Skip to content

chore(deps): bump the rust-minor-patch group with 3 updates - #10

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/cargo/rust-minor-patch-d19e99ddc9
Mar 24, 2026
Merged

chore(deps): bump the rust-minor-patch group with 3 updates#10
github-actions[bot] merged 1 commit into
mainfrom
dependabot/cargo/rust-minor-patch-d19e99ddc9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the rust-minor-patch group with 3 updates: anchor-lang, solana-account-info and solana-instruction.

Updates anchor-lang from 1.0.0-rc.2 to 1.0.0-rc.4

Changelog

Sourced from anchor-lang's changelog.

[1.0.0-rc.4] - 2026-03-19

Features

  • avm: Added flags and version labels to explicitly handle pre-releases (avm list --pre-release, avm update --pre-release and avm install latest-pre-release). (#4335)
  • avm: Added avm self-update command and passive version check warning for out of date avm (#4338)

Fixes

  • avm: Fixed handling of new Cargo.toml version location. Fixed handling of pre-release version parsing. (#4335)

Breaking

[1.0.0-rc.3] - 2026-03-18

Features

  • lang: Add Migration<'info, From, To> account type for schema migrations between account types (#4060).
  • cli: Added a check_program_id_mismatch in build time to check if the program ID in the source code matches the program ID in the keypair file (#4018). This check will be skipped during anchor test.
  • lang: Add instruction parser to declare_program! (#4118).
  • ts: Export all IDL types from the root. Users can now update dist/cjs/idl imports to import directly from @anchor-lang/core (#3948).
  • lang: Add declare_program! support with just anchor_client and not anchor_lang (#4157).
  • lang: Export Owners from prelude (#4189).
  • cli: Use surfpool by default for anchor test and anchor localnet commands (#4106).
  • lang: Optimize enums with all unit variants and empty arrays with Lazy (#4237).
  • lang: Include init_if_needed accounts in duplicate mutable account checks (#4239).
  • client: Accept FnMut for events closure (#4024).
  • client: Export all types used by the public API (#4211).
  • lang: Make common::close accept references (#4178).
  • cli/idl: Add --allow-localnet option for IDL commands; fix panic when run outside a workspace (#4252).
  • lang: Check owner on account reload (#3837).
  • lang/ts: Upgrade borsh to 1.5.7 (#4012).
  • syn: Relax seeds syntax to allow more flexible PDA seed expressions (#3813).
  • lang: Deprecate AccountInfo usage in Accounts macro with a compile-time warning (#3854).
  • cli: Update anchor init to use the multiple program template by default (#3958).
  • cli: Add hooks section to Anchor.toml for {pre,post}-{build,test,deploy} lifecycle hooks (#3862).
  • lang: Add generic program validation support to Program type allowing Program<'info> for executable-only validation (#3878).
  • cli: Added litesvm test template and made it the default option on anchor init (#4316)
  • cli: Added --install-agent-skills to automatically install Solana agent skills during anchor init (#4307)

Fixes

  • lang: Add missing Lazy bound on generics (#4240).
  • lang: Fix wrong generated error code in declare_program! (#4129).
  • idl: Fix defined types with unsupported fields not producing an error (#4088).
  • lang: Fix using non-instruction composite accounts multiple times with declare_program! (#4113).
  • lang: Fix declare_program! messing up IDL errors generation (#4126).
  • idl: Fix address constraint not resolving constants that have numbers in their identifiers (#4144).
  • lang: Fix constant nested string generation in declare_program! (#4158).
  • idl: Fix local_file method not found for proc_macro2::Span error (#4187).

... (truncated)

Commits

Updates solana-account-info from 3.1.0 to 3.1.1

Release notes

Sourced from solana-account-info's releases.

account-info@v3.1.1

What's new

Commits
  • 3f40809 Publish solana-bn254 v3.1.1
  • 0645dac bn254: Bring msrv back to 1.81 (#360)
  • 41e34c2 Publish solana-bn254 v3.1.0
  • 2bd1bdd Add CreateAccountAllowPrefund system instruction (#352)
  • 589e623 Publish solana-file-download v3.1.0
  • 21bd992 Publish solana-account v3.1.0
  • fe1ddab [bn-254] Change input to a sized array for LE addition, multiplication, and c...
  • 5c389a1 use serde_core where applicable (#335)
  • 1a91efa Deprecate InstructionError::NotEnoughAccountKeys (#312)
  • e4c8ed1 Improve fn download_file for Gtihub REST API (#351)
  • Additional commits viewable in compare view

Updates solana-instruction from 3.2.0 to 3.3.0

Release notes

Sourced from solana-instruction's releases.

