[dependabot]

Bumps the actions group with 3 updates in the / directory: Swatinem/rust-cache, taiki-e/install-action and hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml.

Updates Swatinem/rust-cache from 2.9.2 to 2.9.3

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.9.3

What's Changed

• Issue-375: stop cleanup timestamp pruning after the first entry by @​TethysSvensson in Swatinem/rust-cache#377
• fix: log rustup toolchain list failure as info instead of warning by @​SDAChess in Swatinem/rust-cache#394

New Contributors

• @​TethysSvensson made their first contribution in Swatinem/rust-cache#377
• @​SDAChess made their first contribution in Swatinem/rust-cache#394

Full Changelog: Swatinem/rust-cache@v2.9.2...v2.9.3

Changelog

Sourced from Swatinem/rust-cache's changelog.

2.9.3

• Fix timestamp based pruning
• Add missing awaits
• Do not emit warning on missing rustup

Commits

• d1527c8 2.9.3
• f0fca6f update dependencies and rebuild
• b49b17f add missing awaits
• 6a7bc3e Bump the dev-minor group across 1 directory with 2 updates (#383)
• 4ece996 Bump the actions group across 1 directory with 6 updates (#392)
• 8103aff Bump the prd-minor group across 1 directory with 2 updates (#389)
• 0e361f3 fix: log rustup toolchain list failure as info instead of warning (#393) (#394)
• f0d9c38 Merge pull request #380 from Swatinem/dependabot/github_actions/actions-8ff58...
• ccd9742 Bump the actions group with 2 updates
• 258712b fix: stop cleanup timestamp pruning after the first entry (#377)
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.28 to 2.87.32

Release notes

Sourced from taiki-e/install-action's releases.

2.87.32

• Update wild@latest to 0.11.0.

• Update vacuum@latest to 0.35.2.

• Update tombi@latest to 1.9.5.

• Update sccache@latest to 0.19.0.

• Update release-plz@latest to 0.4.1.

• Update mise@latest to 2026.10.19.

• Update knope@latest to 0.23.2.

• Update dprint@latest to 0.64.3.

• Update cargo-vet@latest to 0.10.3.

• Update cargo-sort@latest to 2.1.4.

• Update cargo-binstall@latest to 1.26.1.

• Update biome@latest to 2.6.3.

2.87.31

• Downgrade cargo-sort@latest to 2.1.3.

• Update vacuum@latest to 0.35.0.

• Update xh@latest to 0.26.3.

• Update uv@latest to 0.13.5.

• Update ubi@latest to 0.13.0.

• Update trivy@latest to 0.76.1.

• Update tombi@latest to 1.9.0.

• Update release-plz@latest to 0.3.174.

• Update prek@latest to 0.5.7.

• Update mise@latest to 2026.10.17.

• Update jaq@latest to 3.1.2.

• Update espup@latest to 0.17.1.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.87.32] - 2026-10-26

• Update wild@latest to 0.11.0.

• Update vacuum@latest to 0.35.2.

• Update tombi@latest to 1.9.5.

• Update sccache@latest to 0.19.0.

• Update release-plz@latest to 0.4.1.

• Update mise@latest to 2026.10.19.

• Update knope@latest to 0.23.2.

• Update dprint@latest to 0.64.3.

• Update cargo-vet@latest to 0.10.3.

• Update cargo-sort@latest to 2.1.4.

• Update cargo-binstall@latest to 1.26.1.

• Update biome@latest to 2.6.3.

[2.87.31] - 2026-10-23

• Downgrade cargo-sort@latest to 2.1.3.

• Update vacuum@latest to 0.35.0.

• Update xh@latest to 0.26.3.

• Update uv@latest to 0.13.5.

• Update ubi@latest to 0.13.0.

• Update trivy@latest to 0.76.1.

• Update tombi@latest to 1.9.0.

• Update release-plz@latest to 0.3.174.

• Update prek@latest to 0.5.7.

• Update mise@latest to 2026.10.17.

• Update jaq@latest to 3.1.2.

... (truncated)

Commits

• 5488ac5 Release 2.87.32
• 688322d ci: Mark cargo-vet as glibc_pre_2_34_incompat
• cebf56e Update wild@latest to 0.11.0
• 84f1fb1 Update vacuum@latest to 0.35.2
• 22b4d72 Update trunk manifest
• 4aa26a3 Update tombi@latest to 1.9.5
• 354bf5e Update sccache@latest to 0.19.0
• 89eb201 Update release-plz@latest to 0.4.1
• 304ba0d Update mise@latest to 2026.10.19
• 104910e Update knope@latest to 0.23.2
• Additional commits viewable in compare view

Updates hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 8955f615f769204e42340e08bdea2de9d72e81cd to be6ac46716eaf049570ec4966f4ae4699b319689

Changelog

Sourced from hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml's changelog.

== Changelog

=== [Unreleased]

==== Fixed — KYAML keys holding a line separator

• KYAML output now escapes U+2028 (LS) and U+2029 (PS) as +\uXXXX+, as it already did for NEL (U+0085). go-yaml, the parser behind +yq+, reads all three as line breaks, so a raw one in a key made the document unparseable by +yq+ and by standards' +kyaml-format.sh+. +crate::yaml+ (serde-saphyr) read these files correctly before and after.

==== Changed — attestation hashes are reproducible JCS

• +assail --attest+ now hashes the intent and evidence records as their JCS (RFC 8785) bytes instead of +serde_json+ struct order, and writes the +.attestation.json+ sidecar itself as I-JSON/JCS. Anyone holding the sidecar can recompute both hashes in any language, for example with +jq -cjS .attestation.intent | sha256sum+.
• The seal gains a +hash_scheme+ field (+jcs-sha256+). The scheme is prefixed to the chain hash, so it is covered by any Ed25519 signature: relabelling a seal as legacy to skip the content check breaks the chain hash.
• +attest verify+ now rehashes the embedded intent and evidence and fails on a mismatch. Before, it checked only that the chain hash matched the three stored digests, so the intent and evidence could be edited after sealing without detection. Sidecars written before this change (no +hash_scheme+) still verify, reported as +not rehashed (legacy hash scheme)+.
• +attest verify+ rejects any digest field that is not exactly 64 lowercase hex characters. Fixed widths keep the legacy and scheme-prefixed chain inputs (192 and 202 bytes) apart; otherwise moving the scheme name into +intent_hash+ would reproduce the signed bytes on the legacy path.

==== Added — KYAML report output

• +--output-format kyaml+ writes reports in KYAML, the estate YAML dialect (+crate::kyaml+). The output is a fixed point of +yq -p yaml -o kyaml+ (v4.54.1), so it passes standards' +scripts/kyaml-format.sh --check+. On the reports checked it is also byte-identical to +yq -p json -o kyaml+ run on the JCS report. (Reading JSON, +yq+ reformats some floats, +1e-7+ to +1e-07+; the KYAML report keeps the JCS form, which +yq+ preserves.)
• Keys and numbers are in JCS order and form, so the KYAML and JSON reports of a scan hold the same data.
• One deliberate difference from +yq+: the YAML non-printables U+007F to U+009F, U+FFFE and U+FFFF are escaped as +\uXXXX+. +yq+ writes them raw, and U+0085 (NEL) then reads back as a line break. +kyaml-format.sh+ refuses such a file rather than judging it, because +yq+'s own rewrite would change the data.
• +README.adoc+ now lists the real +--output-format+ values; it named +markdown+ and +text+, which never existed.

==== Added — .kyaml input (estate YAML policy D280/D307)

... (truncated)

Commits

• be6ac46 Fix Patch Bridge lockfile discovery and empty reports (#254)
• 410a8f8 fix(k9): validate K9 with the canonical validator (#253)
• c34d76a ci(actions-lock): add the missing SLSA generator record (#251)
• ac68bba fix(kyaml): escape U+2028 and U+2029 so keys stay parseable by yq (#250)
• 2285a77 feat(attestation): hash intent and evidence as JCS and bind them on verify (#...
• dd91585 fix(assail): make assail reports deterministic (#245)
• cb50e1b ci(dogfood): include .kyaml files in the dogfood gate's file scans (#246)
• b17deef feat(report): add --output-format kyaml (#248)
• e2eba7d Add explicit assail coverage and native PHP analysis (#241)
• deda819 fix(ci): carry composite-action dependencies onto the SHA-keyed lockfile entr...
• Additional commits viewable in compare view

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T08:11:42.094186Z	2bf165e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 674a88af-2ba2-4f7f-844d-3167e15e7c0b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2bf165ea4b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Restore the reusable workflow to the lock graph

Whenever the governance/Hypatia lock audit runs, this empty entry conflicts with .github/workflows/security-scan.yml, which still invokes hyperpolymath/panic-attack at the new SHA. The change also removes that reusable workflow’s dependency record and its three transitive actions, so the lock is no longer transitively closed and is reported as invalid_actions_lock / workflow_dependencies_missing, leaving the governance gate red and the security workflow outside lock coverage. Pin a panic-attack revision that the estate lock tooling can resolve, then regenerate the complete lock graph rather than recording this workflow as action-free.

Useful? React with 👍 / 👎.