fix(security): resolve Dependabot, Scorecard and CodeQL alerts

.github/codeql/extensions/rust-models/codeql-pack.yml

@@ -0,0 +1,9 @@
+# Repository-local CodeQL model pack. Code scanning picks up any pack under
+# .github/codeql/extensions automatically, in default and advanced setup.
+name: dekobon/big-code-analysis-rust-models
+version: 0.0.1
+library: true
+extensionTargets:
+  codeql/rust-all: "*"
+dataExtensions:
+  - models/**/*.yml

.github/codeql/extensions/rust-models/models/vcs.model.yml

@@ -0,0 +1,17 @@
+# CodeQL's Rust taint tracking is field-insensitive on a struct: writing a
+# tainted value into one field taints the whole value, and reading any field
+# of a tainted value is tainted. Options carries both the parsed window
+# lengths (integer constants, which rust/hard-coded-cryptographic-value treats
+# as sources) and the HMAC author_hash_key, so every window constant was
+# reported as a hard-coded HMAC key (alerts #799-#803).
+#
+# Excluding the field removes only that read shortcut. A store into
+# author_hash_key followed by a read of it is ordinary field-sensitive value
+# flow, so a literal really stored there should still be reported (reasoned
+# from the taint-step definitions, not probed).
+extensions:
+  - addsTo:
+      pack: codeql/rust-all
+      extensible: excludeFieldTaintStep
+    data:
+      - ["big_code_analysis::vcs::options::Options::author_hash_key"]

CHANGELOG.md

@@ -1360,6 +1360,14 @@ for historical reference.
   complete a handshake. `rustls` is a dev-only transitive dependency
   here (`jsonschema` → `reqwest`), reached by no shipped code path;
   the bump keeps the `cargo-deny` advisories gate green.
+- Cleared RUSTSEC-2026-0306 by moving `faster-hex` `0.10.0` → `0.10.1`
+  in the workspace lockfile. On x86 / x86_64 with AVX2, the safe
+  `faster_hex::hex_decode_unchecked` could read past the end of a short
+  `src` buffer. `faster-hex` ships in `bca` through `gix-hash`, which
+  calls only the length-checked `hex_decode` / `hex_encode`, so no
+  shipped code path reached the unsound function. `cargo-deny` missed
+  the advisory because its default `unsound` scope covers direct
+  dependencies only; `deny.toml` now sets `unsound = "all"`.
 
 ## [2.2.0] - 2026-08-29
 

big-code-analysis-py/requirements/examples.txt

@@ -551,9 +551,9 @@ jupyter-lsp==2.3.1 ; python_full_version < '3.15' and sys_platform != 'emscripte
     --hash=sha256:71b954d834e85ff3096400554f2eefaf7fe37053036f9a782b0f7c5e42dadb81 \
     --hash=sha256:fdf8a4aa7d85813976d6e29e95e6a2c8f752701f926f2715305249a3829805a6
     # via jupyterlab
-jupyter-server==2.20.0 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
-    --hash=sha256:b5778ba337d8015a3dc2b80803ecdd5ac18d3797fddf61a50ea5fb472b4ebe14 \
-    --hash=sha256:c3b67c93c471e947c18b5026f04f21614218adb706df8f48227d3ee8e0a7cdcc
+jupyter-server==2.21.1 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
+    --hash=sha256:2a6467606af7dbae2e7e31640030025969e15db6a649eae334af90415dc71dca \
+    --hash=sha256:a8960aa29263f6041283e97d4756b099fb49b767baab6371891ecb1bd40a63df
     # via
     #   jupyter-lsp
     #   jupyterlab
@@ -564,9 +564,9 @@ jupyter-server-terminals==0.5.4 ; python_full_version < '3.15' and sys_platform
     --hash=sha256:55be353fc74a80bc7f3b20e6be50a55a61cd525626f578dcb66a5708e2007d14 \
     --hash=sha256:bbda128ed41d0be9020349f9f1f2a4ab9952a73ed5f5ac9f1419794761fb87f5
     # via jupyter-server
-jupyterlab==4.6.3 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
-    --hash=sha256:0a1ebc6567186f1eabd99536e94df7ed9e96d1e7c5ddf3e4406ae16e88abacb7 \
-    --hash=sha256:2e3db6e3a12495ebd188276e985bf5ac502fbde3d1e8628819920210008de498
+jupyterlab==4.6.4 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
+    --hash=sha256:15b13f991d3985129c797eb84d9949eeb8b6615e14b444868e642411f2c418b2 \
+    --hash=sha256:404f49b081819378524886c9db66dba57a5565981eff885830df1baba3a17df5
     # via
     #   jupyter
     #   notebook
@@ -815,9 +815,9 @@ nest-asyncio2==1.7.2 ; python_full_version < '3.15' and sys_platform != 'emscrip
     --hash=sha256:1921d70b92cc4612c374928d081552efb59b83d91b2b789d935c665fa01729a8 \
     --hash=sha256:f5dfa702f3f81f6a03857e9a19e2ba578c0946a4ad417b4c50a24d7ba641fe01
     # via ipykernel
-notebook==7.6.2 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
-    --hash=sha256:5fe9e09c335cb4b7de21627b860f77210e70e54b1fb1276ad942a4a7e1d858d3 \
-    --hash=sha256:cc02b5f0bb972160cccfe44ad8a1a202036206ba3439469c514f03aefa9ae807
+notebook==7.6.3 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
+    --hash=sha256:ad7e0eb765fba836cd4a2ab0c7a3a26cde1d91665fbf6f533b6ae7b2de6d88d2 \
+    --hash=sha256:e2c08e469c0ae20bb0b3214f0ab77e79653317a2f8e5b34c10361c66874a5b50
     # via jupyter
 notebook-shim==0.2.4 ; python_full_version < '3.15' and sys_platform != 'emscripten' \
     --hash=sha256:411a5be4e9dc882a074ccbcae671eda64cceb068767e9a3419096986560e1cef \

deny.toml

@@ -11,6 +11,11 @@ all-features = true
 version = 2
 yanked = "deny"
 ignore = []
+# The default scope ("workspace") reports an unsound advisory only for a
+# direct dependency, so RUSTSEC-2026-0306 in `faster-hex` (reached through
+# gix-hash) passed this gate for weeks and surfaced only via the Scorecard
+# Vulnerabilities check. Unsound code anywhere in the graph ships in `bca`.
+unsound = "all"
 
 [licenses]
 version = 2

src/vcs/options.rs

@@ -231,6 +231,10 @@ pub struct Options {
     /// itself), so it never enters the persistent-cache fingerprint: the
     /// same cached walk re-finalizes under any key without a re-walk (see
     /// [`AuthorId::emit_hashed`](super::identity::AuthorId::emit_hashed)).
+    //
+    // Named by path in .github/codeql/extensions/rust-models: a rename or
+    // move must update that model, or CodeQL again reports every window
+    // constant as a hard-coded HMAC key (alerts #799-#803).
     pub author_hash_key: Option<AuthorHashKey>,
     /// Emit stats for files deleted at the target ref (default: off).
     pub include_deleted: bool,