Add test with MISSING alerts

Merge pull request #21950 from tonghuaroot/experimental-ssrf-ipv6-transition-js
Add experimental query: SSRF host guard missing IPv6-transition unwrap (CWE-918/CWE-1389)
2026-06-12 00:11:07 +02:00 · 2026-06-11 07:22:17 +02:00 · 2026-06-10 21:42:54 +02:00 · 2026-06-10 08:42:42 +08:00 · 2026-06-09 15:46:04 +02:00 · 2026-06-09 05:30:45 +01:00
545 changed files with 13839 additions and 13488 deletions
--- a/.github/workflows/go-version-update.yml
+++ b/.github/workflows/go-version-update.yml
@@ -0,0 +1,208 @@
+name: Update Go version
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 3 * * 1"  # Run weekly on Mondays at 3 AM UTC (1 = Monday)
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-go-version:
+    name: Check and update Go version
+    if: github.repository == 'github/codeql'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Fetch latest Go version
+        id: fetch-version
+        run: |
+          LATEST_GO_VERSION=$(curl -s https://go.dev/dl/?mode=json | jq -r '.[0].version')
+          
+          if [ -z "$LATEST_GO_VERSION" ] || [ "$LATEST_GO_VERSION" = "null" ]; then
+            echo "Error: Failed to fetch latest Go version from go.dev"
+            exit 1
+          fi
+          
+          echo "Latest Go version from go.dev: $LATEST_GO_VERSION"
+          echo "version=$LATEST_GO_VERSION" >> $GITHUB_OUTPUT
+          
+          # Extract version numbers (e.g., go1.26.0 -> 1.26.0)
+          LATEST_VERSION_NUM=$(echo $LATEST_GO_VERSION | sed 's/^go//')
+          echo "version_num=$LATEST_VERSION_NUM" >> $GITHUB_OUTPUT
+          
+          # Extract major.minor version (e.g., 1.26.0 -> 1.26)
+          LATEST_MAJOR_MINOR=$(echo $LATEST_VERSION_NUM | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
+          echo "major_minor=$LATEST_MAJOR_MINOR" >> $GITHUB_OUTPUT
+
+      - name: Check current Go version
+        id: current-version
+        run: |
+          CURRENT_VERSION=$(sed -n 's/.*go_sdk\.download(version = \"\([^\"]*\)\".*/\1/p' MODULE.bazel)
+          
+          if [ -z "$CURRENT_VERSION" ]; then
+            echo "Error: Could not extract Go version from MODULE.bazel"
+            exit 1
+          fi
+          
+          echo "Current Go version in MODULE.bazel: $CURRENT_VERSION"
+          echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
+          
+          # Extract major.minor version
+          CURRENT_MAJOR_MINOR=$(echo $CURRENT_VERSION | sed -E 's/^([0-9]+\.[0-9]+).*/\1/')
+          echo "major_minor=$CURRENT_MAJOR_MINOR" >> $GITHUB_OUTPUT
+
+      - name: Compare versions
+        id: compare
+        run: |
+          LATEST="${{ steps.fetch-version.outputs.version_num }}"
+          CURRENT="${{ steps.current-version.outputs.version }}"
+          
+          echo "Latest: $LATEST"
+          echo "Current: $CURRENT"
+          
+          if [ "$LATEST" = "$CURRENT" ]; then
+            echo "Go version is up to date"
+            echo "needs_update=false" >> $GITHUB_OUTPUT
+          else
+            echo "Go version needs update from $CURRENT to $LATEST"
+            echo "needs_update=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Update Go version in files
+        if: steps.compare.outputs.needs_update == 'true'
+        run: |
+          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
+          LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
+          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
+          CURRENT_MAJOR_MINOR="${{ steps.current-version.outputs.major_minor }}"
+          
+          echo "Updating from $CURRENT_VERSION to $LATEST_VERSION_NUM"
+          
+          # Escape dots in current version strings for use in sed patterns
+          CURRENT_VERSION_ESCAPED=$(echo "$CURRENT_VERSION" | sed 's/\./\\./g')
+          CURRENT_MAJOR_MINOR_ESCAPED=$(echo "$CURRENT_MAJOR_MINOR" | sed 's/\./\\./g')
+          
+          # Update MODULE.bazel
+          sed -i "s/go_sdk\.download(version = \"$CURRENT_VERSION_ESCAPED\")/go_sdk.download(version = \"$LATEST_VERSION_NUM\")/" MODULE.bazel
+          if ! grep -q "go_sdk.download(version = \"$LATEST_VERSION_NUM\")" MODULE.bazel; then
+            echo "Error: Failed to update MODULE.bazel"
+            exit 1
+          fi
+          
+          # Update go/extractor/go.mod
+          if ! sed -i "s/^go $CURRENT_MAJOR_MINOR_ESCAPED\$/go $LATEST_MAJOR_MINOR/" go/extractor/go.mod; then
+            echo "Warning: Failed to update go directive in go.mod"
+          fi
+          if ! sed -i "s/^toolchain go$CURRENT_VERSION_ESCAPED\$/toolchain go$LATEST_VERSION_NUM/" go/extractor/go.mod; then
+            echo "Warning: Failed to update toolchain in go.mod"
+          fi
+          
+          # Update go/extractor/autobuilder/build-environment.go
+          if ! sed -i "s/var maxGoVersion = util\.NewSemVer(\"$CURRENT_MAJOR_MINOR_ESCAPED\")/var maxGoVersion = util.NewSemVer(\"$LATEST_MAJOR_MINOR\")/" go/extractor/autobuilder/build-environment.go; then
+            echo "Warning: Failed to update build-environment.go"
+          fi
+          
+          # Update go/actions/test/action.yml
+          if ! sed -i "s/default: \"~$CURRENT_VERSION_ESCAPED\"/default: \"~$LATEST_VERSION_NUM\"/" go/actions/test/action.yml; then
+            echo "Warning: Failed to update action.yml"
+          fi
+          
+          # Show what changed
+          git diff
+
+      - name: Check for changes
+        id: check-changes
+        if: steps.compare.outputs.needs_update == 'true'
+        run: |
+          if git diff --quiet; then
+            echo "No changes detected"
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "Changes detected"
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check for existing PR
+        if: steps.check-changes.outputs.has_changes == 'true'
+        id: check-pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH_NAME="workflow/go-version-update"
+          PR_NUMBER=$(gh pr list --head "$BRANCH_NAME" --state open --json number --jq '.[0].number')
+          
+          if [ -n "$PR_NUMBER" ]; then
+            echo "Existing PR found: #$PR_NUMBER"
+            echo "pr_exists=true" >> $GITHUB_OUTPUT
+            echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+          else
+            echo "No existing PR found"
+            echo "pr_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Commit and push changes
+        if: steps.check-changes.outputs.has_changes == 'true'
+        run: |
+          BRANCH_NAME="workflow/go-version-update"
+          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
+          LATEST_MAJOR_MINOR="${{ steps.fetch-version.outputs.major_minor }}"
+          
+          # Create or switch to branch
+          git checkout -B "$BRANCH_NAME"
+          
+          # Stage and commit changes
+          git add MODULE.bazel go/extractor/go.mod go/extractor/autobuilder/build-environment.go go/actions/test/action.yml
+          git commit -m "Go: Update to $LATEST_VERSION_NUM"
+          
+          # Push changes
+          git push --force-with-lease origin "$BRANCH_NAME"
+
+      - name: Create or update PR
+        if: steps.check-changes.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH_NAME="workflow/go-version-update"
+          LATEST_VERSION_NUM="${{ steps.fetch-version.outputs.version_num }}"
+          CURRENT_VERSION="${{ steps.current-version.outputs.version }}"
+          
+          PR_TITLE="Go: Update to $LATEST_VERSION_NUM"
+          
+          PR_BODY=$(cat <<EOF
+          This PR updates Go from $CURRENT_VERSION to $LATEST_VERSION_NUM.
+
+          Updated files:
+          - \`MODULE.bazel\` - go_sdk.download version
+          - \`go/extractor/go.mod\` - go directive and toolchain
+          - \`go/extractor/autobuilder/build-environment.go\` - maxGoVersion (only if MAJOR.MINOR changes)
+          - \`go/actions/test/action.yml\` - default go-test-version
+
+          This PR was automatically created by the [Go version update workflow](https://github.com/${{ github.repository }}/blob/main/.github/workflows/go-version-update.yml).
+          EOF
+          )
+          
+          if [ "${{ steps.check-pr.outputs.pr_exists }}" = "true" ]; then
+            echo "Updating existing PR #${{ steps.check-pr.outputs.pr_number }}"
+            gh pr edit "${{ steps.check-pr.outputs.pr_number }}" --title "$PR_TITLE" --body "$PR_BODY"
+          else
+            echo "Creating new PR"
+            gh pr create \
+              --title "$PR_TITLE" \
+              --body "$PR_BODY" \
+              --base main \
+              --head "$BRANCH_NAME" \
+              --label "Go"
+          fi
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -100,63 +100,63 @@ use_repo(
 tree_sitter_extractors_deps = use_extension("//misc/bazel/3rdparty:tree_sitter_extractors_extension.bzl", "r")
 use_repo(
    tree_sitter_extractors_deps,
-    "vendor_ts__anyhow-1.0.102",
-    "vendor_ts__argfile-1.0.0",
-    "vendor_ts__cc-1.2.62",
+    "vendor_ts__anyhow-1.0.100",
+    "vendor_ts__argfile-0.2.1",
+    "vendor_ts__cc-1.2.61",
    "vendor_ts__chalk-ir-0.104.0",
-    "vendor_ts__chrono-0.4.44",
-    "vendor_ts__clap-4.6.1",
+    "vendor_ts__chrono-0.4.42",
+    "vendor_ts__clap-4.5.48",
    "vendor_ts__dunce-1.0.5",
-    "vendor_ts__either-1.16.0",
+    "vendor_ts__either-1.15.0",
    "vendor_ts__encoding-0.2.33",
    "vendor_ts__figment-0.10.19",
-    "vendor_ts__flate2-1.1.9",
+    "vendor_ts__flate2-1.1.2",
    "vendor_ts__glob-0.3.3",
-    "vendor_ts__globset-0.4.18",
+    "vendor_ts__globset-0.4.16",
    "vendor_ts__itertools-0.14.0",
    "vendor_ts__lazy_static-1.5.0",
    "vendor_ts__mustache-0.9.0",
    "vendor_ts__num-traits-0.2.19",
    "vendor_ts__num_cpus-1.17.0",
-    "vendor_ts__proc-macro2-1.0.106",
-    "vendor_ts__quote-1.0.45",
-    "vendor_ts__ra_ap_base_db-0.0.328",
-    "vendor_ts__ra_ap_cfg-0.0.328",
-    "vendor_ts__ra_ap_hir-0.0.328",
-    "vendor_ts__ra_ap_hir_def-0.0.328",
-    "vendor_ts__ra_ap_hir_expand-0.0.328",
-    "vendor_ts__ra_ap_hir_ty-0.0.328",
-    "vendor_ts__ra_ap_ide_db-0.0.328",
-    "vendor_ts__ra_ap_intern-0.0.328",
-    "vendor_ts__ra_ap_load-cargo-0.0.328",
-    "vendor_ts__ra_ap_parser-0.0.328",
-    "vendor_ts__ra_ap_paths-0.0.328",
-    "vendor_ts__ra_ap_project_model-0.0.328",
-    "vendor_ts__ra_ap_span-0.0.328",
-    "vendor_ts__ra_ap_stdx-0.0.328",
-    "vendor_ts__ra_ap_syntax-0.0.328",
-    "vendor_ts__ra_ap_vfs-0.0.328",
-    "vendor_ts__rand-0.10.1",
-    "vendor_ts__rayon-1.12.0",
-    "vendor_ts__regex-1.12.3",
+    "vendor_ts__proc-macro2-1.0.101",
+    "vendor_ts__quote-1.0.41",
+    "vendor_ts__ra_ap_base_db-0.0.301",
+    "vendor_ts__ra_ap_cfg-0.0.301",
+    "vendor_ts__ra_ap_hir-0.0.301",
+    "vendor_ts__ra_ap_hir_def-0.0.301",
+    "vendor_ts__ra_ap_hir_expand-0.0.301",
+    "vendor_ts__ra_ap_hir_ty-0.0.301",
+    "vendor_ts__ra_ap_ide_db-0.0.301",
+    "vendor_ts__ra_ap_intern-0.0.301",
+    "vendor_ts__ra_ap_load-cargo-0.0.301",
+    "vendor_ts__ra_ap_parser-0.0.301",
+    "vendor_ts__ra_ap_paths-0.0.301",
+    "vendor_ts__ra_ap_project_model-0.0.301",
+    "vendor_ts__ra_ap_span-0.0.301",
+    "vendor_ts__ra_ap_stdx-0.0.301",
+    "vendor_ts__ra_ap_syntax-0.0.301",
+    "vendor_ts__ra_ap_vfs-0.0.301",
+    "vendor_ts__rand-0.9.2",
+    "vendor_ts__rayon-1.11.0",
+    "vendor_ts__regex-1.11.3",
    "vendor_ts__serde-1.0.228",
-    "vendor_ts__serde_json-1.0.150",
-    "vendor_ts__serde_with-3.20.0",
+    "vendor_ts__serde_json-1.0.145",
+    "vendor_ts__serde_with-3.14.1",
    "vendor_ts__serde_yaml-0.9.34-deprecated",
-    "vendor_ts__syn-2.0.117",
-    "vendor_ts__toml-1.1.2-spec-1.1.0",
-    "vendor_ts__tracing-0.1.44",
+    "vendor_ts__syn-2.0.106",
+    "vendor_ts__toml-0.9.7",
+    "vendor_ts__tracing-0.1.41",
    "vendor_ts__tracing-flame-0.2.0",
-    "vendor_ts__tracing-subscriber-0.3.23",
-    "vendor_ts__tree-sitter-0.26.9",
+    "vendor_ts__tracing-subscriber-0.3.20",
+    "vendor_ts__tree-sitter-0.26.8",
    "vendor_ts__tree-sitter-embedded-template-0.25.0",
-    "vendor_ts__tree-sitter-generate-0.26.9",
+    "vendor_ts__tree-sitter-generate-0.26.8",
    "vendor_ts__tree-sitter-json-0.24.8",
-    "vendor_ts__tree-sitter-language-0.1.7",
+    "vendor_ts__tree-sitter-language-0.1.5",
    "vendor_ts__tree-sitter-python-0.23.6",
    "vendor_ts__tree-sitter-ql-0.23.1",
    "vendor_ts__tree-sitter-ruby-0.23.1",
-    "vendor_ts__triomphe-0.1.15",
+    "vendor_ts__triomphe-0.1.14",
    "vendor_ts__ungrammar-1.16.1",
    "vendor_ts__zstd-0.13.3",
 )
@@ -164,12 +164,12 @@ use_repo(
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

 # rust-analyzer sources needed by the rust ast-generator (see `rust/ast-generator/README.md`)
-RUST_ANALYZER_SRC_TAG = "2026-04-13"
+RUST_ANALYZER_SRC_TAG = "2025-01-07"

 http_archive(
    name = "rust-analyzer-src",
    build_file = "//rust/ast-generator:BUILD.rust-analyzer-src.bazel",
-    integrity = "sha256-UB/+EVx/6j4VGvnb7jfRqPaoc7Uwci3rEt6il+2J1Ds=",
+    integrity = "sha256-eo8mIaUafZL8LOM65bDIIIXw1rNQ/P/x5RK/XUtgo5g=",
    patch_args = ["-p1"],
    patches = [
        "//rust/ast-generator:patches/rust-analyzer.patch",
@@ -273,7 +273,7 @@ use_repo(
 )

 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.26.0")
+go_sdk.download(version = "1.26.4")

 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")
--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -11,10 +11,6 @@
    "java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
  ],
-  "Bound Java/C#": [
-    "java/ql/lib/semmle/code/java/dataflow/Bound.qll",
-    "csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll"
-  ],
  "ModulusAnalysis Java/C#": [
    "java/ql/lib/semmle/code/java/dataflow/ModulusAnalysis.qll",
    "csharp/ql/lib/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -9,6 +9,7 @@ dependencies:
  codeql/controlflow: ${workspace}
  codeql/dataflow: ${workspace}
  codeql/mad: ${workspace}
+  codeql/rangeanalysis: ${workspace}
  codeql/ssa: ${workspace}
  codeql/threat-models: ${workspace}
  codeql/tutorial: ${workspace}
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/Bound.qll
@@ -4,67 +4,31 @@
 overlay[local?]
 module;

-private import internal.rangeanalysis.BoundSpecific
+private import csharp as CS
+private import semmle.code.csharp.dataflow.SSA::Ssa
+private import semmle.code.csharp.dataflow.internal.rangeanalysis.ConstantUtils as CU
+private import semmle.code.csharp.dataflow.internal.rangeanalysis.RangeUtils as RU
+private import semmle.code.csharp.dataflow.internal.rangeanalysis.SsaUtils as SU
+private import codeql.rangeanalysis.Bound as SharedBound

-private newtype TBound =
-  TBoundZero() or
-  TBoundSsa(SsaVariable v) { v.getSourceVariable().getType() instanceof IntegralType } or
-  TBoundExpr(Expr e) {
-    interestingExprBound(e) and
-    not exists(SsaVariable v | e = v.getAUse())
-  }
+/** Provides C#-specific definitions for bounds. */
+private module BoundDefs implements SharedBound::BoundDefinitions<CS::Location> {
+  class Type = CS::Type;

-/**
- * A bound that may be inferred for an expression plus/minus an integer delta.
- */
-abstract class Bound extends TBound {
-  /** Gets a textual representation of this bound. */
-  abstract string toString();
+  class SsaVariable = SU::SsaVariable;

-  /** Gets an expression that equals this bound plus `delta`. */
-  abstract Expr getExpr(int delta);
+  class SsaSourceVariable = SourceVariable;

-  /** Gets an expression that equals this bound. */
-  Expr getExpr() { result = this.getExpr(0) }
+  class Expr = CS::ControlFlowNodes::ExprNode;

-  /** Gets the location of this bound. */
-  abstract Location getLocation();
+  class IntegralType = CS::IntegralType;
+
+  class ConstantIntegerExpr = CU::ConstantIntegerExpr;
+
+  /** Holds if `e` is a bound expression and it is not an SSA variable read. */
+  predicate interestingExprBound(Expr e) { CU::systemArrayLengthAccess(e.getExpr()) }
 }

-/**
- * The bound that corresponds to the integer 0. This is used to represent all
- * integer bounds as bounds are always accompanied by an added integer delta.
- */
-class ZeroBound extends Bound, TBoundZero {
-  override string toString() { result = "0" }
+module BoundImpl = SharedBound::Bound<CS::Location, BoundDefs>;

