Merge pull request #289 from timescale/fix/dependency-updates

chore(deps): roll up Dependabot PRs and refresh all lockfiles

Author: mostafa

.github/workflows/audit.yml

@@ -41,7 +41,7 @@ jobs:
           rustup override set stable
       # Pull `cargo-audit` from prebuilt artifacts rather than building
       # it from source every run; saves ~30s per audit invocation.
-      - uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
+      - uses: taiki-e/install-action@682e7d9e49c5e653d371fc6adbda67653461378a # v2.82.4
         with:
           tool: cargo-audit
       - run: cargo audit

.github/workflows/ci.yml

@@ -159,7 +159,7 @@ jobs:
         run: |
           rustup toolchain install stable --profile minimal --component llvm-tools-preview --no-self-update
           rustup override set stable
-      - uses: taiki-e/install-action@b8cecb83565409bcc297b2df6e77f030b2a468d5 # v2.82.0
+      - uses: taiki-e/install-action@682e7d9e49c5e653d371fc6adbda67653461378a # v2.82.4
         with:
           tool: cargo-llvm-cov
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

.github/workflows/docs.yml

@@ -51,7 +51,7 @@ jobs:
           persist-credentials: false
           fetch-depth: 0 # git-revision-date-localized needs full history
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: pip

.github/workflows/fuzz.yml

@@ -84,7 +84,7 @@ jobs:
         run: cargo +nightly install cargo-fuzz --locked
 
       - name: Restore corpus cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: fuzz/corpus/${{ matrix.target }}
           key: fuzz-corpus-${{ matrix.target }}-${{ github.sha }}

.github/workflows/zizmor.yml

@@ -30,6 +30,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+      - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
         with:
           persona: pedantic

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to RSigma are documented in this file. Each entry correspond
 
 ## [Unreleased]
 
+### Dependency bumps (#289)
+
+Rolls up the open Dependabot PRs into a single merge, regenerating the lockfiles against current `main` rather than replaying stale lockfile bases, then refreshes everything else `cargo update`, `npm update`, and the docs pins had pending. Rust (workspace `Cargo.lock`): `similar` 2.7.0 to 3.1.1 (#282, a major bump also reflected in `crates/rsigma-cli/Cargo.toml`), `bytes` 1.11.1 to 1.12.0 (#283), `yamlpath` 1.25.2 to 1.26.1 (#284), `cmov` 0.5.3 to 0.5.4 (#288), and the `patch-updates` group (#281) `log` 0.4.33, `uuid` 1.23.4, `rustls` 0.23.41, `env_logger` 0.11.11 plus `time` and `jsonschema`; a follow-up full `cargo update` regenerates both the workspace and `fuzz/Cargo.lock` to the latest MSRV-compatible set, notably `aws-lc-rs` 1.17.1, `bitflags` 2.13.0, `dashmap` 6.2.1, `env_filter` 2.0.0, `jiff` 0.2.31, `jsonschema` 0.46.9, `rmcp` 1.8.0, `shlex` 2.0.1, `time` 0.3.53, `tree-sitter` 0.26.10, `zerocopy` 0.8.52, and the zizmor crate family (`subfeature`, `tree-sitter-iter`, `yamlpatch`, `yamlpath`) 1.26.1. CI (all repinned by commit SHA, batched via the `actions-updates` group, #280): `actions/cache` v5.0.5 to v6.1.0, `actions/setup-python` v6.2.0 to v6.3.0, `taiki-e/install-action` v2.82.0 to v2.82.4, and `zizmorcore/zizmor-action` v0.5.6 to v0.5.7. VS Code extension: `vscode-languageclient` 10.0.0 to 10.0.1 (#278) and `@types/node` 25.9.3 to 26.0.1 (#279), then an `npm update` pass brings the lockfile to `vscode-languageclient` 10.1.0 and `@types/node` 26.1.0; `tsconfig.json` gains an explicit `"types": ["node"]` because TypeScript 6 no longer resolves the Node globals implicitly with this configuration. Docs build (`docs/requirements.txt`): `pymdown-extensions` 11.0.1, `mkdocs-section-index` 0.3.12, `mkdocs-git-revision-date-localized-plugin` 1.5.3, `mkdocs-rss-plugin` 1.19.0, `mkdocs-llmstxt` 0.5.0, and `mkdocs-redirects` 1.2.3, verified with `mkdocs build --strict`. The `rusqlite` 0.39 to 0.40.1 bump (#234) stays held back: it still pulls `libsqlite3-sys` 0.38.1, whose build script needs the `cfg_select!` macro that is unavailable on the pinned MSRV (1.88.0).
+
 ### Rule drafting from logs (#286)
 
 Turns exemplar events into a complete draft Sigma rule, the detection-authoring sibling of schema signature discovery: feed the malicious or noteworthy events (optionally contrasted against a baseline corpus of normal traffic) and get back paste-ready standard Sigma YAML to review, edit, and commit. The tool proposes, a human decides; metadata stays as explicit `TODO` placeholders.