👪 fix security findings

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
     groups:
       codeql-action:
         patterns:
@@ -13,23 +15,33 @@ updates:
     directory: /docs/mkdocs
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/astyle
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/generate_natvis
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/serve_header
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: pip
     directory: /cmake/requirements
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7

.github/workflows/semgrep.yml

@@ -49,7 +49,7 @@ jobs:
       # SEMGREP_APP_TOKEN is still passed through so registry auth works if a
       # token is ever added.
       - name: Install Semgrep
-        run: python3 -m pip install --user semgrep
+        run: python3 -m pip install --user semgrep==1.168.0
 
       # `semgrep scan --sarif` always exits 0 even with findings; continue-on-error
       # is a safety net so the SARIF upload still runs if the scan itself errors.

.github/workflows/windows.yml

@@ -90,11 +90,13 @@ jobs:
       - name: Get latest CMake and ninja
         uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
       - name: Set extra CXX_FLAGS for latest std_version
+        # /wd5285 silences C5285 emitted by the bundled third-party doctest.h, which
+        # specializes std::tuple (newly diagnosed by the VS2026 v145 toolset)
         run: |
           if [ "${{ matrix.std_version }}" = "latest" ]; then
-            echo "flags=/permissive- /std:c++latest /utf-8 /W4 /WX" >> $GITHUB_ENV
+            echo "flags=/permissive- /std:c++latest /utf-8 /W4 /WX /wd5285" >> $GITHUB_ENV
           else
-            echo "flags=/W4 /WX" >> $GITHUB_ENV
+            echo "flags=/W4 /WX /wd5285" >> $GITHUB_ENV
           fi
         shell: bash
       - name: Run CMake (Release)

cmake/clang_flags.cmake

@@ -5,7 +5,7 @@
 # -Wno-extra-semi-stmt            The library uses assert which triggers this warning.
 # -Wno-padded                     We do not care about padding warnings.
 # -Wno-covered-switch-default     All switches list all cases and a default case.
-# -Wno-unsafe-buffer-usage        Otherwise library code (strlen) would not compile.
+# -Wno-unsafe-buffer-usage        Otherwise Doctest would not compile.
 # -Wno-missing-noreturn           We found no way to silence this warning otherwise, see PR #4871
 
 set(CLANG_CXXFLAGS

cmake/gcc_flags.cmake

@@ -4,6 +4,7 @@
 # -Wno-aggregate-return  The library uses aggregate returns.
 # -Wno-long-long         The library uses the long long type to interface with system functions.
 # -Wno-namespaces        The library uses namespaces.
+# -Wno-nrvo              Doctest triggers this warning.
 # -Wno-padded            We do not care about padding warnings.
 # -Wno-system-headers    We do not care about warnings in system headers.
 # -Wno-templates         The library uses templates.
@@ -231,6 +232,7 @@ set(GCC_CXXFLAGS
     -Wnonnull
     -Wnonnull-compare
     -Wnormalized=nfkc
+    -Wno-nrvo
     -Wnull-dereference
     -Wodr
     -Wold-style-cast

tests/src/unit-algorithms.cpp

@@ -232,6 +232,9 @@ TEST_CASE("algorithms")
             // only the first four elements are expected to be sorted, the rest are
             // unspecified by the standard
             const json expected({nullptr, false, true, 3});
+            // std::equal below only bounds-checks the first range; assert the
+            // second range is at least as long to rule out an over-read (CWE-126)
+            CHECK(std::distance(begin(expected), end(expected)) >= 4);
             CHECK(std::equal(j.begin(), j.begin() + 4, begin(expected)));
         }
     }