Merge remote-tracking branch 'origin/main' into r5945

scripts/lint_workflow_triggers.py

@@ -52,14 +52,14 @@ def _normalise_on(on_field):
 
 def _load_workflow(path: Path):
     try:
-        return yaml.safe_load(path.read_text())
+        return yaml.safe_load(path.read_text(encoding = "utf-8"))
     except Exception as exc:
         print(f"ERROR: failed to parse {path}: {exc}", file = sys.stderr)
         sys.exit(2)
 
 
 def _extract_cache_keys(path: Path) -> list[str]:
-    text = path.read_text()
+    text = path.read_text(encoding = "utf-8")
     keys: list[str] = []
     for m in re.finditer(r"(?:^|\n)\s*key:\s*([^\n]+)", text):
         keys.append(m.group(1).strip())
@@ -104,7 +104,7 @@ def main() -> int:
 
         for t in RESTRICTED_TRIGGERS:
             if t in triggers:
-                text = path.read_text()
+                text = path.read_text(encoding = "utf-8")
                 if "lint:workflow_triggers-allow-workflow_run" not in text:
                     findings.append(
                         f"{path.name}: RESTRICTED trigger '{t}' requires an "

scripts/scan_packages_baseline.json

@@ -98,6 +98,14 @@
       "evidence": "L587:                                 while True: sha256:06c2c7f15d73bf192e5e3272c5ff5fcaeff7f6774fef5f4eca6ef473ae50e2b3",
       "evidence_hash": "57acd497f404c203e4450d0580ad85aa8a33406e8d64ad06fbac6cf47d97b24d"
     },
+    {
+      "package": "fastapi",
+      "file": "fastapi/routing.py",
+      "check": "C2 polling/beaconing loop detected",
+      "severity": "CRITICAL",
+      "evidence": "L592:                                 while True: sha256:84283c09277ded3296998b2a6a838744457b606829cf5ab5d0da6f222ff020a0",
+      "evidence_hash": "a7295004315e26a8f3c64fb837521e9fdd7268219bb43e000fb0236ab0259223"
+    },
     {
       "package": "fastmcp-slim",
       "file": "fastmcp/cli/apps_dev.py",