instruction@v3.3.0

What's new

frozen-abi@v3.2.2

What's new

Commits
  • 2a751ef Publish solana-account v3.3.0
  • cf84ac9 Deprecate WritableAccount::create (#488)
  • a1cd804 Publish solana-reward-info v4.0.0
  • 77fb9b2 reward-info: change commission to commission_bps (#500)
  • cadd3df keypair: Document panic conditions for from_base58_string (#499)
  • 4a58b8b [bls-signatures] Add public key, signature, and proof of possession affine in...
  • a4b0353 Use sol_get_sysvar instead of sol_get_<NAME>_sysvar, fixed (#458)
  • 42a250f Publish solana-program-log v1.1.0
  • af1642c feat: add no_std support for program-pack crate (#497)
  • efdd728 Publish solana-frozen-abi-macro v3.2.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the rust-minor-patch group with 3 updates
107419c 
Bumps the rust-minor-patch group with 3 updates: [anchor-lang](https://github.com/solana-foundation/anchor), [solana-account-info](https://github.com/anza-xyz/solana-sdk) and [solana-instruction](https://github.com/anza-xyz/solana-sdk).


Updates `anchor-lang` from 1.0.0-rc.2 to 1.0.0-rc.4
- [Release notes](https://github.com/solana-foundation/anchor/releases)
- [Changelog](https://github.com/solana-foundation/anchor/blob/master/CHANGELOG.md)
- [Commits](https://github.com/solana-foundation/anchor/commits/v1.0.0-rc.4)

Updates `solana-account-info` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/anza-xyz/solana-sdk/releases)
- [Commits](https://github.com/anza-xyz/solana-sdk/compare/msg@v3.1.0...bn254@v3.1.1)

Updates `solana-instruction` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/anza-xyz/solana-sdk/releases)
- [Commits](https://github.com/anza-xyz/solana-sdk/compare/bn254@v3.2.0...account@v3.3.0)

---
updated-dependencies:
- dependency-name: anchor-lang
  dependency-version: 1.0.0-rc.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: solana-account-info
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor-patch
- dependency-name: solana-instruction
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Automated dependency updates rust Rust dependency updates labels Mar 24, 2026
@github-actions github-actions Bot added the size/L Large PR (100-499 lines changed) label Mar 24, 2026
@github-actions

github-actions Bot commented Mar 24, 2026

Copy link
Copy Markdown

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Mar 24, 2026

Copy link
Copy Markdown
Contributor Author

Sorry, only users with push access can use that command.

@github-actions
github-actions Bot merged commit b01ae48 into main Mar 24, 2026
5 of 6 checks passed
@dependabot
dependabot Bot deleted the dependabot/cargo/rust-minor-patch-d19e99ddc9 branch March 24, 2026 17:38
This was referenced May 31, 2026
Merged
Merged
WomB0ComB0 added a commit that referenced this pull request Jun 2, 2026
@WomB0ComB0
ci(security): harden security workflow — clear zizmor alerts #10 & #11 (
f07095b 
#32)

* ci(security): harden security workflow — clear zizmor alerts #10 & #11

Resolves both open code-scanning alerts on .github/workflows/security.yml
(zizmor 1.24.1, verified locally with `zizmor --persona=auditor`):

- #11 secrets-inherit (warning): replace `secrets: inherit` — which hands
  the reusable workflow ALL of this repo's secrets — with named forwarding
  of just SEMGREP_APP_TOKEN (the only enabled token-consuming scanner).
  Enabled by resq-software/.github#21, which declares the secret under
  workflow_call.secrets; re-pinned to that workflow's new SHA
  (b48036af, #21).
- #10 unpinned-uses (error): already SHA-pinned in #30; carried forward.

Also clears two latent findings the stale scan predates:
- excessive-permissions: drop workflow-level `permissions` to `{}` and move
  contents/security-events/pull-requests scopes onto the `scan` job, so they
  apply only to the reusable call.
- undocumented-permissions: every scope now carries an explanatory comment.

`zizmor --no-online-audits` reports "No findings" on the result.

NOTE: this does not by itself explain the separate scheduled-run
startup_failure (which persisted after the #30 pin); switching off
`secrets: inherit` is the leading remaining hypothesis and this PR tests it.

* fix(ci): grant actions:read so the security reusable can start

Root cause of the security-workflow startup_failure (every run since
2026-05-04, 0 jobs executed): the reusable security-scan.yml's CodeQL and
zizmor jobs request `actions: read` (added in resq-software/.github#20,
2026-05-04 — exactly when the failures began). A reusable workflow's jobs
cannot request a permission the caller did not grant; GitHub rejects the
entire run at startup.

The prior #30 SHA-pin and the secrets-inherit removal did not fix it
because neither granted actions:read. Add it to the scan job's permissions.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Automated dependency updates rust Rust dependency updates size/L Large PR (100-499 lines changed)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants