chore(deps): bump the actions group with 2 updates

[dependabot]

Bumps the actions group with 2 updates: taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates taiki-e/install-action from 2.85.2 to 2.85.3

Release notes

Sourced from taiki-e/install-action's releases.

2.85.3

• Update xh@latest to 0.26.2.

• Update ubi@latest to 0.10.0.

• Update mise@latest to 2026.7.14.

• Update martin@latest to 1.13.0.

• Update cargo-shear@latest to 1.13.3.

• Update cargo-binstall@latest to 1.21.1.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.85.5] - 2026-07-30

• Update uv@latest to 0.12.0.

• Update syft@latest to 1.50.0.

• Update sccache@latest to 0.17.0.

• Update mise@latest to 2026.7.16.

[2.85.4] - 2026-07-29

• Update uv@latest to 0.11.33.

• Update mise@latest to 2026.7.15.

• Update biome@latest to 2.5.6.

[2.85.3] - 2026-07-28

• Update xh@latest to 0.26.2.

• Update ubi@latest to 0.10.0.

• Update mise@latest to 2026.7.14.

• Update martin@latest to 1.13.0.

• Update cargo-shear@latest to 1.13.3.

• Update cargo-binstall@latest to 1.21.1.

[2.85.2] - 2026-07-26

• Update prek@latest to 0.4.11.

• Update mise@latest to 2026.7.13.

... (truncated)

Commits

• 18b1216 Release 2.85.3
• 3a7eb9d Update xh@latest to 0.26.2
• 3d4a0c1 Update uv manifest
• 9e4a53c Update ubi@latest to 0.10.0
• 9f2f6a3 Update mise@latest to 2026.7.14
• e026bd2 Update martin@latest to 1.13.0
• f72efa0 Update cargo-shear@latest to 1.13.3
• d19664f Update cargo-binstall@latest to 1.21.1
• 4d9bbfb Update biome manifest
• See full diff in compare view

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 38e2d15c9535b3e0bfd86a01f13825ce5adfc482 to 774dceb6373d798ad4d96a9e40c3993942c2836e

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

Changelog

[Unreleased]

Fixed — assail detector precision (false-positive reduction, 2026-06-24)

Three assail analyzer fixes, all conservative (no new false negatives), found while triaging hyperpolymath/proven#68 and JoshuaJewell/paint-type#86:

• UncheckedAllocation (C) is now NULL-check aware. The detector previously flagged every malloc(...) and emitted a line-less, file-level finding. It now scans per line, skips a malloc whose result is NULL-checked within a short window (if (p == NULL), if (!p), nullptr), and attaches a line number — which also lets an inline // panic-attack: accepted marker suppress a reviewed site (marker suppression is line-gated). A genuinely-unchecked malloc still fires. This is why a real null-check fix (proven stubs.c) previously failed to clear.
• DynamicCodeExecution (JS/Python) is word-boundary aware. contains("eval(") matched FFI symbol names like proven_calculator_eval(. Now \beval\s*\( (and \b(?:eval|exec)\s*\( for Python); a genuine eval( still fires.
• CommandInjection (Shell) no longer matches the --eval CLI flag. contains("eval ") matched --eval/-eval. Now the eval builtin is matched only in statement position ((?m)(?:^|[\s;&|(])eval[ \t]).

Verified end-to-end: proven 1→0 active Critical/High (stubs.c clears), paint-type 36→35 (gossamer --eval benchmark FP clears; genuinely-unsafe vendored FFI + the irreducible believe_me axiom correctly remain). 4 new tests in tests/analyzer_tests.rs; full analyzer suite green; zero warnings. PR #134. Refs #32.

Added — attestation unforgeability proof (Idris2, PROOF-PROGRAMME §3.2)

• src/abi/AttestationUnforgeability.idr: Idris2 proof that the intent→evidence→seal attestation chain is unforgeable. Models chain_hash = H(intent‖evidence‖report) + the Ed25519 signature with the cryptographic facts (chain-hash collision-resistance, Ed25519 EUF-CMA message- and signer-binding, signature correctness) as a parameters block — hypotheses, not postulate (PA021 bans escape hatches), so it is an honest conditional theorem. Under %default total it Qed-closes integrity (tampering any phase invalidates the seal), authenticity (a verifying seal comes from the matching key), and nonRepudiation (a genuine seal verifies), plus two corollaries. Typechecks under Idris2 0.8.0. Closes #123.

Added — contractile registry (INDEX.a2ml)

• .machine_readable/contractiles/INDEX.a2ml: the previously-missing contractile registry, modelled on echidna's canonical INDEX. Catalogues all

... (truncated)

Commits

• 774dceb chore(deps): bump the rust-minor group with 3 updates (#166)
• 870fed7 feat(ci): add fail_on_severity so the scan gate can actually fail (#169)
• d032185 ci: vendor validation scripts and remove remote action pins
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions