From 03540acd15ab4bf7f5d146c3c9d0cb2e22789007 Mon Sep 17 00:00:00 2001 From: Elijah Zupancic <490392+dekobon@users.noreply.github.com> Date: Wed, 7 Oct 2026 09:54:49 -0700 Subject: [PATCH 1/8] chore(deps): bump jupyterlab 4.6.4, notebook 7.6.3 Resolves Dependabot alerts #57-#60 and #66-#69 (GHSA-6966-vjj6-99xv, GHSA-3325-v43h-43rv, GHSA-3jqq-pw4j-pqcj). Both are transitive through the examples extra's jupyter>=1.0; only the lock and its examples.txt export move. --- big-code-analysis-py/requirements/examples.txt | 12 ++++++------ big-code-analysis-py/uv.lock | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/big-code-analysis-py/requirements/examples.txt b/big-code-analysis-py/requirements/examples.txt index b5829ca1..44906b2a 100644 --- a/big-code-analysis-py/requirements/examples.txt +++ b/big-code-analysis-py/requirements/examples.txt @@ -564,9 +564,9 @@ jupyter-server-terminals==0.5.4 ; python_full_version < '3.15' and sys_platform --hash=sha256:55be353fc74a80bc7f3b20e6be50a55a61cd525626f578dcb66a5708e2007d14 \ --hash=sha256:bbda128ed41d0be9020349f9f1f2a4ab9952a73ed5f5ac9f1419794761fb87f5 # via jupyter-server -jupyterlab==4.6.3 ; python_full_version < '3.15' and sys_platform != 'emscripten' \ - --hash=sha256:0a1ebc6567186f1eabd99536e94df7ed9e96d1e7c5ddf3e4406ae16e88abacb7 \ - --hash=sha256:2e3db6e3a12495ebd188276e985bf5ac502fbde3d1e8628819920210008de498 +jupyterlab==4.6.4 ; python_full_version < '3.15' and sys_platform != 'emscripten' \ + --hash=sha256:15b13f991d3985129c797eb84d9949eeb8b6615e14b444868e642411f2c418b2 \ + --hash=sha256:404f49b081819378524886c9db66dba57a5565981eff885830df1baba3a17df5 # via # jupyter # notebook @@ -815,9 +815,9 @@ nest-asyncio2==1.7.2 ; python_full_version < '3.15' and sys_platform != 'emscrip --hash=sha256:1921d70b92cc4612c374928d081552efb59b83d91b2b789d935c665fa01729a8 \ --hash=sha256:f5dfa702f3f81f6a03857e9a19e2ba578c0946a4ad417b4c50a24d7ba641fe01 # via ipykernel -notebook==7.6.2 ; python_full_version < '3.15' and sys_platform != 'emscripten' \ - --hash=sha256:5fe9e09c335cb4b7de21627b860f77210e70e54b1fb1276ad942a4a7e1d858d3 \ - --hash=sha256:cc02b5f0bb972160cccfe44ad8a1a202036206ba3439469c514f03aefa9ae807 +notebook==7.6.3 ; python_full_version < '3.15' and sys_platform != 'emscripten' \ + --hash=sha256:ad7e0eb765fba836cd4a2ab0c7a3a26cde1d91665fbf6f533b6ae7b2de6d88d2 \ + --hash=sha256:e2c08e469c0ae20bb0b3214f0ab77e79653317a2f8e5b34c10361c66874a5b50 # via jupyter notebook-shim==0.2.4 ; python_full_version < '3.15' and sys_platform != 'emscripten' \ --hash=sha256:411a5be4e9dc882a074ccbcae671eda64cceb068767e9a3419096986560e1cef \ diff --git a/big-code-analysis-py/uv.lock b/big-code-analysis-py/uv.lock index c0b735ed..343de0ce 100644 --- a/big-code-analysis-py/uv.lock +++ b/big-code-analysis-py/uv.lock @@ -1157,7 +1157,7 @@ wheels = [ [[package]] name = "jupyterlab" -version = "4.6.3" +version = "4.6.4" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "async-lru" }, @@ -1174,9 +1174,9 @@ dependencies = [ { name = "tornado" }, { name = "traitlets" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/00/c0/45934229995d4c6e38192ca118d93185f60808f64157e3df3c5c28f8c5fd/jupyterlab-4.6.3.tar.gz", hash = "sha256:2e3db6e3a12495ebd188276e985bf5ac502fbde3d1e8628819920210008de498", size = 28319771, upload-time = "2026-08-10T18:50:57.947Z" } +sdist = { url = "https://files.pythonhosted.org/packages/33/8d/995cc142f6083346b35e7d3eadc5a6717ee89ce64ea53577010ac493bc3c/jupyterlab-4.6.4.tar.gz", hash = "sha256:404f49b081819378524886c9db66dba57a5565981eff885830df1baba3a17df5", size = 28335647, upload-time = "2026-09-21T15:25:18.779Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/e9/47/242f46de028074651c9bd6d8000fc340ed0d3cdd1a0eae4387826123413a/jupyterlab-4.6.3-py3-none-any.whl", hash = "sha256:0a1ebc6567186f1eabd99536e94df7ed9e96d1e7c5ddf3e4406ae16e88abacb7", size = 17168312, upload-time = "2026-08-10T18:50:53.044Z" }, + { url = "https://files.pythonhosted.org/packages/3b/e4/072bc0d3c6d45d414062a06af7ee81c02a2c12d769c358ec9919f9995ffd/jupyterlab-4.6.4-py3-none-any.whl", hash = "sha256:15b13f991d3985129c797eb84d9949eeb8b6615e14b444868e642411f2c418b2", size = 17171596, upload-time = "2026-09-21T15:25:14.123Z" }, ] [[package]] @@ -1708,7 +1708,7 @@ wheels = [ [[package]] name = "notebook" -version = "7.6.2" +version = "7.6.3" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "jupyter-builder" }, @@ -1718,9 +1718,9 @@ dependencies = [ { name = "notebook-shim" }, { name = "tornado" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/31/d9/5c76de84e96e1cf8aae3fce930875e0615e14f3557bbcdb634aab52da9d3/notebook-7.6.2.tar.gz", hash = "sha256:cc02b5f0bb972160cccfe44ad8a1a202036206ba3439469c514f03aefa9ae807", size = 5500147, upload-time = "2026-08-11T13:21:16.632Z" } +sdist = { url = "https://files.pythonhosted.org/packages/42/ac/aedb759dc683dcd129f6c75271bab5eb23020b0f7969163c726343718e1e/notebook-7.6.3.tar.gz", hash = "sha256:e2c08e469c0ae20bb0b3214f0ab77e79653317a2f8e5b34c10361c66874a5b50", size = 5501618, upload-time = "2026-09-21T18:07:24.261Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/5c/fd/3e552ff5b24dd305c6e9a10e8645e29c03091c317429f326ae10dbae1ac6/notebook-7.6.2-py3-none-any.whl", hash = "sha256:5fe9e09c335cb4b7de21627b860f77210e70e54b1fb1276ad942a4a7e1d858d3", size = 5547102, upload-time = "2026-08-11T13:21:13.302Z" }, + { url = "https://files.pythonhosted.org/packages/a1/f7/907b98438cf00bdc4e296570058f29a347214bb42338a48e3b7eae58ae2a/notebook-7.6.3-py3-none-any.whl", hash = "sha256:ad7e0eb765fba836cd4a2ab0c7a3a26cde1d91665fbf6f533b6ae7b2de6d88d2", size = 5548452, upload-time = "2026-09-21T18:07:21.563Z" }, ] [[package]] From 1ef3e6ef4a1232081eb3f8e9dcc911661dc9aa28 Mon Sep 17 00:00:00 2001 From: Elijah Zupancic <490392+dekobon@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:04:30 -0700 Subject: [PATCH 2/8] chore(deps): bump faster-hex to 0.10.1 Fixes RUSTSEC-2026-0306 (unsound AVX2 hex_decode_unchecked read past src), reached through gix-hash. Reported by the Scorecard Vulnerabilities check (alert #776); Dependabot did not flag it. The new defmt 0.3 lock entry is an optional feature nothing enables. --- Cargo.lock | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 64c10c77..ff72795e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1065,6 +1065,15 @@ version = "2.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06" +[[package]] +name = "defmt" +version = "0.3.100" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0963443817029b2024136fc4dd07a5107eb8f977eaf18fcd1fdeb11306b64ad" +dependencies = [ + "defmt 1.1.1", +] + [[package]] name = "defmt" version = "1.1.1" @@ -1245,10 +1254,12 @@ dependencies = [ [[package]] name = "faster-hex" -version = "0.10.0" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7223ae2d2f179b803433d9c830478527e92b8117eab39460edae7f1614d9fb73" +checksum = "04839bdf9d8c10f66806fad16b852fc72aab80873aebc3cb69d85b4fa41543ed" dependencies = [ + "autocfg", + "defmt 0.3.100", "heapless", "serde", ] @@ -2709,7 +2720,7 @@ version = "0.2.35" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc" dependencies = [ - "defmt", + "defmt 1.1.1", "jiff-core", "jiff-static", "jiff-tzdb-platform", @@ -2726,7 +2737,7 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09" dependencies = [ - "defmt", + "defmt 1.1.1", ] [[package]] From e0a303f0c57cecc1bf49ee37adf92764e252360e Mon Sep 17 00:00:00 2001 From: Elijah Zupancic <490392+dekobon@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:04:30 -0700 Subject: [PATCH 3/8] chore(deps): bump jupyter-server to 2.21.1 Fixes PYSEC-2026-4054 / GHSA-c3mw-737p-c7g2 (5xx request logging leaks token-bearing Referer values). Transitive via the examples extra; reported only by the Scorecard Vulnerabilities check (alert #776). --- big-code-analysis-py/requirements/examples.txt | 6 +++--- big-code-analysis-py/uv.lock | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/big-code-analysis-py/requirements/examples.txt b/big-code-analysis-py/requirements/examples.txt index 44906b2a..b3e0cc74 100644 --- a/big-code-analysis-py/requirements/examples.txt +++ b/big-code-analysis-py/requirements/examples.txt @@ -551,9 +551,9 @@ jupyter-lsp==2.3.1 ; python_full_version < '3.15' and sys_platform != 'emscripte --hash=sha256:71b954d834e85ff3096400554f2eefaf7fe37053036f9a782b0f7c5e42dadb81 \ --hash=sha256:fdf8a4aa7d85813976d6e29e95e6a2c8f752701f926f2715305249a3829805a6 # via jupyterlab -jupyter-server==2.20.0 ; python_full_version < '3.15' and sys_platform != 'emscripten' \ - --hash=sha256:b5778ba337d8015a3dc2b80803ecdd5ac18d3797fddf61a50ea5fb472b4ebe14 \ - --hash=sha256:c3b67c93c471e947c18b5026f04f21614218adb706df8f48227d3ee8e0a7cdcc +jupyter-server==2.21.1 ; python_full_version < '3.15' and sys_platform != 'emscripten' \ + --hash=sha256:2a6467606af7dbae2e7e31640030025969e15db6a649eae334af90415dc71dca \ + --hash=sha256:a8960aa29263f6041283e97d4756b099fb49b767baab6371891ecb1bd40a63df # via # jupyter-lsp # jupyterlab diff --git a/big-code-analysis-py/uv.lock b/big-code-analysis-py/uv.lock index 343de0ce..6d9f54cd 100644 --- a/big-code-analysis-py/uv.lock +++ b/big-code-analysis-py/uv.lock @@ -1115,7 +1115,7 @@ wheels = [ [[package]] name = "jupyter-server" -version = "2.20.0" +version = "2.21.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anyio" }, @@ -1137,9 +1137,9 @@ dependencies = [ { name = "traitlets" }, { name = "websocket-client" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/6b/dc/db3a582633170186f8c8b31298d7eb26ad0eb031a1f53476c258b64eed05/jupyter_server-2.20.0.tar.gz", hash = "sha256:b5778ba337d8015a3dc2b80803ecdd5ac18d3797fddf61a50ea5fb472b4ebe14", size = 756523, upload-time = "2026-06-17T12:09:09.435Z" } +sdist = { url = "https://files.pythonhosted.org/packages/65/3d/3c9f8bce5d5448107bd285cd80185e76c9c871d076b580dfd90997e52904/jupyter_server-2.21.1.tar.gz", hash = "sha256:a8960aa29263f6041283e97d4756b099fb49b767baab6371891ecb1bd40a63df", size = 761651, upload-time = "2026-09-15T16:00:07.853Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/f3/71/8c002223e873a870f5c41dc69b0a7c922301123e4a31d5d01ecb700aef77/jupyter_server-2.20.0-py3-none-any.whl", hash = "sha256:c3b67c93c471e947c18b5026f04f21614218adb706df8f48227d3ee8e0a7cdcc", size = 393143, upload-time = "2026-06-17T12:09:07.234Z" }, + { url = "https://files.pythonhosted.org/packages/1d/39/91bc08650cc8e3efeb7a83c25e20ebddcc9b70d28b4eb6f51a4fb55da7a4/jupyter_server-2.21.1-py3-none-any.whl", hash = "sha256:2a6467606af7dbae2e7e31640030025969e15db6a649eae334af90415dc71dca", size = 394641, upload-time = "2026-09-15T16:00:05.526Z" }, ] [[package]] From 1d7ae3e40734164b98e6b48568feba74a8b29604 Mon Sep 17 00:00:00 2001 From: Elijah Zupancic <490392+dekobon@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:04:31 -0700 Subject: [PATCH 4/8] docs(vcs): note CodeQL HMAC-key false positive Records why alerts #799-#803 (rust/hard-coded-cryptographic-value) were dismissed: field-insensitive taint through Options links the window constants to the HMAC key, which only AuthorHashKey::new builds. --- src/vcs/identity.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/vcs/identity.rs b/src/vcs/identity.rs index c9a2d161..34f1a924 100644 --- a/src/vcs/identity.rs +++ b/src/vcs/identity.rs @@ -215,6 +215,13 @@ impl AuthorHashKey { // it per RFC 2104), so it is infallible here; the `expect` // documents that provably-unreachable invariant (AGENTS.md permits // it for such cases). + // + // CodeQL's rust/hard-coded-cryptographic-value flags `self.key` as + // fed by the `SECONDS_PER_*` window constants in `vcs/options.rs` + // (alerts #799-#803). That is field-insensitive taint through + // `Options`: the constants only reach the `*_window_secs` fields, + // and `self.key` is only ever built by `AuthorHashKey::new` from + // caller-supplied bytes. Dismissed as a false positive. let mut mac = Hmac::::new_from_slice(&self.key).expect("HMAC accepts a key of any length"); mac.update(digest_hex.as_bytes()); From 6ce55d4f069dfdb86c506be436d23bc08f525ae3 Mon Sep 17 00:00:00 2001 From: Elijah Zupancic <490392+dekobon@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:09:15 -0700 Subject: [PATCH 5/8] chore(deny): report unsound advisories graph-wide cargo-deny's default unsound scope covers direct dependencies only, so RUSTSEC-2026-0306 in the transitive faster-hex passed the cargo-deny CI job and surfaced only through Scorecard alert #776. Verified: with unsound = "all" the check fails on main's lockfile and passes here. --- deny.toml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/deny.toml b/deny.toml index 97302867..1c66be84 100644 --- a/deny.toml +++ b/deny.toml @@ -11,6 +11,11 @@ all-features = true version = 2 yanked = "deny" ignore = [] +# The default scope ("workspace") reports an unsound advisory only for a +# direct dependency, so RUSTSEC-2026-0306 in `faster-hex` (reached through +# gix-hash) passed this gate for weeks and surfaced only via the Scorecard +# Vulnerabilities check. Unsound code anywhere in the graph ships in `bca`. +unsound = "all" [licenses] version = 2 From f37db5202cbf20f19668169b2295407f24fc7ab5 Mon Sep 17 00:00:00 2001 From: Elijah Zupancic <490392+dekobon@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:18:18 -0700 Subject: [PATCH 6/8] docs(changelog): record faster-hex RUSTSEC bump --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b0762a92..5acb9694 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1360,6 +1360,14 @@ for historical reference. complete a handshake. `rustls` is a dev-only transitive dependency here (`jsonschema` → `reqwest`), reached by no shipped code path; the bump keeps the `cargo-deny` advisories gate green. +- Cleared RUSTSEC-2026-0306 by moving `faster-hex` `0.10.0` → `0.10.1` + in the workspace lockfile. On x86 / x86_64 with AVX2, the safe + `faster_hex::hex_decode_unchecked` could read past the end of a short + `src` buffer. `faster-hex` ships in `bca` through `gix-hash`, which + calls only the length-checked `hex_decode` / `hex_encode`, so no + shipped code path reached the unsound function. `cargo-deny` missed + the advisory because its default `unsound` scope covers direct + dependencies only; `deny.toml` now sets `unsound = "all"`. ## [2.2.0] - 2026-08-29 From 449d9ee54136fa58939a0468a38219819151218e Mon Sep 17 00:00:00 2001 From: Elijah Zupancic <490392+dekobon@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:18:18 -0700 Subject: [PATCH 7/8] docs(vcs): name both CodeQL taint sources Alert #803's source is parse_iso8601's zero accumulator, not a SECONDS_PER_* constant. --- src/vcs/identity.rs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/vcs/identity.rs b/src/vcs/identity.rs index 34f1a924..8cb058db 100644 --- a/src/vcs/identity.rs +++ b/src/vcs/identity.rs @@ -217,9 +217,10 @@ impl AuthorHashKey { // it for such cases). // // CodeQL's rust/hard-coded-cryptographic-value flags `self.key` as - // fed by the `SECONDS_PER_*` window constants in `vcs/options.rs` - // (alerts #799-#803). That is field-insensitive taint through - // `Options`: the constants only reach the `*_window_secs` fields, + // fed by the window-parsing literals in `vcs/options.rs` (the + // `SECONDS_PER_*` constants and `parse_iso8601`'s zero + // accumulator; alerts #799-#803). That is field-insensitive taint + // through `Options`: those values only reach the `*_window_secs` fields, // and `self.key` is only ever built by `AuthorHashKey::new` from // caller-supplied bytes. Dismissed as a false positive. let mut mac = From 95e6e4bf3d311c2db33cb3ef01cfeecfee7270ab Mon Sep 17 00:00:00 2001 From: Elijah Zupancic <490392+dekobon@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:39:33 -0700 Subject: [PATCH 8/8] fix(ci): stop CodeQL tainting the HMAC key field CodeQL's Rust taint tracking is field-insensitive on a struct, so the window constants written into Options tainted Options::author_hash_key and surfaced as rust/hard-coded-cryptographic-value (alerts #799-#803). A repo-local model pack excludes that field from the read taint step; store-then-read flow through the field is still tracked. The rationale moves from the HMAC call to the field the model names, which is where a rename would break it. --- .../extensions/rust-models/codeql-pack.yml | 9 +++++++++ .../extensions/rust-models/models/vcs.model.yml | 17 +++++++++++++++++ src/vcs/identity.rs | 8 -------- src/vcs/options.rs | 4 ++++ 4 files changed, 30 insertions(+), 8 deletions(-) create mode 100644 .github/codeql/extensions/rust-models/codeql-pack.yml create mode 100644 .github/codeql/extensions/rust-models/models/vcs.model.yml diff --git a/.github/codeql/extensions/rust-models/codeql-pack.yml b/.github/codeql/extensions/rust-models/codeql-pack.yml new file mode 100644 index 00000000..fa838cf7 --- /dev/null +++ b/.github/codeql/extensions/rust-models/codeql-pack.yml @@ -0,0 +1,9 @@ +# Repository-local CodeQL model pack. Code scanning picks up any pack under +# .github/codeql/extensions automatically, in default and advanced setup. +name: dekobon/big-code-analysis-rust-models +version: 0.0.1 +library: true +extensionTargets: + codeql/rust-all: "*" +dataExtensions: + - models/**/*.yml diff --git a/.github/codeql/extensions/rust-models/models/vcs.model.yml b/.github/codeql/extensions/rust-models/models/vcs.model.yml new file mode 100644 index 00000000..7755bad9 --- /dev/null +++ b/.github/codeql/extensions/rust-models/models/vcs.model.yml @@ -0,0 +1,17 @@ +# CodeQL's Rust taint tracking is field-insensitive on a struct: writing a +# tainted value into one field taints the whole value, and reading any field +# of a tainted value is tainted. Options carries both the parsed window +# lengths (integer constants, which rust/hard-coded-cryptographic-value treats +# as sources) and the HMAC author_hash_key, so every window constant was +# reported as a hard-coded HMAC key (alerts #799-#803). +# +# Excluding the field removes only that read shortcut. A store into +# author_hash_key followed by a read of it is ordinary field-sensitive value +# flow, so a literal really stored there should still be reported (reasoned +# from the taint-step definitions, not probed). +extensions: + - addsTo: + pack: codeql/rust-all + extensible: excludeFieldTaintStep + data: + - ["big_code_analysis::vcs::options::Options::author_hash_key"] diff --git a/src/vcs/identity.rs b/src/vcs/identity.rs index 8cb058db..c9a2d161 100644 --- a/src/vcs/identity.rs +++ b/src/vcs/identity.rs @@ -215,14 +215,6 @@ impl AuthorHashKey { // it per RFC 2104), so it is infallible here; the `expect` // documents that provably-unreachable invariant (AGENTS.md permits // it for such cases). - // - // CodeQL's rust/hard-coded-cryptographic-value flags `self.key` as - // fed by the window-parsing literals in `vcs/options.rs` (the - // `SECONDS_PER_*` constants and `parse_iso8601`'s zero - // accumulator; alerts #799-#803). That is field-insensitive taint - // through `Options`: those values only reach the `*_window_secs` fields, - // and `self.key` is only ever built by `AuthorHashKey::new` from - // caller-supplied bytes. Dismissed as a false positive. let mut mac = Hmac::::new_from_slice(&self.key).expect("HMAC accepts a key of any length"); mac.update(digest_hex.as_bytes()); diff --git a/src/vcs/options.rs b/src/vcs/options.rs index a7a0cfbb..d2ded164 100644 --- a/src/vcs/options.rs +++ b/src/vcs/options.rs @@ -231,6 +231,10 @@ pub struct Options { /// itself), so it never enters the persistent-cache fingerprint: the /// same cached walk re-finalizes under any key without a re-walk (see /// [`AuthorId::emit_hashed`](super::identity::AuthorId::emit_hashed)). + // + // Named by path in .github/codeql/extensions/rust-models: a rename or + // move must update that model, or CodeQL again reports every window + // constant as a hard-coded HMAC key (alerts #799-#803). pub author_hash_key: Option, /// Emit stats for files deleted at the target ref (default: off). pub include_deleted: bool,