chore(deps): bump the actions group with 3 updates (#382)

Bumps the actions group with 3 updates:
[github/codeql-action](https://github.com/github/codeql-action),
[taiki-e/install-action](https://github.com/taiki-e/install-action) and
[hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attack).

Updates `github/codeql-action` from 4.37.9 to 4.38.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.38.0</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/b96794f015dfd88f77b49b1c93e0fa7110f94c63"><code>b96794f</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4131">#4131</a>
from github/update-v4.38.0-7e08580a9</li>
<li><a
href="https://github.com/github/codeql-action/commit/02d5093871674ea20274117103ce3038c73c77ef"><code>02d5093</code></a>
Update changelog for v4.38.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/7e08580a93dc4e4b9dda167e364577035cf504c6"><code>7e08580</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4130">#4130</a>
from github/henrymercer/workflow-runner-sizing</li>
<li><a
href="https://github.com/github/codeql-action/commit/bfcc52b4f5d98468a5993daa0bf0e4fb3f3ed698"><code>bfcc52b</code></a>
Run slow macOS checks on larger runners</li>
<li><a
href="https://github.com/github/codeql-action/commit/8c251e757c0260283fc50214a06ac768b61d3af4"><code>8c251e7</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4129">#4129</a>
from github/update-bundle/codeql-bundle-v2.27.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/0b7ca400df35985869d4b9146a067865d4115da1"><code>0b7ca40</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/40484b339517c6bcf00f81eebc95ca041ddca505"><code>40484b3</code></a>
Update default bundle to codeql-bundle-v2.27.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/977e6ceaea7361825998245d787fa3b4d6b9e5df"><code>977e6ce</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4124">#4124</a>
from github/henrymercer/toolcache-bundle-cleanup</li>
<li><a
href="https://github.com/github/codeql-action/commit/40a6b3824794ae1156e1a5320d32e364bf1dcebc"><code>40a6b38</code></a>
Address toolcache cleanup review feedback</li>
<li><a
href="https://github.com/github/codeql-action/commit/deece8f852f048bc3f52fd42c9cc7a99b1ebb252"><code>deece8f</code></a>
Apply suggestion from <a
href="https://github.com/henrymercer"><code>@​henrymercer</code></a></li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/v4.37.9...v4.38.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `taiki-e/install-action` from 2.87.3 to 2.87.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's
releases</a>.</em></p>
<blockquote>
<h2>2.87.13</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.6.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.30.5.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.5.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.167.</p>
</li>
<li>
<p>Update <code>protoc-gen-connect-openapi@latest</code> to 0.27.2.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.5.3.</p>
</li>
<li>
<p>Update <code>osv-scanner@latest</code> to 2.6.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.7.</p>
</li>
<li>
<p>Update <code>kache@latest</code> to 0.21.0.</p>
</li>
<li>
<p>Update <code>cargo-leptos@latest</code> to 0.3.8.</p>
</li>
<li>
<p>Update <code>cargo-auditable@latest</code> to 0.7.6.</p>
</li>
</ul>
<h2>2.87.12</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.2.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.259.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.13.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.165.</p>
</li>
<li>
<p>Update <code>protoc-gen-connect-openapi@latest</code> to 0.27.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.5.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.144.</p>
</li>
</ul>
<h2>2.87.11</h2>
<ul>
<li>
<p>Update <code>biome@latest</code> to 2.5.13.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.12.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.4.</p>
</li>
<li>
<p>Update <code>kache@latest</code> to 0.19.0.</p>
</li>
</ul>
<h2>2.87.10</h2>
<ul>
<li>Update <code>zizmor@latest</code> to 1.30.1.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's
changelog</a>.</em></p>
<blockquote>
<h2>[2.87.13] - 2026-09-15</h2>
<ul>
<li>
<p>Update <code>zola@latest</code> to 0.23.6.</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.30.5.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.5.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.167.</p>
</li>
<li>
<p>Update <code>protoc-gen-connect-openapi@latest</code> to 0.27.2.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.5.3.</p>
</li>
<li>
<p>Update <code>osv-scanner@latest</code> to 2.6.0.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.7.</p>
</li>
<li>
<p>Update <code>kache@latest</code> to 0.21.0.</p>
</li>
<li>
<p>Update <code>cargo-leptos@latest</code> to 0.3.8.</p>
</li>
<li>
<p>Update <code>cargo-auditable@latest</code> to 0.7.6.</p>
</li>
</ul>
<h2>[2.87.12] - 2026-09-12</h2>
<ul>
<li>
<p>Update <code>wasmtime@latest</code> to 48.0.2.</p>
</li>
<li>
<p>Update <code>wasm-tools@latest</code> to 1.259.0.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.13.</p>
</li>
<li>
<p>Update <code>release-plz@latest</code> to 0.3.165.</p>
</li>
<li>
<p>Update <code>protoc-gen-connect-openapi@latest</code> to 0.27.1.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.5.</p>
</li>
<li>
<p>Update <code>cargo-nextest@latest</code> to 0.9.144.</p>
</li>
</ul>
<h2>[2.87.11] - 2026-09-11</h2>
<ul>
<li>
<p>Update <code>biome@latest</code> to 2.5.13.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.12.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.9.4.</p>
</li>
<li>
<p>Update <code>kache@latest</code> to 0.19.0.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/taiki-e/install-action/commit/26e9283f268b880168bdbd2c545dfcd60ec2c6ab"><code>26e9283</code></a>
Release 2.87.13</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/04a4a8246c7a2f2eaf87e42293bca7269081db97"><code>04a4a82</code></a>
Update <code>zola@latest</code> to 0.23.6</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/b9c60f15f4eb442f41065a510b0f59af400f446f"><code>b9c60f1</code></a>
Update <code>vacuum@latest</code> to 0.30.5</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/b31d41ab50dced8ea9cf3c57e9d5cc72056195b8"><code>b31d41a</code></a>
Update uv manifest</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/1b200db2bbc6f05645c43889fb464ddf599f8342"><code>1b200db</code></a>
Update <code>tombi@latest</code> to 1.5.5</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/d3a7a77950c0ece9292ebee57d72a8b83d4d352c"><code>d3a7a77</code></a>
Update sccache manifest</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/3e3c2df701b5f6f49f22ed085cd483c3a315a5ad"><code>3e3c2df</code></a>
Update <code>release-plz@latest</code> to 0.3.167</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/d4446731e441b4b4ec4f412c6f953fd4accd114b"><code>d444673</code></a>
Update <code>protoc-gen-connect-openapi@latest</code> to 0.27.2</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/e75a66b87d55a9adef6d69af04b0f69631daf082"><code>e75a66b</code></a>
Update <code>prek@latest</code> to 0.5.3</li>
<li><a
href="https://github.com/taiki-e/install-action/commit/034ed194fcb80aefbc57346f8e914946d777dee6"><code>034ed19</code></a>
Update oxfmt manifest</li>
<li>Additional commits viewable in <a
href="https://github.com/taiki-e/install-action/compare/v2.87.3...v2.87.13">compare
view</a></li>
</ul>
</details>
<br />

Updates
`hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml` from
2b7202dbd5d545b0fbf79c8d43f80c3d6f4489d0 to
a030ef32c571b4aa22bbcd4a41acbdd9a801d366
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.adoc">hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's
changelog</a>.</em></p>
<blockquote>
<p>== Changelog</p>
<p>=== [Unreleased]</p>
<p>==== Fixed — assail detector precision (false-positive reduction,
2026-06-24)</p>
<p>Three <code>+assail+</code> analyzer fixes, all conservative (no new
false
negatives), found while triaging <a
href="https://redirect.github.com/hyperpolymath/proven/issues/68">hyperpolymath/proven#68</a>
and
<a
href="https://redirect.github.com/JoshuaJewell/paint-type/issues/86">JoshuaJewell/paint-type#86</a>:</p>
<ul>
<li><em>UncheckedAllocation (C) is now NULL-check aware.</em> The
detector
previously flagged <em>every</em> <code>+malloc(...)+</code> and emitted
a line-less,
file-level finding. It now scans per line, skips a malloc whose result
is NULL-checked within a short window (<code>+if (p == NULL)+</code>,
<code>+if (!p)+</code>,
<code>+nullptr+</code>), and attaches a line number — which also lets an
inline
<code>+// panic-attack: accepted+</code> marker suppress a reviewed site
(marker
suppression is line-gated). A genuinely-unchecked malloc still fires.
This is why a real null-check fix (proven <code>+stubs.c+</code>)
previously failed
to clear.</li>
<li><em>DynamicCodeExecution (JS/Python) is word-boundary aware.</em>
<code>+contains(&quot;eval(&quot;)+</code> matched FFI symbol names like
<code>+proven_calculator_eval(+</code>. Now <code>+\beval\s*\(+</code>
(and
<code>+\b(?:eval|exec)\s*\(+</code> for Python); a genuine
<code>+eval(+</code> still fires.</li>
<li><em>CommandInjection (Shell) no longer matches the
<code>+--eval+</code> CLI flag.</em>
<code>+contains(&quot;eval &quot;)+</code> matched
<code>+--eval+</code>/<code>+-eval+</code>. Now the eval builtin
is matched only in statement position
(<code>+(?m)(?:^|[\s;&amp;|(])eval[ \t]+</code>).</li>
</ul>
<p>Verified end-to-end: proven 1→0 active Critical/High
(<code>+stubs.c+</code>
clears), paint-type 36→35 (gossamer <code>+--eval+</code> benchmark FP
clears;
genuinely-unsafe vendored FFI + the irreducible
<code>+believe_me+</code> axiom
correctly remain). 4 new tests in
<code>+tests/analyzer_tests.rs+</code>; full
analyzer suite green; zero warnings. PR <a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/134">#134</a>.
Refs <a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/32">#32</a>.</p>
<p>==== Added — attestation unforgeability proof (Idris2,
PROOF-PROGRAMME §3.2)</p>
<ul>
<li><em><code>+src/abi/AttestationUnforgeability.idr+</code></em>:
Idris2 proof that the
intent→evidence→seal attestation chain is unforgeable. Models
<code>+chain_hash = H(intent‖evidence‖report)+</code> + the Ed25519
signature with
the cryptographic facts (chain-hash collision-resistance, Ed25519
EUF-CMA message- and signer-binding, signature correctness) as a
<code>+parameters+</code> block — hypotheses, <em>not</em>
<code>+postulate+</code> (PA021 bans
escape hatches), so it is an honest <em>conditional</em> theorem. Under
<code>+%default total+</code> it Qed-closes <code>+integrity+</code>
(tampering any phase
invalidates the seal), <code>+authenticity+</code> (a verifying seal
comes from the
matching key), and <code>+nonRepudiation+</code> (a genuine seal
verifies), plus
two corollaries. Typechecks under Idris2 0.8.0. Closes <a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/123">#123</a>.</li>
</ul>
<p>==== Added — contractile registry (INDEX.a2ml)</p>
<ul>
<li><em><code>+.machine_readable/contractiles/INDEX.a2ml+</code></em>:
the</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/a030ef32c571b4aa22bbcd4a41acbdd9a801d366"><code>a030ef3</code></a>
chore(deps): bump eframe from 0.35.0 to 0.36.2 (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/196">#196</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/b3aa86dbd5903fc6e33aafa43a8a77fee9061e21"><code>b3aa86d</code></a>
chore(deps): bump dirs from 6.0.0 to 7.0.0 (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/195">#195</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/3bc57538b52c2a2f5230c6e29fae5be5542789a2"><code>3bc5753</code></a>
chore(deps): bump the rust-minor group with 2 updates (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/194">#194</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/27b8de55b4805252c43bd8d32c0c4e49a50f8fcb"><code>27b8de5</code></a>
fix(ci): make the dogfood gate .deed-aware (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/197">#197</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/2e043bb87e371d710cd4afcca0ea070b6d7c4252"><code>2e043bb</code></a>
chore(ci): bump governance-reusable pin to standards main (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/193">#193</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/f21f73be9830195b419cf82702c013fc2641250b"><code>f21f73b</code></a>
chore(deps): bump the rust-minor group across 1 directory with 2 updates
(<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/191">#191</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/540dbc72d23119b28a22251179c5938bca72109c"><code>540dbc7</code></a>
fix(ci): the invisible-character gate never matched anything (<a
href="https://redirect.github.com/hyperpolymath/panic-attack/issues/189">#189</a>)</li>
<li>See full diff in <a
href="https://github.com/hyperpolymath/panic-attack/compare/2b7202dbd5d545b0fbf79c8d43f80c3d6f4489d0...a030ef32c571b4aa22bbcd4a41acbdd9a801d366">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/codeql.yml

@@ -44,12 +44,12 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@v4.38.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@v4.38.0
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/mvp-smoke.yml

@@ -40,7 +40,7 @@ jobs:
         uses: Swatinem/rust-cache@v2.9.2
 
       - name: Install just
-        uses: taiki-e/install-action@v2.87.3
+        uses: taiki-e/install-action@v2.87.13
         with:
           # Governance R1 requires versioned family-tool pins
           # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`

.github/workflows/s4-loop.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Cache Cargo
         uses: Swatinem/rust-cache@v2.9.2
       - name: Install just
-        uses: taiki-e/install-action@v2.87.3
+        uses: taiki-e/install-action@v2.87.13
         with:
           tool: just@1.51.0
       - name: Install system dependencies

.github/workflows/security-scan.yml

@@ -23,6 +23,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@2b7202dbd5d545b0fbf79c8d43f80c3d6f4489d0 # main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@a030ef32c571b4aa22bbcd4a41acbdd9a801d366 # main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}