2)

• +src/abi/AttestationUnforgeability.idr+: Idris2 proof that the intent→evidence→seal attestation chain is unforgeable. Models +chain_hash = H(intent‖evidence‖report)+ + the Ed25519 signature with the cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA message- and signer-binding, signature correctness) as a +parameters+ block — hypotheses, not +postulate+ (PA021 bans escape hatches), so it is an honest conditional theorem. Under +%default total+ it Qed-closes +integrity+ (tampering any phase invalidates the seal), +authenticity+ (a verifying seal comes from the matching key), and +nonRepudiation+ (a genuine seal verifies), plus two corollaries. Typechecks under Idris2 0.8.0. Closes #123.

==== Added — contractile registry (INDEX.a2ml)

• +.machine_readable/contractiles/INDEX.a2ml+: the

... (truncated)

Commits

• 27b3d93 fix(ci): reconcile actions.lock so the lockfile validates (#207)
• 467fedf fix(gates): gate on the DEED grammar, per the template and standards#837 (#206)
• 54b6a24 ci(hypatia): standardise the wrapper caller id to the canonical hypatia (#205)
• cf1aef4 chore(ci): remove dead Codecov upload steps + lock pins (#204)
• b76ce7e fix(ci): reconcile the workflows with actions.lock (gh-actions-lock) (#203)
• 7f429c9 fix(ci): key action refs already used by the workflows (#202)
• 6e1210d fix(ci): pin third-party actions to full commit SHAs (#201)
• 5e5e239 refactor(root): move root artefacts to their canonical locations (#199)
• b70d6da chore(www): migrate root .well-known/ to www/.well-known/ (#198)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 092fcbea-ec29-434b-bd2d-2d791f0e791b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}