From f647fd0a11fdbd33eac421833ec41b1baeaf44c5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 00:46:57 +0000 Subject: [PATCH 1/3] build(deps): bump the actions group with 3 updates Bumps the actions group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [jdx/mise-action](https://github.com/jdx/mise-action) and [elide-dev/toolchain/action](https://github.com/elide-dev/toolchain). Updates `step-security/harden-runner` from 2.22.2 to 2.22.3 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/dc2769abcc0fcfbadfc1df54081c1608579ef6b2...46b06cea07f9e64621fdf066ba77ac6915163d43) Updates `jdx/mise-action` from 5.2.2 to 5.2.4 - [Release notes](https://github.com/jdx/mise-action/releases) - [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/jdx/mise-action/compare/8418fedb1110381a0d3ba51a7a415d7c1b884550...6be3c7ed4c21d4f76b208d351d95aac273ebb76d) Updates `elide-dev/toolchain/action` from 2026.10.1 to 2026.10.3 - [Release notes](https://github.com/elide-dev/toolchain/releases) - [Commits](https://github.com/elide-dev/toolchain/compare/171eb7cde379e17822e042cfbda26c9740c10b03...4c1d0de75d10912ba860a694256dc93830097833) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: jdx/mise-action dependency-version: 5.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: elide-dev/toolchain/action dependency-version: 2026.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/check.jvm.yml | 4 ++-- .github/workflows/check.native-image.yml | 2 +- .github/workflows/check.rust.yml | 6 +++--- .github/workflows/job.build.yml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/check.jvm.yml b/.github/workflows/check.jvm.yml index e3dafb8..b613f8e 100644 --- a/.github/workflows/check.jvm.yml +++ b/.github/workflows/check.jvm.yml @@ -16,14 +16,14 @@ jobs: steps: - name: Harden runner if: runner.os == 'Linux' - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2 + - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: version: '2026.9.10' # Keep the stock JVM test matrix authoritative after Mise's development JDK. diff --git a/.github/workflows/check.native-image.yml b/.github/workflows/check.native-image.yml index b36a1e4..d5b24b7 100644 --- a/.github/workflows/check.native-image.yml +++ b/.github/workflows/check.native-image.yml @@ -10,7 +10,7 @@ jobs: steps: - name: Harden runner if: runner.os == 'Linux' - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/check.rust.yml b/.github/workflows/check.rust.yml index 5c5694b..3fec6ba 100644 --- a/.github/workflows/check.rust.yml +++ b/.github/workflows/check.rust.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Harden runner if: runner.os == 'Linux' - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: Checkout @@ -29,7 +29,7 @@ jobs: - name: Check generated C exports if: runner.os == 'Linux' run: python3 tools/generate_exports.py --check - - uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2 + - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 if: runner.os == 'Linux' with: version: '2026.9.10' @@ -73,7 +73,7 @@ jobs: timeout-minutes: 45 steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/job.build.yml b/.github/workflows/job.build.yml index 916f8a9..745eaf4 100644 --- a/.github/workflows/job.build.yml +++ b/.github/workflows/job.build.yml @@ -13,7 +13,7 @@ jobs: steps: - name: Harden runner if: runner.os == 'Linux' - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: Checkout @@ -26,7 +26,7 @@ jobs: run: python3 -c 'import json; print("version=" + json.load(open("tools/versions.json"))["llvm"]["toolchain_version"])' >> "$GITHUB_OUTPUT" - name: Install Elide native toolchain id: native-toolchain - uses: elide-dev/toolchain/action@171eb7cde379e17822e042cfbda26c9740c10b03 + uses: elide-dev/toolchain/action@4c1d0de75d10912ba860a694256dc93830097833 with: version: ${{ steps.native-version.outputs.version }} target: ${{ runner.os == 'Linux' && 'x86_64-unknown-linux-gnu' || 'arm64-apple-darwin' }} From 86a974c2a4596fb231efb3c936e65f44918f9303 Mon Sep 17 00:00:00 2001 From: Sam Gammon Date: Wed, 4 Nov 2026 16:59:57 -0800 Subject: [PATCH 2/3] build(deps): retain the current toolchain action pin --- .github/workflows/job.build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/job.build.yml b/.github/workflows/job.build.yml index 745eaf4..fd8d8ef 100644 --- a/.github/workflows/job.build.yml +++ b/.github/workflows/job.build.yml @@ -26,7 +26,7 @@ jobs: run: python3 -c 'import json; print("version=" + json.load(open("tools/versions.json"))["llvm"]["toolchain_version"])' >> "$GITHUB_OUTPUT" - name: Install Elide native toolchain id: native-toolchain - uses: elide-dev/toolchain/action@4c1d0de75d10912ba860a694256dc93830097833 + uses: elide-dev/toolchain/action@4677dd77b520b609bb0e548e6e7a4dadadbb2d14 with: version: ${{ steps.native-version.outputs.version }} target: ${{ runner.os == 'Linux' && 'x86_64-unknown-linux-gnu' || 'arm64-apple-darwin' }} From 48ccaba2edba3bf3fec24fa5dc2c998bd60e027a Mon Sep 17 00:00:00 2001 From: Sam Gammon Date: Wed, 4 Nov 2026 17:08:05 -0800 Subject: [PATCH 3/3] test(safety): synchronize the deliberate TSAN race canary --- tests/sanitizer/SanitizerCanary.java | 7 +++++++ tests/sanitizer/canary.c | 4 +++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/tests/sanitizer/SanitizerCanary.java b/tests/sanitizer/SanitizerCanary.java index fb8d2d8..fd525e2 100644 --- a/tests/sanitizer/SanitizerCanary.java +++ b/tests/sanitizer/SanitizerCanary.java @@ -5,6 +5,7 @@ import java.lang.foreign.ValueLayout; import java.lang.invoke.MethodHandle; import java.nio.file.Path; +import java.util.concurrent.CountDownLatch; /** Calls a deliberately defective native library through FFM; the sanitizer must abort it. */ public final class SanitizerCanary { @@ -26,18 +27,24 @@ public static void main(String[] args) throws Throwable { symbols.find("bemo_canary_race").orElseThrow(), FunctionDescriptor.ofVoid(ValueLayout.JAVA_INT)); Thread[] threads = new Thread[4]; + CountDownLatch ready = new CountDownLatch(threads.length); + CountDownLatch start = new CountDownLatch(1); for (int index = 0; index < threads.length; index++) { threads[index] = Thread.ofPlatform() .start( () -> { try { + ready.countDown(); + start.await(); race.invokeExact(100_000); } catch (Throwable failure) { throw new AssertionError(failure); } }); } + ready.await(); + start.countDown(); for (Thread thread : threads) { thread.join(); } diff --git a/tests/sanitizer/canary.c b/tests/sanitizer/canary.c index 2e704a0..78fe904 100644 --- a/tests/sanitizer/canary.c +++ b/tests/sanitizer/canary.c @@ -14,7 +14,9 @@ int32_t bemo_canary_overflow(void) { } /* Unsynchronized counter written from several Java threads: TSAN must report it. */ -static uint64_t counter; +/* Keep repeated loads/stores; an optimized counter += iterations can finish + * before the other callers enter. Volatile does not make these accesses atomic. */ +static volatile uint64_t counter; void bemo_canary_race(int32_t iterations) { for (int32_t index = 0; index < iterations; index++) {