-  override Expr getExpr(int delta) { result.(ConstantIntegerExpr).getIntValue() = delta }
-
-  override Location getLocation() { result.hasLocationInfo("", 0, 0, 0, 0) }
-}
-
-/**
- * A bound corresponding to the value of an SSA variable.
- */
-class SsaBound extends Bound, TBoundSsa {
-  /** Gets the SSA variable that equals this bound. */
-  SsaVariable getSsa() { this = TBoundSsa(result) }
-
-  override string toString() { result = this.getSsa().toString() }
-
-  override Expr getExpr(int delta) { result = this.getSsa().getAUse() and delta = 0 }
-
-  override Location getLocation() { result = this.getSsa().getLocation() }
-}
-
-/**
- * A bound that corresponds to the value of a specific expression that might be
- * interesting, but isn't otherwise represented by the value of an SSA variable.
- */
-class ExprBound extends Bound, TBoundExpr {
-  override string toString() { result = this.getExpr().toString() }
-
-  override Expr getExpr(int delta) { this = TBoundExpr(result) and delta = 0 }
-
-  override Location getLocation() { result = this.getExpr().getLocation() }
-}
+import BoundImpl
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/BoundSpecific.qll
@@ -1,22 +0,0 @@
-/**
- * Provides C#-specific definitions for bounds.
- */
-
-private import csharp as CS
-private import semmle.code.csharp.dataflow.SSA::Ssa as Ssa
-private import semmle.code.csharp.dataflow.internal.rangeanalysis.ConstantUtils as CU
-private import semmle.code.csharp.dataflow.internal.rangeanalysis.RangeUtils as RU
-private import semmle.code.csharp.dataflow.internal.rangeanalysis.SsaUtils as SU
-
-class SsaVariable = SU::SsaVariable;
-
-class Expr = CS::ControlFlowNodes::ExprNode;
-
-class Location = CS::Location;
-
-class IntegralType = CS::IntegralType;
-
-class ConstantIntegerExpr = CU::ConstantIntegerExpr;
-
-/** Holds if `e` is a bound expression and it is not an SSA variable read. */
-predicate interestingExprBound(Expr e) { CU::systemArrayLengthAccess(e.getExpr()) }
--- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.25.6.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.25.6.rst
@@ -0,0 +1,139 @@
+.. _codeql-cli-2.25.6:
+
+==========================
+CodeQL 2.25.6 (2026-06-04)
+==========================
+
+.. contents:: Contents
+   :depth: 2
+   :local:
+   :backlinks: none
+
+This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
+
+Security Coverage
+-----------------
+
+CodeQL 2.25.6 runs a total of 496 security queries when configured with the Default suite (covering 169 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).
+
+CodeQL CLI
+----------
+
+Improvements
+~~~~~~~~~~~~
+
+*   When the :code:`git` executable is available, CodeQL can now obtain configuration and queries from SHA-256 Git repositories, and infer Git metadata about them.
+
+Miscellaneous
+~~~~~~~~~~~~~
+
+*   The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.11.
+
+Query Packs
+-----------
+
+Bug Fixes
+~~~~~~~~~
+
+GitHub Actions
+""""""""""""""
+
+*   Adjusted (minor) help file descriptions for queries: :code:`actions/untrusted-checkout/critical`, :code:`actions/untrusted-checkout/high`, :code:`actions/untrusted-checkout/medium`. Clarified wording on a minor point, added one more listed resource and added one more recommendation for things to check.
+
+Major Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+GitHub Actions
+""""""""""""""
+
+*   Adjusted :code:`actions/untrusted-checkout/critical` to align more with other untrusted resource queries, where the alert location is the location where the artifact is obtained from (the checkout point). This aligns with the other 2 related queries. This will cause the same alerts to re-open for closed alerts of this query.
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+GitHub Actions
+""""""""""""""
+
+*   Altered the alert message for clarity for queries: :code:`actions/untrusted-checkout/critical`, :code:`actions/untrusted-checkout/high`.
+*   The :code:`actions/unpinned-tag` query now recognizes 64-character SHA-256 commit hashes as properly pinned references, in addition to 40-character SHA-1 hashes.
+
+Query Metadata Changes
+~~~~~~~~~~~~~~~~~~~~~~
+
+GitHub Actions
+""""""""""""""
+
+*   Reversed adjustment of the name of :code:`actions/untrusted-checkout/high`, but kept the portion of the previous change for the word "trusted" to "privileged". Added a missing "a" to phrasing in :code:`actions/untrusted-checkout/high` and :code:`actions/untrusted-checkout/medium`.
+
+Language Libraries
+------------------
+
+Major Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Swift
+"""""
+
+*   Upgraded to allow analysis of Swift 6.3.2.
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   Added flow source models for :code:`scanf_s` and related functions.
+*   Added a :code:`Call` column to :code:`LocalFlowSourceFunction::hasLocalFlowSource` and :code:`RemoteFlowSourceFunction::hasRemoteFlowSource`. The old predicates without a :code:`Call` column continue to be supported.
+
+C#
+""
+
+*   Full support for C# 14 / .NET 10. All new language features are now supported by the extractor. The QL library and data flow analysis now support the new C# 14 language constructs and include generated Models as Data (MaD) models for the .NET 10 runtime.
+*   C# 14: Added support for user-defined instance increment/decrement operators.
+
+Java/Kotlin
+"""""""""""
+
+*   Added LLM-generated source and sink models for :code:`org.apache.avro`.
+
+JavaScript/TypeScript
+"""""""""""""""""""""
+
+*   The sensitive data heuristics used to identify code that handles passwords and private data have been improved. Most of the changes permit more variations of established patterns, thereby finding more sensitive data. Queries that use the sensitive data library (for example :code:`js/clear-text-logging`) may find more correct results and fewer false positive results after these changes.
+
+Python
+""""""
+
+*   The sensitive data heuristics used to identify code that handles passwords and private data have been improved. Most of the changes permit more variations of established patterns, thereby finding more sensitive data. Queries that use the sensitive data library (for example :code:`py/clear-text-logging-sensitive-data`) may find more correct results and fewer false positive results after these changes.
+
+Swift
+"""""
+
+*   The sensitive data heuristics used to identify code that handles passwords and private data have been improved. Most of the changes permit more variations of established patterns, thereby finding more sensitive data. Queries that use the sensitive data library (for example :code:`swift/cleartext-logging`) may find more correct results and fewer false positive results after these changes.
+
+GitHub Actions
+""""""""""""""
+
+*   The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, including regexes like :code:`^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a SHA-1 or SHA-256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.
+
+Rust
+""""
+
+*   The sensitive data heuristics used to identify code that handles passwords and private data have been improved. Most of the changes permit more variations of established patterns, thereby finding more sensitive data. Queries that use the sensitive data library (for example :code:`rust/cleartext-logging`) may find more correct results and fewer false positive results after these changes.
+
+Deprecated APIs
+~~~~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   The :code:`UsingAliasTypedefType` class has been deprecated. Use :code:`TypeAliasType` instead.
+
+New Features
+~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   Added a :code:`getOriginalTemplate` predicate to :code:`TemplateClass`, :code:`TemplateFunction`, :code:`TemplateVariable`, and :code:`AliasTemplateType`, which yields the class member template the template was generated from. The predicates only have results for templates that are members of class template instantiations.
+*   Added :code:`AliasTemplateType` and :code:`AliasTemplateInstantiationType` classes, representing C++ alias templates and their instantiations.
--- a/docs/codeql/codeql-overview/codeql-changelog/index.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/index.rst
@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
 .. toctree::
   :maxdepth: 1

+   codeql-cli-2.25.6
   codeql-cli-2.25.5
   codeql-cli-2.25.4
   codeql-cli-2.25.3
--- a/go/actions/test/action.yml
+++ b/go/actions/test/action.yml
@@ -4,7 +4,7 @@ inputs:
  go-test-version:
    description: Which Go version to use for running the tests
    required: false
-    default: "~1.26.0"
+    default: "~1.26.4"
  run-code-checks:
    description: Whether to run formatting, code and qhelp generation checks
    required: false
--- a/go/extractor/go.mod
+++ b/go/extractor/go.mod
@@ -2,14 +2,14 @@ module github.com/github/codeql-go/extractor

 go 1.26

-toolchain go1.26.0
+toolchain go1.26.4

 // when updating this, run
 //    bazel run @rules_go//go -- mod tidy
 // when adding or removing dependencies, run
 //    bazel mod tidy
 require (
-	golang.org/x/mod v0.36.0
+	golang.org/x/mod v0.37.0
 	golang.org/x/tools v0.45.0
 )

--- a/go/extractor/go.sum
+++ b/go/extractor/go.sum
@@ -6,8 +6,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
--- a/java/documentation/library-coverage/coverage.csv
+++ b/java/documentation/library-coverage/coverage.csv
@@ -194,7 +194,7 @@ org.apache.hc.core5.http,73,2,45,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,72,,,,,,,,,,,
 org.apache.hc.core5.net,,,18,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,
 org.apache.hc.core5.util,,,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,6
 org.apache.hive.hcatalog.templeton,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,
-org.apache.http,48,3,95,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,46,,,,,,,,,,,,,,,,3,86,9
+org.apache.http,53,3,117,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,51,,,,,,,,,,,,,,,,3,108,9
 org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,57,
 org.apache.ibatis.mapping,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
 org.apache.log4j,11,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
--- a/java/documentation/library-coverage/coverage.rst
+++ b/java/documentation/library-coverage/coverage.rst
@@ -13,7 +13,7 @@ Java framework & library support
   `Apache Commons IO <https://commons.apache.org/proper/commons-io/>`_,``org.apache.commons.io``,,570,124,105,,,,,15
   `Apache Commons Lang <https://commons.apache.org/proper/commons-lang/>`_,``org.apache.commons.lang3``,,425,7,,,,,,
   `Apache Commons Text <https://commons.apache.org/proper/commons-text/>`_,``org.apache.commons.text``,,272,,,,,,,
-   `Apache HttpComponents <https://hc.apache.org/>`_,"``org.apache.hc.core5.*``, ``org.apache.http``",5,183,122,,3,,,,119
+   `Apache HttpComponents <https://hc.apache.org/>`_,"``org.apache.hc.core5.*``, ``org.apache.http``",5,205,127,,3,,,,124
   `Apache Log4j 2 <https://logging.apache.org/log4j/2.0/>`_,``org.apache.logging.log4j``,,8,359,,,,,,
   `Apache Struts <https://struts.apache.org/>`_,"``org.apache.struts2``, ``org.apache.struts.beanvalidation.validation.interceptor``",,3877,14,,,,,,
   `Apache Velocity <https://velocity.apache.org/>`_,"``org.apache.velocity.app``, ``org.apache.velocity.runtime``",,,8,,,,,,
@@ -41,5 +41,5 @@ Java framework & library support
   `Thymeleaf <https://www.thymeleaf.org/>`_,``org.thymeleaf``,,2,2,,,,,,
   `jOOQ <https://www.jooq.org/>`_,``org.jooq``,,,1,,,1,,,
   Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``hudson``, ``io.jsonwebtoken``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.avro``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.fileupload``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.codehaus.cargo.container.installer``, ``org.dom4j``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",127,6034,775,148,6,14,18,,186
-   Totals,,382,26381,2702,421,16,137,33,1,410
+   Totals,,382,26403,2707,421,16,137,33,1,415

--- a/java/ql/lib/semmle/code/java/dataflow/Bound.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/Bound.qll
@@ -4,67 +4,33 @@
 overlay[local?]
 module;

-private import internal.rangeanalysis.BoundSpecific
+private import java as J
+private import semmle.code.java.dataflow.SSA
+private import semmle.code.java.dataflow.RangeUtils as RU
+private import codeql.rangeanalysis.Bound as SharedBound

-private newtype TBound =
-  TBoundZero() or
-  TBoundSsa(SsaVariable v) { v.getSourceVariable().getType() instanceof IntegralType } or
-  TBoundExpr(Expr e) {
-    interestingExprBound(e) and
-    not exists(SsaVariable v | e = v.getAUse())
+private module BoundDefs implements SharedBound::BoundDefinitions<J::Location> {
+  class SsaVariable extends Ssa::SsaDefinition {
+    /** Gets a use of this variable. */
+    Expr getAUse() { result = super.getARead() }
  }

-/**
- * A bound that may be inferred for an expression plus/minus an integer delta.
- */
-abstract class Bound extends TBound {
-  /** Gets a textual representation of this bound. */
-  abstract string toString();
+  class SsaSourceVariable = Ssa::SourceVariable;

-  /** Gets an expression that equals this bound plus `delta`. */
-  abstract Expr getExpr(int delta);
+  class Type = J::Type;

-  /** Gets an expression that equals this bound. */
-  Expr getExpr() { result = this.getExpr(0) }
+  class Expr = J::Expr;

-  /** Gets the location of this bound. */
-  abstract Location getLocation();
+  class IntegralType = J::IntegralType;
+
+  class ConstantIntegerExpr = RU::ConstantIntegerExpr;
+
+  /** Holds if `e` is a bound expression and it is not an SSA variable read. */
+  predicate interestingExprBound(Expr e) {
+    e.(J::FieldRead).getField() instanceof J::ArrayLengthField
+  }
 }

-/**
- * The bound that corresponds to the integer 0. This is used to represent all
- * integer bounds as bounds are always accompanied by an added integer delta.
- */
-class ZeroBound extends Bound, TBoundZero {
-  override string toString() { result = "0" }
+module BoundImpl = SharedBound::Bound<J::Location, BoundDefs>;

-  override Expr getExpr(int delta) { result.(ConstantIntegerExpr).getIntValue() = delta }
-
-  override Location getLocation() { result.hasLocationInfo("", 0, 0, 0, 0) }
-}
-
-/**
- * A bound corresponding to the value of an SSA variable.
- */
-class SsaBound extends Bound, TBoundSsa {
-  /** Gets the SSA variable that equals this bound. */
-  SsaVariable getSsa() { this = TBoundSsa(result) }
-
-  override string toString() { result = this.getSsa().toString() }
-
-  override Expr getExpr(int delta) { result = this.getSsa().getAUse() and delta = 0 }
-
-  override Location getLocation() { result = this.getSsa().getLocation() }
-}
-
-/**
- * A bound that corresponds to the value of a specific expression that might be
- * interesting, but isn't otherwise represented by the value of an SSA variable.
- */
-class ExprBound extends Bound, TBoundExpr {
-  override string toString() { result = this.getExpr().toString() }
-
-  override Expr getExpr(int delta) { this = TBoundExpr(result) and delta = 0 }
-
-  override Location getLocation() { result = this.getExpr().getLocation() }
-}
+import BoundImpl
--- a/java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/BoundSpecific.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/BoundSpecific.qll
@@ -1,27 +0,0 @@
-/**
- * Provides Java-specific definitions for bounds.
- */
-overlay[local?]
-module;
-
-private import java as J
-private import semmle.code.java.dataflow.SSA as Ssa
-private import semmle.code.java.dataflow.RangeUtils as RU
-
-class SsaVariable extends Ssa::SsaDefinition {
-  /** Gets a use of this variable. */
-  Expr getAUse() { result = super.getARead() }
-}
-
-class Expr = J::Expr;
-
-class Location = J::Location;
-
-class IntegralType = J::IntegralType;
-
-class ConstantIntegerExpr = RU::ConstantIntegerExpr;
-
-/** Holds if `e` is a bound expression and it is not an SSA variable read. */
-predicate interestingExprBound(Expr e) {
-  e.(J::FieldRead).getField() instanceof J::ArrayLengthField
-}
--- a/javascript/ql/integration-tests/query-suite/not_included_in_qls.expected
+++ b/javascript/ql/integration-tests/query-suite/not_included_in_qls.expected
@@ -63,6 +63,7 @@ ql/javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerificationL
 ql/javascript/ql/src/experimental/Security/CWE-444/InsecureHttpParser.ql
 ql/javascript/ql/src/experimental/Security/CWE-522-DecompressionBombs/DecompressionBombs.ql
 ql/javascript/ql/src/experimental/Security/CWE-918/SSRF.ql
+ql/javascript/ql/src/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard.ql
 ql/javascript/ql/src/experimental/StandardLibrary/MultipleArgumentsToSetConstructor.ql
 ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-020/UntrustedDataToExternalAPI.ql
 ql/javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-078/CommandInjection.ql
--- a/javascript/ql/src/change-notes/2026-06-06-ssrf-ipv6-transition-incomplete-guard.md
+++ b/javascript/ql/src/change-notes/2026-06-06-ssrf-ipv6-transition-incomplete-guard.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new experimental query, `javascript/ssrf-ipv6-transition-incomplete-guard`, to detect SSRF host-validation guards that reject private IPv4 ranges but fail to unwrap IPv6-transition forms (IPv4-mapped `::ffff:`, NAT64 `64:ff9b::`, 6to4 `2002::`), allowing the guard to be bypassed by wrapping an internal IPv4 address in a transition literal.
--- a/javascript/ql/src/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard.qhelp
+++ b/javascript/ql/src/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard.qhelp
@@ -0,0 +1,59 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+
+<overview>
+    <p>
+        Server-side request forgery (SSRF) guards frequently reject requests to internal
+        addresses by checking the request host against a denylist of private, loopback and
+        cloud-metadata IPv4 ranges. When such a guard inspects only the dotted-quad IPv4 form
+        and never unwraps IPv6-transition representations, it can be bypassed: the host
+        validator classifies the address as public, but the operating system routes the
+        connection to the embedded internal IPv4 endpoint.
+    </p>
+    <p>
+        The affected forms include IPv4-mapped IPv6 (<code>::ffff:169.254.169.254</code>),
+        NAT64 (<code>64:ff9b::a9fe:a9fe</code>) and 6to4 (<code>2002::</code>). A URL such as
+        <code>http://[::ffff:169.254.169.254]/</code> passes a dotted-quad denylist unchanged
+        while still reaching the internal address.
+    </p>
+</overview>
+
+<recommendation>
+    <p>
+        Normalize the host before validating it: parse the address with a transition-aware
+        library and unwrap IPv4-mapped, NAT64 and 6to4 forms to their embedded IPv4 address,
+        then apply the private-range check to the normalized value. Libraries such as
+        <code>ipaddr.js</code> classify these forms correctly via their range API, and
+        SSRF-protection libraries such as <code>request-filtering-agent</code> apply the check
+        after DNS resolution. Validate the resolved address rather than the textual host.
+    </p>
+</recommendation>
+
+<example>
+    <p>
+        The following guard rejects private IPv4 ranges using the <code>private-ip</code>
+        package, which inspects the textual IPv4 form only. An attacker supplies
+        <code>::ffff:169.254.169.254</code>, which the guard classifies as public, but the
+        request still reaches the internal metadata endpoint.
+    </p>
+
+    <sample src="examples/SsrfIpv6TransitionIncompleteGuardBad.js"/>
+
+    <p>
+        The following guard parses the host with a transition-aware classifier, so the
+        embedded internal IPv4 address is detected regardless of the transition form used.
+    </p>
+
+    <sample src="examples/SsrfIpv6TransitionIncompleteGuardGood.js"/>
+</example>
+
+<references>
+
+<li>OWASP: <a href="https://owasp.org/www-community/attacks/Server_Side_Request_Forgery">Server-Side Request Forgery</a>.</li>
+<li>Common Weakness Enumeration: <a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918</a>.</li>
+<li>Common Weakness Enumeration: <a href="https://cwe.mitre.org/data/definitions/1389.html">CWE-1389</a>.</li>
+
+</references>
+</qhelp>
--- a/javascript/ql/src/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard.ql
+++ b/javascript/ql/src/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard.ql
@@ -0,0 +1,129 @@
+/**
+ * @name SSRF host guard does not reject IPv6-transition forms
+ * @description An SSRF host guard that rejects private or loopback IPv4 ranges but never
+ *              unwraps IPv6-transition forms (IPv4-mapped `::ffff:`, NAT64 `64:ff9b::`,
+ *              6to4 `2002::`) can be bypassed by wrapping an internal IPv4 address in a
+ *              transition literal, allowing requests to reach internal endpoints.
+ * @kind problem
+ * @problem.severity warning
+ * @id javascript/ssrf-ipv6-transition-incomplete-guard
+ * @tags security
+ *       experimental
+ *       external/cwe/cwe-918
+ *       external/cwe/cwe-1389
+ */
+
+import javascript
+
+/**
+ * Holds if `f` imports a dotted-quad-oriented private-IP guard package whose
+ * classification is performed on the textual IPv4 form and therefore returns
+ * `false` for an internal address wrapped in an IPv6-transition literal.
+ */
+predicate importsHandRolledIpGuard(File f) {
+  exists(DataFlow::SourceNode mod |
+    mod.getFile() = f and
+    mod = DataFlow::moduleImport(["private-ip", "is-ip", "ip", "ip-range-check"])
+  )
+}
+
+/**
+ * Holds if `f` contains a call to an `isPrivate`-style host classifier, the
+ * common name for a hand-rolled SSRF guard.
+ */
+predicate hasIsPrivateCall(File f) {
+  exists(DataFlow::CallNode c |
+    c.getFile() = f and
+    c.getCalleeName().regexpMatch("(?i)^is_?private(ip|address|host)?$")
+  )
+  or
+  exists(DataFlow::MethodCallNode m |
+    m.getFile() = f and
+    m.getMethodName().regexpMatch("(?i)^is_?private(ip|address|host)?$")
+  )
+}
+
+/**
+ * Holds if `f` contains a hand-written RFC 1918, loopback or cloud-metadata IPv4
+ * literal used as a denylist entry.
+ */
+predicate hasRfc1918Literal(File f) {
+  exists(StringLiteral s |
+    s.getFile() = f and
+    s.getValue()
+        .regexpMatch("(?i).*(127\\.0\\.0\\.1|169\\.254\\.169\\.254|10\\.|192\\.168|172\\.1[6-9]|::1|fc00|fd00|metadata\\.google).*")
+  )
+}
+
+/** Holds if `f` carries any hand-rolled, dotted-quad-oriented SSRF guard signal. */
+predicate hasUnsafeGuardSignal(File f) {
+  importsHandRolledIpGuard(f) or
+  hasIsPrivateCall(f) or
+  hasRfc1918Literal(f)
+}
+
+/** Holds if `func` has a name that reads as an SSRF host or URL validator. */
+predicate isSsrfValidatorFunction(Function func) {
+  func.getName()
+      .regexpMatch("(?i).*(validate|check|guard|reject|deny|block|allow|is_?safe|sanitiz)e?_?.*(url|host|ip|address|target|endpoint|webhook|origin).*")
+  or
+  func.getName()
+      .regexpMatch("(?i).*(is_?)?(private|internal|loopback|reserved|external)_?(ip|address|host|url).*")
+  or
+  func.getName().regexpMatch("(?i).*(ssrf|metadata).*")
+}
+
+/**
+ * Holds if `f` imports a maturity-hardened, transition-aware address classifier
+ * or SSRF-protection library that does unwrap IPv6-transition forms.
+ */
+predicate importsSafeClassifier(File f) {
+  exists(DataFlow::SourceNode mod |
+    mod.getFile() = f and
+    mod =
+      DataFlow::moduleImport([
+          "ipaddr.js", "ssrf-req-filter", "request-filtering-agent", "ssrf-agent", "netmask",
+          "ip-cidr", "cidr-matcher", "blocked-at"
+        ])
+  )
+}
+
+/**
+ * Holds if `f` already performs an explicit IPv6-transition unwrap or
+ * canonicalization, so the guard does see the embedded IPv4 address.
+ */
+predicate hasTransitionUnwrap(File f) {
+  exists(StringLiteral s |
+    s.getFile() = f and
+    (
+      s.getValue().matches("%64:ff9b%") or
+      s.getValue().matches("%::ffff%") or
+      s.getValue().matches("%2002:%") or
+      s.getValue().matches("%2001:%")
+    )
+  )
+  or
+  exists(Identifier id |
+    id.getFile() = f and
+    id.getName()
+        .regexpMatch("(?i).*(ipv4mapped|v4mapped|mappedipv4|ipv4inipv6|embeddedipv4|unwrap.*ip|toipv4|canonicaliz|isipv4compat).*")
+  )
+  or
+  exists(DataFlow::MethodCallNode m | m.getFile() = f and m.getMethodName() = ["range", "kind"])
+}
+
+/** Holds if `f` is treated as safe (transition-aware), suppressing the alert. */
+predicate isSafe(File f) { importsSafeClassifier(f) or hasTransitionUnwrap(f) }
+
+from Function guard, File f
+where
+  guard.getFile() = f and
+  isSsrfValidatorFunction(guard) and
+  hasUnsafeGuardSignal(f) and
+  not isSafe(f) and
+  not f.getRelativePath()
+      .regexpMatch("(?i).*/(tests?|specs?|examples?|__tests__|e2e|node_modules)/.*")
+select guard,
+  "This SSRF host guard rejects private IPv4 ranges but never unwraps IPv6-transition forms " +
+    "(IPv4-mapped '::ffff:', NAT64 '64:ff9b::', 6to4 '2002::'); an attacker can wrap an internal " +
