diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 58b14d22..0f8a30f9 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -14,7 +14,7 @@ workflows: - 'actions/setup-node@v7.0.0' - 'actions/upload-artifact@v7.0.1' - 'dtolnay/rust-toolchain@v1' - - 'taiki-e/install-action@v2.87.18' + - 'taiki-e/install-action@v2.87.22' '.github/workflows/ci-health-sweep.yml': - 'actions/checkout@v7.0.1' '.github/workflows/ci.yml': @@ -24,15 +24,14 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'haskell-actions/hlint-run@v2.4.10' - 'haskell-actions/hlint-setup@v2.4.10' - - 'haskell-actions/setup@v2.12.0' + - 'haskell-actions/setup@v2.12.1' - 'swatinem/rust-cache@v2.9.2' - - 'taiki-e/install-action@v2.87.18' + - 'taiki-e/install-action@v2.87.22' '.github/workflows/clusterfuzzlite.yml': - 'actions/checkout@v7.0.1' - 'google/clusterfuzzlite@v1' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' '.github/workflows/dependabot-automerge.yml': - 'dependabot/fetch-metadata@v3.1.0' '.github/workflows/dogfood-gate.yml': @@ -71,7 +70,7 @@ workflows: - 'actions/upload-pages-artifact@v5.0.0' - 'dtolnay/rust-toolchain@v1' - 'editorconfig-checker/action-editorconfig-checker@v3.0.0' - - 'ruby/setup-ruby@v1.324.0' + - 'ruby/setup-ruby@v1.327.0' '.github/workflows/release.yml': - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' @@ -99,10 +98,9 @@ workflows: - 'actions/upload-artifact@v7.0.1' - 'aquasecurity/trivy-action@v0.36.0' - 'dtolnay/rust-toolchain@v1' - - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' - 'gitleaks/gitleaks-action@v3.0.0' - - 'taiki-e/install-action@v2.87.18' - - 'trufflesecurity/trufflehog@v3.97.6' + - 'taiki-e/install-action@v2.87.22' + - 'trufflesecurity/trufflehog@v3.97.9' '.github/workflows/tests.yml': - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' @@ -113,7 +111,7 @@ workflows: - 'dtolnay/rust-toolchain@v1' - 'erlef/setup-beam@v1.24.1' - 'swatinem/rust-cache@v2.9.2' - - 'taiki-e/install-action@v2.87.18' + - 'taiki-e/install-action@v2.87.22' '.github/workflows/verify-proofs.yml': - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' @@ -263,11 +261,6 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': - ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63' - commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' - owner_id: 9919 - repo_id: 259445878 'gitleaks/gitleaks-action@v3.0.0': ref: 'v3.0.0' commit: 'sha1-e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e' @@ -288,9 +281,9 @@ dependencies: commit: 'sha1-fe9cd1cd1af94a23900c06738e73f6ddb092966a' owner_id: 75048950 repo_id: 692590623 - 'haskell-actions/setup@v2.12.0': - ref: 'v2.12.0' - commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d' + 'haskell-actions/setup@v2.12.1': + ref: 'v2.12.1' + commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d' owner_id: 75048950 repo_id: 623796603 'hyperpolymath/deed-ecosystem@main': @@ -308,9 +301,9 @@ dependencies: commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be' owner_id: 6759885 repo_id: 1352485172 - 'ruby/setup-ruby@v1.324.0': - ref: 'v1.324.0' - commit: 'sha1-a0102e0972be65f351c307e2d64b9314a57c8073' + 'ruby/setup-ruby@v1.327.0': + ref: 'v1.327.0' + commit: 'sha1-14594264cd68ce8a2345dd349bc3d138a4ef85c8' owner_id: 210414 repo_id: 231208785 'softprops/action-gh-release@v3.0.3': @@ -323,13 +316,13 @@ dependencies: commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6' owner_id: 580492 repo_id: 298565987 - 'taiki-e/install-action@v2.87.18': - ref: 'v2.87.18' - commit: 'sha1-dfae9bf3d6f6c6f20ef4ebb3486c01a51341ff12' + 'taiki-e/install-action@v2.87.22': + ref: 'v2.87.22' + commit: 'sha1-83ac0ad63c0167e6f06796fab0fce28db1bf3db0' owner_id: 43724913 repo_id: 442947557 - 'trufflesecurity/trufflehog@v3.97.6': - ref: 'v3.97.6' - commit: 'sha1-64d939a56362f519781c53ea09b27f8d1dc0140a' + 'trufflesecurity/trufflehog@v3.97.9': + ref: 'v3.97.9' + commit: 'sha1-4dd8831c5f12599465d4d45c3c447b4018a34c85' owner_id: 79229934 repo_id: 77726177 diff --git a/Cargo.lock b/Cargo.lock index f06f4a03..9d44e46d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -217,9 +217,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53" [[package]] name = "aws-lc-rs" -version = "1.17.0" +version = "1.18.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00" +checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e" dependencies = [ "aws-lc-sys", "zeroize", @@ -227,14 +227,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.41.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -3212,9 +3213,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.40" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "aws-lc-rs", "once_cell", @@ -3276,9 +3277,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "aws-lc-rs", "ring", diff --git a/cli/src/app_state.rs b/cli/src/app_state.rs index c9d6dbf4..0b1c5712 100644 --- a/cli/src/app_state.rs +++ b/cli/src/app_state.rs @@ -55,7 +55,7 @@ impl RateLimitSlot { } let prev = self .remaining - .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |r| { + .try_update(Ordering::Relaxed, Ordering::Relaxed, |r| { if r > 0 { Some(r - 1) } else { diff --git a/lib/hypatia/scanner_suppression.ex b/lib/hypatia/scanner_suppression.ex index 8e09c2b5..0adb5740 100644 --- a/lib/hypatia/scanner_suppression.ex +++ b/lib/hypatia/scanner_suppression.ex @@ -356,11 +356,12 @@ defmodule Hypatia.ScannerSuppression do def comment_masked_secret_label?(_label, _line, _line_number), do: false - # Proof-assistant sources name lemmas and facts with `name: "prop"` - # (Isabelle `lemma inj_secret: "…"`, `assumes pw_ok: "…"`), which is exactly - # the `secret: "…"` form. Only that declaration shape is dropped, and only - # for the three form-ambiguous labels: a plain assignment such as - # `password = "…"` in a proof source still fires, as do the + # Proof-assistant sources name lemmas and facts with `name:` followed by a + # quoted proposition (Isabelle `lemma inj_secret:`, `assumes pw_ok:`, each + # then a double-quoted prop), which is exactly the shape of a `secret:` + # string assignment. Only that declaration shape is dropped, and only + # for the three form-ambiguous labels: a plain `password =` string + # assignment in a proof source still fires, as do the # structurally-unforgeable shapes (`ghp_…`, `AKIA…`, PEM blocks). # absolute-zero OND.thy:62. @proof_source_exts ~w(.thy .v .agda .lagda .lean .idr .lidr) diff --git a/scripts/ci-tools/Cargo.lock b/scripts/ci-tools/Cargo.lock index 68019f3e..21d00bf2 100644 --- a/scripts/ci-tools/Cargo.lock +++ b/scripts/ci-tools/Cargo.lock @@ -1011,9 +1011,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.40" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "once_cell", "ring", @@ -1073,9 +1073,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types",