0.1.2: fix warm-reuse leak + wrong output (#33), dependency refresh, security fixes

.github/workflows/canary.yml

@@ -25,7 +25,7 @@ jobs:
         # large-packages removes `^llvm-.*` (libclang/lld) → breaks boring-sys2
         # bindgen + lld linking. Keep it false; the rest still frees ~20 GB.
         with: { tool-cache: true, android: true, dotnet: true, haskell: true, large-packages: false, swap-storage: false }
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - name: Install skia system deps (freetype + fontconfig)

.github/workflows/changelog.yml

@@ -22,7 +22,7 @@ jobs:
     name: Validate CHANGELOG for workspace version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - name: Extract [workspace.package] version
         id: ver
         run: |

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     name: Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           components: rustfmt
@@ -40,7 +40,7 @@ jobs:
     # lives in the root Cargo.toml `[workspace.lints.clippy]` table; any
     # remaining per-site `#[allow(...)]` carries a justifying comment.
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           components: clippy
@@ -81,7 +81,7 @@ jobs:
           large-packages: false
           swap-storage: true
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           toolchain: ${{ matrix.rust }}
@@ -118,7 +118,7 @@ jobs:
     name: MSRV
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       # 1.91 is the real floor: deno_core 0.403 uses const `TypeId::of`
       # (cppgc.rs), stabilized in Rust 1.91, but declares no rust-version — so
       # the resolver doesn't catch it; only an actual build does (1.90 fails,
@@ -138,11 +138,11 @@ jobs:
     # Mechanical enforcement of the workspace policy at deny.toml:
     # MIT/Apache-only licenses, crates.io-only sources, fail on advisories.
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       # Use the current cargo-deny CLI rather than the action: the action bundles
       # an older cargo-deny whose advisory-db parser chokes on newer RUSTSEC
       # entries (e.g. RUSTSEC-2026-0124). The current CLI parses them fine.
-      - uses: taiki-e/install-action@daa3c1f1f9a9d46f686d9fc2f65773d0c293688b # v2
+      - uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
         with:
           # Pin a version new enough to parse current advisory-db entries
           # (older cargo-deny chokes on e.g. RUSTSEC-2026-0124).
@@ -153,11 +153,11 @@ jobs:
     name: Security audit (cargo-audit / RUSTSEC)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       # Use the current cargo-audit CLI rather than rustsec/audit-check: the
       # action bundles an older rustsec parser that chokes on newer advisory-db
       # entries. cargo-audit reads the ignore list from audit.toml.
-      - uses: taiki-e/install-action@daa3c1f1f9a9d46f686d9fc2f65773d0c293688b # v2
+      - uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
         with:
           # Pin a version new enough to parse current advisory-db entries
           # (the action's default older cargo-audit chokes on RUSTSEC-2026-0124).
@@ -168,8 +168,8 @@ jobs:
     name: TOML format (taplo)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: taiki-e/install-action@daa3c1f1f9a9d46f686d9fc2f65773d0c293688b # v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
+      - uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
         with:
           tool: taplo-cli
       - run: taplo fmt --check
@@ -178,8 +178,8 @@ jobs:
     name: Unused deps (cargo-shear)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: taiki-e/install-action@daa3c1f1f9a9d46f686d9fc2f65773d0c293688b # v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
+      - uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
         with:
           tool: cargo-shear
       - run: cargo shear
@@ -188,7 +188,7 @@ jobs:
     name: Unsafe-code report (cargo-geiger, informational)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
@@ -205,12 +205,12 @@ jobs:
       - name: Free disk space
         uses: jlumbroso/free-disk-space@main
         with: { tool-cache: true, android: true, dotnet: true, haskell: true, large-packages: false, swap-storage: false }
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           key: hack
-      - uses: taiki-e/install-action@daa3c1f1f9a9d46f686d9fc2f65773d0c293688b # v2
+      - uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
         with:
           tool: cargo-hack
       - run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev
@@ -226,7 +226,7 @@ jobs:
     # block. CHANGELOG is the source of truth until we cut 1.0.
     continue-on-error: true
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: obi1kenobi/cargo-semver-checks-action@7272cc2caa468d3e009a2b0a9cc366839348237b # v2
 
   coverage:
@@ -236,7 +236,7 @@ jobs:
       - name: Free disk space
         uses: jlumbroso/free-disk-space@main
         with: { tool-cache: true, android: true, dotnet: true, haskell: true, large-packages: false, swap-storage: false }
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
           components: llvm-tools-preview
@@ -247,7 +247,7 @@ jobs:
       # share of the engine is exercised only by #[ignore] live-network tests,
       # so a line-% gate would be misleading. Reported + uploaded, not enforced.
       - run: cargo llvm-cov --workspace --lcov --output-path lcov.info -- --test-threads=1
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v7
         with:
           files: ./lcov.info
           fail_ci_if_error: false
@@ -257,7 +257,7 @@ jobs:
     name: Benchmark smoke (compile only)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
       - run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev
@@ -268,7 +268,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           fetch-depth: 0
       - name: Check Signed-off-by on PR commits
@@ -277,7 +277,11 @@ jobs:
           head="${{ github.event.pull_request.head.sha }}"
           missing=0
           while IFS= read -r sha; do
-            git log -1 --pretty=full "$sha" | grep -q "^Signed-off-by:" || {
+            # `--format=%B` emits the RAW commit body. Do not use
+            # `--pretty=full` here: it indents the body by four spaces, so a
+            # `^Signed-off-by:` anchor never matches and the check fails even
+            # on correctly signed-off commits.
+            git log -1 --format=%B "$sha" | grep -q "^Signed-off-by:" || {
               echo "::error::commit $sha missing Signed-off-by trailer"; missing=$((missing+1)); }
           done < <(git log --pretty=format:"%H" "${base}..${head}")
           [ "$missing" -eq 0 ] || exit 1

.github/workflows/codeql.yml

@@ -24,10 +24,10 @@ jobs:
       matrix:
         language: [rust]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
@@ -37,6 +37,6 @@ jobs:
       - name: Build for CodeQL
         run: cargo build --workspace
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/outdated.yml

@@ -14,7 +14,7 @@ jobs:
     name: cargo outdated
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:

.github/workflows/python.yml

@@ -55,7 +55,7 @@ jobs:
       # (Mach-O) and Windows (PE) link the prebuilt V8 fine.
       V8_FROM_SOURCE: ${{ startsWith(matrix.platform.runner, 'ubuntu') && '1' || '' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
@@ -136,7 +136,7 @@ jobs:
         run: |
           python -m pip install --upgrade twine
           python -m twine check dist/*.whl
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-${{ matrix.platform.target }}
           path: dist/*.whl
@@ -152,7 +152,7 @@ jobs:
     needs: wheels
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       # Harsh check: on a tag, the tag must equal pyproject.toml's version,
       # else we'd ship a wrong-versioned wheel. Mirrors the crates.io gate.
       - name: Validate tag matches pyproject version

.github/workflows/release-crates.yml

@@ -36,7 +36,7 @@ jobs:
     outputs:
       version: ${{ steps.ver.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # need full history + branches for the on-main check
       - name: Install skia system deps (freetype + fontconfig)
@@ -103,7 +103,7 @@ jobs:
       name: crates-io
       url: https://crates.io/crates/browser_oxide
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install skia system deps (freetype + fontconfig)
         run: sudo apt-get update && sudo apt-get install -y libfontconfig1-dev libfreetype6-dev
       - uses: dtolnay/rust-toolchain@stable

.github/workflows/release-mcp.yml

@@ -25,7 +25,7 @@ jobs:
           - { runner: macos-latest,   target: x86_64-apple-darwin }
           - { runner: windows-latest, target: x86_64-pc-windows-msvc }
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -42,7 +42,7 @@ jobs:
           [ "${{ runner.os }}" = "Windows" ] && bin="$bin.exe"
           tar -czf "browser-oxide-mcp-${{ matrix.target }}.tar.gz" \
             -C "target/${{ matrix.target }}/release" "$bin"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: mcp-${{ matrix.target }}
           path: browser-oxide-mcp-${{ matrix.target }}.tar.gz
@@ -57,7 +57,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/download-artifact@v4
         with:
           path: dist

.github/workflows/scorecard.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           persist-credentials: false
       - name: Run Scorecard
@@ -28,11 +28,11 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: scorecard-results
           path: results.sarif
           retention-days: 5
-      - uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+      - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
         with:
           sarif_file: results.sarif