From 710388685c02778bcea92848fde3c3692af5ad06 Mon Sep 17 00:00:00 2001
From: tkc <loosefingers@gmail.com>
Date: Wed, 28 Oct 2026 16:39:18 +0900
Subject: [PATCH 1/2] ci: watch the dependencies for advisories

Dependabot alerts, secret scanning and code scanning are all off on
this repository, so nothing was watching the dependency tree. A manual
`cargo audit` over the 348 crates in the lockfile reports no
vulnerabilities and two informational warnings, neither of which this
repository can act on: lru's panic-safety fix landed in 0.18.2 while
glyphon pins 0.16, and ttf-parser is unmaintained with no patched
release. Both are named in the ignore list with the reason and the
condition for removing them.

The audit runs as its own job on Linux, since it only reads
Cargo.lock. Dependabot is pointed at cargo and the actions, monthly,
with the cargo updates grouped into one pull request.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/dependabot.yml   | 20 ++++++++++++++++++++
 .github/workflows/ci.yml | 27 +++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9d60f18
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+version: 2
+
+# 依存の更新は月に一度でよい。数は 20 ほどで、週ごとに出すと
+# 更新の PR を読むほうが仕事になる。Cargo は 1 本にまとめ、
+# Actions は別に出す。
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    groups:
+      cargo:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e4cab91..aa988ba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,3 +52,30 @@ jobs:
         run: |
           ./target/release/termit --shell-integration | head -3
           ./target/release/termit --latency-test
+
+  audit:
+    # Security advisories against the lockfile. This one runs on Linux:
+    # it only reads Cargo.lock, nothing here is macOS-specific, and the
+    # Linux runner is the cheaper of the two.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Audit the dependencies
+        uses: rustsec/audit-check@v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # Neither of these has a fix this repository can reach, so
+          # they are named here rather than left to fail every run.
+          #
+          # RUSTSEC-2026-0253 (lru, unsound): fixed in 0.18.2, but
+          # glyphon pins lru to 0.16. The advisory needs a key whose
+          # Drop panics; glyphon's key is a Copy enum, which cannot
+          # implement Drop, so the path does not exist here.
+          #
+          # RUSTSEC-2026-0192 (ttf-parser, unmaintained): arrives
+          # through cosmic-text and fontdb, and has no patched release
+          # at all.
+          #
+          # Drop an entry when the crate above it moves.
+          ignore: RUSTSEC-2026-0253,RUSTSEC-2026-0192

From 0759c27f0d268d4adad74073d502ee437ad848b8 Mon Sep 17 00:00:00 2001
From: tkc <loosefingers@gmail.com>
Date: Wed, 28 Oct 2026 16:40:51 +0900
Subject: [PATCH 2/2] ci: move the actions off the deprecated Node 20 runtime

Every run carries the annotation "Node.js 20 is deprecated. The
following actions target Node.js 20 but are being forced to run on
Node.js 24: actions/cache@v4, actions/checkout@v4". Both have majors
that target Node 24, so checkout moves to v7 and cache to v6, in CI and
in the release workflow. dtolnay/rust-toolchain is a composite action
with no Node runtime and is left as it is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml      | 6 +++---
 .github/workflows/release.yml | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aa988ba..30e7021 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     # building on another platform yet.
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -25,7 +25,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -59,7 +59,7 @@ jobs:
     # Linux runner is the cheaper of the two.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Audit the dependencies
         uses: rustsec/audit-check@v2.0.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6ad0c2c..1618ffe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
     # Apple silicon の runner。termit は arm64 でしか測っていない。
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.tag || github.ref }}
 
@@ -29,7 +29,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry