deps: Mesa 26.2.4, OSV 2.7.0, CodeQL upload 4.39.0, semgrep 1.181.0, mailparser 3.10.0, and a version check for what Dependabot does not read

.github/mesa-dist-win

@@ -1,5 +1,5 @@
-version=26.2.0
-archive=mesa3d-26.2.0-release-msvc.7z
-sha256=dcb2719ef346dab5b609fcb193a5f13cfc4b0502e3f4de1ad43d349477402f47
-file=x64/libgallium_wgl.dll 1a2e49cd5fdb1a857d98117ab04240d723b57da5dffe6d07f5386f42014557c1
-file=x64/opengl32.dll 33b217ed7947b48684baa987914475898a2b4d7d64cce96b078216c67a633582
+version=26.2.4
+archive=mesa3d-26.2.4-release-msvc.7z
+sha256=351fc8c8b695878ffb3eaa044b3ead08672a48b1a045e3c3e3975811df0f6695
+file=x64/libgallium_wgl.dll 53e49adf87590d5b0cab8553b1e98084812040cc1fca8c487695b17b7af3702e
+file=x64/opengl32.dll 75b295fc80df0eaa8f1264c28663f6932c8b72d36513eb092556608858b7f5e0

.github/osv-scanner-digest

@@ -1 +1 @@
-sha256:71ad04ab2f8798be47870f9b18817ad317c2f8f2f97aa6726ba10d5578bc174a
+sha256:d54770fe0b09493894e76a02aaed9f51a0513fa57c5186452a755d257b0068a6

.github/requirements-semgrep.in

@@ -20,8 +20,8 @@
 #
 # Licence read from the pinned version rather than recalled, on 2026-08-27:
 # LGPL-2.1-or-later, stated by the wheel metadata as a License-Expression and
-# carried in full beside it. Read again for 1.180.0 on 2026-10-14, the same.
-# It analyses the tree and is never linked into either binary.
+# carried in full beside it. Read again for 1.180.0 on 2026-10-14 and for
+# 1.181.0 on 2026-10-26, the same. It analyses the tree and is never linked into either binary.
 #
 # This is the one line a person writes. requirements-semgrep.txt next to it is
 # every package that line installs, pinned, and it is compiled from this file
@@ -43,4 +43,12 @@
 # job uses and the pip-tools Dependabot runs:
 #
 #   docker run --rm -v "$PWD/.github:/w" -w /w python:3.14-slim sh -c "pip install -q pip==26.1.1 pip-tools==7.5.3 && pip-compile --strip-extras --no-emit-index-url --output-file=requirements-semgrep.txt requirements-semgrep.in"
-semgrep==1.180.0
+#
+# To raise every package rather than only what a new line needs, add --upgrade,
+# and hold back what is younger than a week the way the cooldown in
+# .github/dependabot.yml does, with --pip-args '--uploaded-prior-to=<a week ago,
+# for example 2026-10-19T00:00:00Z>'. A security fix is the exception, as it is
+# for Dependabot: certifi 2026.10.23 (new roots, #204) is younger than that and
+# was put back by hand on 2026-10-26. Then run the plain command above once
+# more. If it changes nothing, pip accepts the set as it stands.
+semgrep==1.181.0

.github/requirements-semgrep.txt

@@ -168,11 +168,11 @@ ruamel-yaml-clib==0.2.15
     # via semgrep
 semantic-version==2.10.0
     # via semgrep
-semgrep==1.180.0
+semgrep==1.181.0
     # via -r requirements-semgrep.in
 sse-starlette==3.5.0
     # via mcp
-starlette==1.8.0
+starlette==1.9.0
     # via
     #   mcp
     #   sse-starlette

.github/workflows/ci.yml

@@ -994,7 +994,7 @@ jobs:
         # Pinned by commit like every other action here. The scan is evidence,
         # not the document: its job is to ask whether the built binaries contain
         # something the registry does not know about.
-        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c  # v0.24.0
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c  # v0.24.3
         with:
           path: dist
           format: syft-json
@@ -1397,7 +1397,7 @@ jobs:
           # licence gate then blocks two packages of it (review of #173,
           # docs/REVIEW-173-2026-10-07.md). Whether CI-only tools belong under
           # that gate is the owner's decision, not a fix.
-          npm install --prefix "$RUNNER_TEMP/mailparser" mailparser@3.9.36
+          npm install --prefix "$RUNNER_TEMP/mailparser" mailparser@3.10.0
           echo "TFG_MAILPARSER=$RUNNER_TEMP/mailparser/node_modules/mailparser" >> "$GITHUB_ENV"
           node -e "console.log('mailparser', require(process.argv[1] + '/package.json').version)" "$RUNNER_TEMP/mailparser/node_modules/mailparser"
 

.github/workflows/osv-pull-request.yml

@@ -82,7 +82,7 @@ jobs:
       # function is reachable is what the govulncheck job answers.
       - name: scan the branch this merges into
         id: old
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         continue-on-error: true
         with:
           scan-args: |-
@@ -99,7 +99,7 @@ jobs:
 
       - name: scan the merge of this pull request
         id: new
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         continue-on-error: true
         with:
           scan-args: |-
@@ -138,7 +138,7 @@ jobs:
       # table come out byte for byte as they did under the deprecated
       # --output and --gh-annotations (docs/OSV-2-2026-10-15.md).
       - name: what this pull request adds
-        uses: google/osv-scanner-action/osv-reporter-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-reporter-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         with:
           scan-args: |-
             --old=osv-old.json

.github/workflows/osv-weekly.yml

@@ -67,7 +67,7 @@ jobs:
 
       - name: scan
         id: scan
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         continue-on-error: true
         with:
           scan-args: |-
@@ -93,7 +93,7 @@ jobs:
       # way the deprecated --output printed it, measured byte for byte
       # 2026-10-15 (docs/OSV-2-2026-10-15.md).
       - name: results for the Security tab
-        uses: google/osv-scanner-action/osv-reporter-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-reporter-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         with:
           scan-args: |-
             --new=osv-results.json
@@ -102,7 +102,7 @@ jobs:
 
       - name: upload to the Security tab
         if: ${{ !cancelled() && hashFiles('osv-results.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
         with:
           sarif_file: osv-results.sarif
           category: osv-scanner

.github/workflows/pages.yml

@@ -86,4 +86,4 @@ jobs:
           path: web/public
 
       - id: deployment
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346  # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346  # v5.0.1

.github/workflows/tool-versions.yml

@@ -1,9 +1,15 @@
-# Are the tools CI pins still the current ones?
+# Are the versions CI pins still the current ones?
 #
-# Dependabot cannot answer this. It reads go.mod for Go modules and `uses:` for
-# actions, and staticcheck, govulncheck and golangci-lint are none of those -
-# they are shell commands inside a workflow step. Measured 2026-09-02: thirty
-# pull requests from that bot, not one about any of them.
+# Dependabot cannot answer this. It reads go.mod for Go modules, `uses:` for
+# actions and requirements-semgrep.in, and staticcheck, govulncheck and
+# golangci-lint are none of those - they are shell commands inside a workflow
+# step. Measured 2026-09-02: thirty pull requests from that bot, not one about
+# any of them. Since 2026-10-27 the same job asks about GO_VERSION, the
+# software renderer the Windows archive ships (.github/mesa-dist-win, which sat
+# four releases behind with nothing to say so), the npm package the mail check
+# installs, and the two pins the owner holds on purpose (Python, WiX), which it
+# prints and does not fail on. What it asks and why: the docstring of
+# .github/scripts/tool_versions.py.
 #
 # The cost of nobody watching was paid on 2026-09-01. staticcheck was pinned to
 # a version that could not read Go 1.27 at all, and govulncheck to one that

CHANGELOG.md

@@ -24,6 +24,15 @@ because it turns other people's test suites red.
   `--user "$(id -u):$(id -g)"` to write there. README also shows a step that
   installs `tfg` on Windows and macOS runners in GitHub Actions.
 
+### Changed
+
+- **The Windows archive of the window carries Mesa 26.2.4.** The software
+  OpenGL renderer in the `opengl` folder, which the window loads only after
+  the graphics toolkit could not open a window, or when it is started with
+  `--software-gl`, moves from 26.2.0 to 26.2.4, built with LLVM 23.1.2. Its
+  licences are the same. `THIRD-PARTY-NOTICES.md` names the new files and
+  their sums.
+
 ### Fixed
 
 - **`tfg cleanup --yes` keeps a file that changed after it was checked.**

THIRD-PARTY-NOTICES.md

@@ -836,38 +836,39 @@ offered the toolkit less than it needs.
 
 | what | files in the archive | licence | copyright |
 |---|---|---|---|
-| Mesa 3D, llvmpipe software renderer, 26.2.0 | `opengl/libgallium_wgl.dll` and `opengl/opengl32.dll` | MIT AND Apache-2.0 WITH LLVM-exception AND BSL-1.0 | Copyright (C) 1999-2007 Brian Paul, Copyright (C) 2008 VMware, Inc. |
+| Mesa 3D, llvmpipe software renderer, 26.2.4 | `opengl/libgallium_wgl.dll` and `opengl/opengl32.dll` | MIT AND Apache-2.0 WITH LLVM-exception AND BSL-1.0 | Copyright (C) 1999-2007 Brian Paul, Copyright (C) 2008 VMware, Inc. |
 
-The two files are taken from `x64/` of `mesa3d-26.2.0-release-msvc.7z`, the
-MSVC release archive of the pal1000/mesa-dist-win project, version 26.2.0,
+The two files are taken from `x64/` of `mesa3d-26.2.4-release-msvc.7z`, the
+MSVC release archive of the pal1000/mesa-dist-win project, version 26.2.4,
 whose SHA-256 is
-`dcb2719ef346dab5b609fcb193a5f13cfc4b0502e3f4de1ad43d349477402f47`. The
+`351fc8c8b695878ffb3eaa044b3ead08672a48b1a045e3c3e3975811df0f6695`. The
 release workflow downloads that archive, checks the sum before it unpacks
 anything, and puts exactly these two files into the Windows archive of the
 window:
 
 | file | bytes | SHA-256 |
 |---|---|---|
-| `opengl/libgallium_wgl.dll` | 61734400 | `1a2e49cd5fdb1a857d98117ab04240d723b57da5dffe6d07f5386f42014557c1` |
-| `opengl/opengl32.dll` | 139264 | `33b217ed7947b48684baa987914475898a2b4d7d64cce96b078216c67a633582` |
+| `opengl/libgallium_wgl.dll` | 61868032 | `53e49adf87590d5b0cab8553b1e98084812040cc1fca8c487695b17b7af3702e` |
+| `opengl/opengl32.dll` | 139264 | `75b295fc80df0eaa8f1264c28663f6932c8b72d36513eb092556608858b7f5e0` |
 
-The archive carries no licence file of its own - checked on 2026-09-17, it
-holds one readme pointing at a web page - so what is compiled into the two
+The archive carries no licence file of its own - checked on 2026-09-17 and
+again for 26.2.4 on 2026-10-26, it holds one readme pointing at a web page
+and two deployment scripts - so what is compiled into the two
 files was read from the sources of the pinned versions, and the bytes of the
 renderer were asked which of the build's components they hold:
 
-- **Mesa 26.2.0** is MIT: the core, the llvmpipe driver and the WGL frontend.
+- **Mesa 26.2.4** is MIT: the core, the llvmpipe driver and the WGL frontend.
   The core's line is quoted in the table, the driver is Copyright 2007
-  VMware, Inc. Read from `docs/license.rst` and `licenses/` of
-  `mesa-26.2.0.tar.xz`. Two things in that tree carry a GPL identifier and
+  VMware, Inc. Read from `docs/license.rst` and `licenses/` of Mesa at the
+  `mesa-26.2.4` tag. Two things in that tree carry a GPL identifier and
   neither is in these files: Linux kernel headers under `include/drm-uapi`,
   and headers of the freedreno and svga drivers, none of which a Windows
   build compiles.
-- **LLVM 22.1.8**, compiled in for llvmpipe's code generation, is Apache-2.0
+- **LLVM 23.1.2**, compiled in for llvmpipe's code generation, is Apache-2.0
   WITH LLVM-exception. Its licence file states no copyright line under that
   licence, and the one it does carry - Copyright (c) 2003-2019 University of
   Illinois at Urbana-Champaign - belongs to the legacy licence the same file
-  reproduces. Read from `llvm/LICENSE.TXT` at `llvmorg-22.1.8`.
+  reproduces. Read from `llvm/LICENSE.TXT` at `llvmorg-23.1.2`.
 - The **C11 threads shim** Mesa compiles on Windows, `src/c11/impl/threads_win32.c`,
   is BSL-1.0, Copyright yohhoy 2012.
 - The **Direct3D 12 headers**, 1.619.5, used by the d3d12 driver that the same
@@ -883,7 +884,7 @@ reproduced from the files named beside them.
 
 ### LLVM-exception
 
-From `llvm/LICENSE.TXT` at `llvmorg-22.1.8`, the exceptions that follow the
+From `llvm/LICENSE.TXT` at `llvmorg-23.1.2`, the exceptions that follow the
 Apache License, Version 2.0 there.
 
 ```
@@ -906,7 +907,7 @@ Software.
 
 ### BSL-1.0
 
-From `licenses/BSL-1.0` of `mesa-26.2.0.tar.xz`.
+From `licenses/BSL-1.0` of Mesa at the `mesa-26.2.4` tag.
 
 ```
 Boost Software License - Version 1.0 - August 17th, 2003

internal/guard/mutation/entries.py

@@ -9628,8 +9628,8 @@
         # archive would be packed with the wrong name.
         "the registry names a file the window never loads",
         "internal/legal/companions.go",
-        "{Path: \"opengl/libgallium_wgl.dll\", Size: 61734400,",
-        "{Path: \"opengl/libgallium.dll\", Size: 61734400,",
+        "{Path: \"opengl/libgallium_wgl.dll\", Size: 61868032,",
+        "{Path: \"opengl/libgallium.dll\", Size: 61868032,",
         "TestTheRegistryNamesTheFilesTheWindowLoads",
     ),
     (
@@ -9656,8 +9656,8 @@
         # the notices describe another.
         "the renderer pin names a release the registry does not",
         ".github/mesa-dist-win",
-        "version=26.2.0",
-        "version=26.2.1",
+        "version=26.2.4",
+        "version=26.2.5",
         "TestTheRendererPinAgreesWithTheRegistry",
     ),
     (

internal/guard/notelemetry_test.go

@@ -189,7 +189,7 @@ var allowedURLs = map[string]string{
 	"internal/format/rtf/links.go|ftp://example.com/file.txt":                      "a link written into a document, on a domain kept for examples",
 	"internal/format/rtf/links.go|https://example.org/new":                         "a link written into a document, on a domain kept for examples",
 	"internal/format/rtf/links.go|https://example.net/tip":                         "a link written into a document, on a domain kept for examples",
-	"internal/legal/companions.go|https://github.com/pal1000/mesa-dist-win/releases/download/26.2.0/mesa3d-26.2.0-release-msvc.7z": "where the software " +
+	"internal/legal/companions.go|https://github.com/pal1000/mesa-dist-win/releases/download/26.2.4/mesa3d-26.2.4-release-msvc.7z": "where the software " +
 		"renderer's bytes were downloaded FROM, by the release workflow and never by the program: written into the bill of " +
 		"materials as the package's download location, and compared with the workflow's pin by a guard",
 }

internal/guard/testdata/screens/about.xml

@@ -1132,7 +1132,7 @@
 													<widget pos="-6,-6" size="231x45" type="*widget.Label">
 														<widget size="231x45" type="*widget.RichText">
 															<text pos="6,6" size="183x16">Mesa 3D, llvmpipe software</text>
-															<text pos="6,22" size="106x16">renderer  26.2.0</text>
+															<text pos="6,22" size="107x16">renderer  26.2.4</text>
 														</widget>
 													</widget>
 												</container>

internal/legal/companions.go

@@ -75,12 +75,14 @@ type CompanionSource struct {
 // companions is the reviewed list.
 //
 // Everything below was read on 2026-09-17 from the files of the pinned
-// versions: docs/license.rst and licenses/ of mesa-26.2.0.tar.xz from
-// archive.mesa3d.org, buildinfo/msvc.txt of pal1000/mesa-dist-win at its
-// 26.2.0 tag, llvm/LICENSE.TXT at llvmorg-22.1.8, and LICENSE of
-// microsoft/DirectX-Headers at v1.619.5. What is inside the shipped file was
-// measured in its bytes rather than taken from the build list: it names
-// "Mesa 26.2.0" and "LLVM 22.1.8", carries the llvmpipe, d3d12, zink and
+// versions, and again on 2026-10-26 for 26.2.4: docs/license.rst and
+// licenses/ of Mesa at the mesa-26.2.4 tag, buildinfo/msvc.txt of
+// pal1000/mesa-dist-win at its 26.2.4 tag, llvm/LICENSE.TXT at
+// llvmorg-23.1.2 (byte for byte the file of llvmorg-22.1.8 that 26.2.0 was
+// built with), and LICENSE of microsoft/DirectX-Headers at v1.619.5. What is
+// inside the shipped file was measured in its bytes rather than taken from
+// the build list: it names "Mesa 26.2.4" and "LLVM 23.1.2", carries the
+// llvmpipe, d3d12, zink and
 // softpipe drivers and the D3D12 headers, and holds neither zlib's nor
 // zstd's code - the only mention of zlib is LLVM saying it was built without
 // it. Its imports are system libraries only, so it needs no runtime
@@ -96,23 +98,23 @@ var companions = []Companion{
 		Binary:   "tfg-gui",
 		Platform: "windows/amd64",
 		Files: []CompanionFile{
-			{Path: "opengl/libgallium_wgl.dll", Size: 61734400, SHA256: "1a2e49cd5fdb1a857d98117ab04240d723b57da5dffe6d07f5386f42014557c1"},
-			{Path: "opengl/opengl32.dll", Size: 139264, SHA256: "33b217ed7947b48684baa987914475898a2b4d7d64cce96b078216c67a633582"},
+			{Path: "opengl/libgallium_wgl.dll", Size: 61868032, SHA256: "53e49adf87590d5b0cab8553b1e98084812040cc1fca8c487695b17b7af3702e"},
+			{Path: "opengl/opengl32.dll", Size: 139264, SHA256: "75b295fc80df0eaa8f1264c28663f6932c8b72d36513eb092556608858b7f5e0"},
 		},
 		SPDX:      "MIT AND Apache-2.0 WITH LLVM-exception AND BSL-1.0",
 		Copyright: "Copyright (C) 1999-2007 Brian Paul, Copyright (C) 2008 VMware, Inc.",
 		Source: CompanionSource{
 			Project: "pal1000/mesa-dist-win",
-			Version: "26.2.0",
-			Archive: "mesa3d-26.2.0-release-msvc.7z",
-			SHA256:  "dcb2719ef346dab5b609fcb193a5f13cfc4b0502e3f4de1ad43d349477402f47",
-			URL:     "https://github.com/pal1000/mesa-dist-win/releases/download/26.2.0/mesa3d-26.2.0-release-msvc.7z",
+			Version: "26.2.4",
+			Archive: "mesa3d-26.2.4-release-msvc.7z",
+			SHA256:  "351fc8c8b695878ffb3eaa044b3ead08672a48b1a045e3c3e3975811df0f6695",
+			URL:     "https://github.com/pal1000/mesa-dist-win/releases/download/26.2.4/mesa3d-26.2.4-release-msvc.7z",
 			Inside:  "x64/",
 		},
 		Note: "OpenGL in software, for a machine whose graphics driver offers no OpenGL 2.1 - a virtual machine without 3D acceleration, a remote desktop, a server. " +
 			"Loaded only after the toolkit could not open a window, or when the window is started with the flag that asks for it, and never otherwise. " +
 			"Mesa is MIT (core, the llvmpipe driver and the WGL frontend - the core's line is quoted, the driver is Copyright 2007 VMware, Inc.). " +
-			"LLVM 22.1.8, compiled in for llvmpipe's code generation, is Apache-2.0 WITH LLVM-exception - its licence file states no copyright line under that licence, and the one it does carry, Copyright (c) 2003-2019 University of Illinois at Urbana-Champaign, belongs to the legacy licence the file also reproduces. " +
+			"LLVM 23.1.2, compiled in for llvmpipe's code generation, is Apache-2.0 WITH LLVM-exception - its licence file states no copyright line under that licence, and the one it does carry, Copyright (c) 2003-2019 University of Illinois at Urbana-Champaign, belongs to the legacy licence the file also reproduces. " +
 			"The C11 threads shim Mesa compiles on Windows is BSL-1.0, Copyright yohhoy 2012. " +
 			"The Direct3D 12 headers, 1.619.5, are MIT, Copyright (c) Microsoft Corporation. " +
 			"Built and published by pal1000/mesa-dist-win, whose own scripts are MIT, Copyright (c) 2017-2020 pal1000, and whose archive carries no licence file - which is why the texts are read from the sources of the pinned versions and reproduced in the notices.",