Repository navigation
Conversation
Rolls up Dependabot intersystems-community#159, intersystems-community#160, intersystems-community#173, intersystems-community#178 and intersystems-community#179. - ctor 1 refuses a constructor without the unsafe acknowledgement, so every #[ctor::ctor] is now #[ctor::ctor(unsafe)]. They are the test-isolation hooks; what they run is unchanged. - aes-gcm 0.11 deprecates from_slice. The safeStorage decrypt converts the key and nonce with TryFrom; both lengths are checked first, and a failed conversion is an error, not a panic. The test helper that seals fixtures uses From on its fixed-size arrays. - windows 0.62 passes optional arguments as Option: GetUserNameW and LocalFree take Some(..). CryptUnprotectData is unchanged. - rusqlite 0.41 and dirs 7 build without code changes. - The payload test's fixture value is renamed so the staged-file secret scan does not read it as a credential; the test is unchanged. The Windows paths compile only on the Windows runner; windows-handshake and its DPAPI round-trip step cover them.
Rolls up the vsce half of Dependabot intersystems-community#177 and intersystems-community#168. qs 6.17.1 clears its moderate advisory; minimatch stays at 10.2.6, behind vsce, until vsce takes 11. Not taken: @types/vscode 1.144 (intersystems-community#177), @types/node 26 (intersystems-community#156) and which 7 (intersystems-community#155). The extension supports VS Code 1.99, which runs on Node 20: newer typings would let code use APIs that release lacks, and which 7 needs Node 22.22. They move with engines.vscode.
Dependabot intersystems-community#157: setup-qemu 4.4.0, setup-buildx 4.4.1, login 4.7.0, metadata 6.2.0, build-push 7.4.0. Each pin is the commit its tag points to. All five run on node24 and still take every input this workflow passes and give the outputs it reads (tags, labels, digest). The image job runs only on a release tag, so the next release is its first run.
@types/vscode, @types/node from 21 and which from 7 are ignored for the extension: they follow engines.vscode, which moves by hand. Every ecosystem now has a 7-day cooldown, so a version update is proposed only after a release has been public for a week; security updates are not delayed. zizmor's dependabot-cooldown check had six findings here.
isc-tdyar
approved these changes
Nov 4, 2026
isc-tdyar
left a comment
isc-tdyar
left a comment
Contributor
There was a problem hiding this comment.
Approved. Required checks green; CodeQL alerts #278/#279 already exist on master (test fixture), not introduced here.
isc-tdyar
merged commit Nov 4, 2026
71fd59f
into
intersystems-community:master
21 of 22 checks passed
isc-tdyar
pushed a commit
that referenced
this pull request
Nov 5, 2026
CodeQL flags the fixed test key and nonce as hard-coded cryptographic values. Since the Dependabot roll-up (#180) the test helper builds keys with From instead of from_slice, and CodeQL follows those into the cipher. Every test seals and opens with the same key, so the value never mattered: the key and nonce now come from the OS once per run, and the wrong-key test draws its own and asserts it differs. getrandom 0.4 is a dev-dependency here; it was already in Cargo.lock through uuid.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolls up the open Dependabot PRs that are safe to take, adapts the code to their API changes, and stops Dependabot proposing the three that aren't.
Rust (#159, #160, #173, #178, #179)
#[ctor::ctor(unsafe)]. Every site is a test-isolation hook, and what each one runs is unchanged.from_slice. The safeStorage decrypt now converts the key and nonce withTryFrom. Both lengths are already checked, and a failed conversion returns an error, not a panic.Option, soGetUserNameWandLocalFreenow takeSome(..). I checked the 0.62 signatures;CryptUnprotectDatais unchanged.windows-handshakeand its DPAPI round-trip step are the check for them.Extension (#177 in part, #168)
minimatch10.2.6 stays behind vsce until vsce takes 11.Release workflow (#157)
tags,labels,digest.Not taken; Dependabot now ignores them
@types/vscode1.144 (chore(deps-dev): bump the extension-minor group across 1 directory with 2 updates #177),@types/node26 (chore(deps-dev): bump @types/node from 20.19.43 to 26.6.6 in /vscode-iris-agentic-dev #156) andwhich7 (chore(deps): bump which from 6.0.1 to 7.0.0 in /vscode-iris-agentic-dev #155).engines.vscode ^1.99.0), which runs on Node 20.which7 needs Node ≥ 22.22.engines.vscode, by hand.Dependabot cooldown
dependabot-cooldownfindings zizmor reports fordependabot.ymlon master. CI's zizmor job only lints.github/workflows, so they never showed up there.Checks run locally (macOS)
-D warnings, with and withouttesting, and fmt are clean.cargo denyis clean..github.Supersedes #155, #156, #157, #159, #160, #168, #173, #177, #178 and #179. Close #155 and #156 as declined.