Refresh Graphify and Highlight.js dependencies

.github/workflows/dependabot-vendor.yml

@@ -55,19 +55,20 @@ jobs:
             --jobs "$RUNNER_TEMP/jobs.json" \
             --github-output "$GITHUB_OUTPUT"
 
-      - name: Fetch locked manifests
+      - name: Checkout validated Dependabot head
         shell: bash
         env:
-          GH_TOKEN: ${{ github.token }}
+          HEAD_REF: ${{ steps.context.outputs.head_ref }}
           HEAD_SHA: ${{ steps.context.outputs.head_sha }}
         run: |
           set -euo pipefail
-          gh api -H "Accept: application/vnd.github.raw+json" \
-            "repos/${GITHUB_REPOSITORY}/contents/package.json?ref=${HEAD_SHA}" \
-            > package.json
-          gh api -H "Accept: application/vnd.github.raw+json" \
-            "repos/${GITHUB_REPOSITORY}/contents/package-lock.json?ref=${HEAD_SHA}" \
-            > package-lock.json
+          sha256sum scripts/vendor.js scripts/dependabot_vendor.py \
+            > "$RUNNER_TEMP/trusted-script-checksums"
+          git fetch --no-tags origin "refs/heads/${HEAD_REF}"
+          test "$(git rev-parse FETCH_HEAD)" = "$HEAD_SHA"
+          git checkout --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$HEAD_SHA"
+          sha256sum --check "$RUNNER_TEMP/trusted-script-checksums"
 
       - name: Generate vendor assets from locked dependencies
         shell: bash
@@ -88,9 +89,7 @@ jobs:
           HEAD_SHA: ${{ steps.context.outputs.head_sha }}
         run: |
           set -euo pipefail
-          git fetch --no-tags origin "refs/heads/${HEAD_REF}"
-          test "$(git rev-parse FETCH_HEAD)" = "$HEAD_SHA"
-          git checkout --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$HEAD_SHA"
           rsync --archive --delete "$RUNNER_TEMP/vendor/" static/vendor/
           python "$RUNNER_TEMP/dependabot_vendor.py" stage \
             --root . \

Dockerfile

@@ -3,6 +3,7 @@ FROM python:3.14-slim@sha256:a7fb1e634c4a578f9e0bd6327f11a3cde11b7a9395f48e24360
 WORKDIR /build
 
 RUN apt-get update \
+    && apt-get upgrade --yes \
     && apt-get install --yes --no-install-recommends \
         build-essential \
         libldap-dev \
@@ -39,6 +40,7 @@ RUN adduser --disabled-password --gecos "" appuser
 COPY requirements.txt /app/
 COPY --from=ldap-builder /install /usr/local
 RUN apt-get update \
+    && apt-get upgrade --yes \
     && apt-get install --yes --no-install-recommends \
         ca-certificates \
         libldap2 \

package.json

@@ -11,7 +11,7 @@
     "test:e2e": "playwright test --forbid-only"
   },
   "dependencies": {
-    "@highlightjs/cdn-assets": "11.11.2",
+    "@highlightjs/cdn-assets": "11.12.0",
     "material-icons": "1.13.14",
     "socket.io-client": "4.8.3",
     "@xterm/addon-fit": "0.11.0",

requirements-graph.in

@@ -1,2 +1,2 @@
 # Build-only dependency for the published repository code graph.
-graphifyy==0.9.39
+graphifyy==0.9.42

requirements-graph.txt

@@ -1,7 +1,7 @@
 --require-hashes
-graphifyy==0.9.39 \
-    --hash=sha256:2e1d602677d90ba2e94472828a7ffbea288421bd809d8feb55bff827a21c32f7 \
-    --hash=sha256:3f91de79f5afbccd897297b698e99ba63f34cc4800ecfa494f84d4cf0f59dc55
+graphifyy==0.9.42 \
+    --hash=sha256:a45ff2d9517340a429d8e74a7dc7a74062d1bbc18019f26ec62b98b03863eb1b \
+    --hash=sha256:d87bec57d5dbca1203ce719f4b4afb83ae5eb6cea1b4af2d62d0c10c1c3e26e6
     # via -r requirements-graph.in
 networkx==3.6.1 \
     --hash=sha256:26b7c357accc0c8cde558ad486283728b65b6a95d85ee1cd66bafab4c8168509 \

tests/test_dependency_policy.py

@@ -241,9 +241,9 @@ def test_graph_dependencies_are_hash_locked_and_generated_with_other_locks():
         encoding='utf-8'
     )
 
-    assert 'graphifyy==0.9.39' in graph_input
+    assert 'graphifyy==0.9.42' in graph_input
     assert '--require-hashes' in graph_lock
-    assert 'graphifyy==0.9.39' in graph_lock
+    assert 'graphifyy==0.9.42' in graph_lock
     assert 'requirements-graph.in' in lock_script
     assert 'requirements-graph.txt' in lock_script
 

tests/test_supply_chain_policy.py

@@ -135,6 +135,13 @@ def test_container_build_inputs_and_ci_services_are_digest_pinned():
     assert all(IMAGE_DIGEST.search(reference) for reference in redis_references)
 
 
+def test_container_build_applies_available_base_image_security_updates():
+    dockerfile = (ROOT / 'Dockerfile').read_text(encoding='utf-8')
+
+    assert dockerfile.count('apt-get update') == 2
+    assert dockerfile.count('apt-get upgrade --yes') == 2
+
+
 def test_security_workflow_gates_publish_and_preserves_scan_evidence():
     security = (WORKFLOWS / 'security.yml').read_text(encoding='utf-8')
     publish = (WORKFLOWS / 'docker-publish.yml').read_text(encoding='utf-8')
@@ -314,6 +321,38 @@ def test_dependabot_vendor_refresh_uses_a_separate_validated_write_workflow():
     assert 'workflow_dispatch:' in tests_workflow
 
 
+def test_dependabot_vendor_refresh_checks_out_validated_head_before_generation():
+    workflow = (WORKFLOWS / 'dependabot-vendor.yml').read_text(
+        encoding='utf-8'
+    )
+
+    validation = workflow.index('Fetch and validate Dependabot context')
+    checkout = workflow.index('Checkout validated Dependabot head')
+    generation = workflow.index('Generate vendor assets from locked dependencies')
+
+    assert validation < checkout < generation
+    assert 'git checkout --detach FETCH_HEAD' in workflow
+    assert '> package.json' not in workflow
+    assert '> package-lock.json' not in workflow
+
+
+def test_dependabot_vendor_refresh_executes_only_trusted_automation_scripts():
+    workflow = (WORKFLOWS / 'dependabot-vendor.yml').read_text(
+        encoding='utf-8'
+    )
+
+    snapshot = workflow.index(
+        'sha256sum scripts/vendor.js scripts/dependabot_vendor.py'
+    )
+    checkout = workflow.index('git checkout --detach FETCH_HEAD')
+    verification = workflow.index(
+        'sha256sum --check "$RUNNER_TEMP/trusted-script-checksums"'
+    )
+    generation = workflow.index('node scripts/vendor.js')
+
+    assert snapshot < checkout < verification < generation
+
+
 def test_readme_describes_current_transfer_and_log_rotation_contracts():
     readme = (ROOT / 'README.md').read_text(encoding='utf-8')
 
@@ -358,9 +397,9 @@ def test_graph_pages_toolchain_versions_are_explicit():
 
     assert re.search(r'with:\s*\n\s+version:\s*[\'"]?0\.12\.3', workflow)
     assert 'uv pip install --require-hashes -r requirements-graph.txt' in workflow
-    assert 'graphifyy==0.9.39' in graph_input
+    assert 'graphifyy==0.9.42' in graph_input
     assert '--require-hashes' in graph_lock
-    assert 'graphifyy==0.9.39' in graph_lock
+    assert 'graphifyy==0.9.42' in graph_lock
 
 
 def test_workflows_use_an_explicit_runner_release():