From e49e8bd502c31133336a250cd685317880c2a622 Mon Sep 17 00:00:00 2001 From: Renn F Date: Sun, 25 Oct 2026 18:07:34 +0100 Subject: [PATCH 1/3] chore(deps): bump workflow actions together Workflow refs: init v4.39.0->v4.39.1,autobuild v4.39.0->v4.39.1,install-action v2.87.29->v2.87.30. All references of each multi-step action move in one commit so workflows such as CodeQL run against a single action version; single-step Dependabot PRs leave the steps of one workflow on different versions and fail their own CI. I also grouped github-actions updates in .github/dependabot.yml so future action bumps arrive as one weekly PR instead of one PR per workflow step. --- .github/dependabot.yml | 4 ++++ .github/workflows/ci.yml | 2 +- .github/workflows/code-ql.yml | 4 ++-- Cargo.lock | 4 ++-- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index da734d7..d3032d9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,3 +7,7 @@ updates: day: "monday" time: "02:00" timezone: "UTC" + groups: + actions: + patterns: + - "*" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5a7acd2..b043fa0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -126,7 +126,7 @@ jobs: cache-shared-key: ci-coverage - name: Install cargo-llvm-cov - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29 + uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30 with: tool: cargo-llvm-cov diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index 4fd5d0a..7f9fbc1 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -29,12 +29,12 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: rust,actions - name: Autobuild - uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 diff --git a/Cargo.lock b/Cargo.lock index bcb6645..8a54820 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -429,9 +429,9 @@ dependencies = [ [[package]] name = "ctutils" -version = "0.4.2" +version = "0.4.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e" +checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0" dependencies = [ "cmov", ] From 9e5aeea26571f7b86744fb34a104960e0bf98ece Mon Sep 17 00:00:00 2001 From: Renn F Date: Sun, 25 Oct 2026 18:46:50 +0100 Subject: [PATCH 2/3] fix(deps): bump tokio past RUSTSEC-2026-0386 tokio 1.53.x before 1.53.3 has AsyncFd constructors that violate I/O safety (RUSTSEC-2026-0386); the lockfile now tracks 1.54.1. cargo-deny treats the unsound advisory as an error, so every fresh CI run fails without this. --- Cargo.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 8a54820..69ac44c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -550,7 +550,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1555,7 +1555,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1725,7 +1725,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1784,7 +1784,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2049,7 +2049,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2090,9 +2090,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee" [[package]] name = "tokio" -version = "1.53.2" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -2446,7 +2446,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] From f5efb35da77a0cc981dcd3ab5c7df62a0bbecb44 Mon Sep 17 00:00:00 2001 From: Renn F Date: Sun, 25 Oct 2026 19:12:18 +0100 Subject: [PATCH 3/3] fix(ci): align codeql analyze with the init and autobuild bump Dependabot had not opened the analyze step PR yet, so the consolidation left analyze on 4.39.0 while init and autobuild moved to 4.39.1, which fails CodeQL with the version-mismatch error in the opposite direction. --- .github/workflows/code-ql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index 7f9fbc1..dcda3eb 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -37,7 +37,7 @@ jobs: uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: # The category of the earlier `analyze` job, so the existing analyses and alerts carry over. category: .github/workflows/code-ql.yml:analyze