+    "IPv4 address in a transition literal to bypass it and reach internal endpoints."
--- a/javascript/ql/src/experimental/Security/CWE-918/examples/SsrfIpv6TransitionIncompleteGuardBad.js
+++ b/javascript/ql/src/experimental/Security/CWE-918/examples/SsrfIpv6TransitionIncompleteGuardBad.js
@@ -0,0 +1,14 @@
+const isPrivate = require('private-ip');
+const fetch = require('node-fetch');
+
+// BAD: `private-ip` classifies the textual IPv4 form only, so it returns false
+// for `::ffff:169.254.169.254`. The guard treats the wrapped internal address as
+// public, but the request still reaches the metadata endpoint.
+async function validateUrlHost(host) {
+  if (isPrivate(host)) {
+    throw new Error('blocked private host');
+  }
+  return fetch('http://' + host + '/');
+}
+
+module.exports = { validateUrlHost };
--- a/javascript/ql/src/experimental/Security/CWE-918/examples/SsrfIpv6TransitionIncompleteGuardGood.js
+++ b/javascript/ql/src/experimental/Security/CWE-918/examples/SsrfIpv6TransitionIncompleteGuardGood.js
@@ -0,0 +1,16 @@
+const ipaddr = require('ipaddr.js');
+const fetch = require('node-fetch');
+
+// GOOD: ipaddr.js parses the host and classifies it with `.range()`, which is
+// transition-aware. `::ffff:169.254.169.254` parses as an IPv4-mapped address and
+// is reported in the `linkLocal` range, so the guard is complete.
+async function validateTargetHost(host) {
+  const addr = ipaddr.parse(host);
+  const range = addr.range();
+  if (range === 'private' || range === 'loopback' || range === 'linkLocal') {
+    throw new Error('blocked internal host');
+  }
+  return fetch('http://' + host + '/');
+}
+
+module.exports = { validateTargetHost };
--- a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/SsrfIpv6TransitionIncompleteGuard.expected
+++ b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/SsrfIpv6TransitionIncompleteGuard.expected
@@ -0,0 +1,2 @@
+| bad-private-ip-pkg.js:6:1:11:1 | async f ... '/');\\n} | This SSRF host guard rejects private IPv4 ranges but never unwraps IPv6-transition forms (IPv4-mapped '::ffff:', NAT64 '64:ff9b::', 6to4 '2002::'); an attacker can wrap an internal IPv4 address in a transition literal to bypass it and reach internal endpoints. |
+| bad-rfc1918-regex.js:5:1:16:1 | functio ... '/');\\n} | This SSRF host guard rejects private IPv4 ranges but never unwraps IPv6-transition forms (IPv4-mapped '::ffff:', NAT64 '64:ff9b::', 6to4 '2002::'); an attacker can wrap an internal IPv4 address in a transition literal to bypass it and reach internal endpoints. |
--- a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/SsrfIpv6TransitionIncompleteGuard.qlref
+++ b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/SsrfIpv6TransitionIncompleteGuard.qlref
@@ -0,0 +1 @@
+experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard.ql
--- a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-private-ip-pkg.js
+++ b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-private-ip-pkg.js
@@ -0,0 +1,13 @@
+const isPrivate = require('private-ip');
+const fetch = require('node-fetch');
+
+// BAD: `private-ip` classifies the textual IPv4 form only. It returns false for
+// `::ffff:169.254.169.254`, so a transition-wrapped internal address slips past.
+async function validateUrlHost(host) { // NOT OK
+  if (isPrivate(host)) {
+    throw new Error('blocked private host');
+  }
+  return fetch('http://' + host + '/');
+}
+
+module.exports = { validateUrlHost };
--- a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-rfc1918-regex.js
+++ b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/bad-rfc1918-regex.js
@@ -0,0 +1,18 @@
+const http = require('http');
+
+// BAD: a hand-written RFC 1918 / loopback / metadata denylist matched against the
+// host string. The embedded IPv4 inside `::ffff:10.0.0.1` is never seen.
+function checkTargetHost(host) { // NOT OK
+  if (
+    host === '127.0.0.1' ||
+    host === '169.254.169.254' ||
+    host.startsWith('10.') ||
+    host.startsWith('192.168') ||
+    host.startsWith('172.16')
+  ) {
+    throw new Error('blocked internal host');
+  }
+  return http.get('http://' + host + '/');
+}
+
+module.exports = { checkTargetHost };
--- a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/good-explicit-unwrap.js
+++ b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/good-explicit-unwrap.js
@@ -0,0 +1,32 @@
+const http = require('http');
+
+const IPV4_MAPPED_PREFIX = '::ffff:';
+
+// OK: this guard uses a hand-rolled denylist, but it first unwraps the
+// IPv6-transition form, so the embedded IPv4 is normalized before the check.
+function unwrapMapped(host) {
+  // strip an IPv4-mapped `::ffff:` prefix down to the embedded dotted quad
+  if (host.toLowerCase().startsWith(IPV4_MAPPED_PREFIX)) {
+    return host.slice(IPV4_MAPPED_PREFIX.length);
+  }
+  return host;
+}
+
+function isPrivateAddress(host) { // OK
+  const h = unwrapMapped(host);
+  return (
+    h === '127.0.0.1' ||
+    h === '169.254.169.254' ||
+    h.startsWith('10.') ||
+    h.startsWith('192.168')
+  );
+}
+
+function validateHost(host) { // OK
+  if (isPrivateAddress(host)) {
+    throw new Error('blocked internal host');
+  }
+  return http.get('http://' + host + '/');
+}
+
+module.exports = { validateHost };
--- a/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/good-ipaddr.js
+++ b/javascript/ql/test/experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard/good-ipaddr.js
@@ -0,0 +1,16 @@
+const ipaddr = require('ipaddr.js');
+const fetch = require('node-fetch');
+
+// OK: ipaddr.js parses the address and classifies it with `.range()`, which is
+// transition-aware. `::ffff:10.0.0.1` parses as an IPv4-mapped address and is
+// reported in the `private` range, so the guard is complete.
+async function validateTargetHost(host) { // OK
+  const addr = ipaddr.parse(host);
+  const range = addr.range();
+  if (range === 'private' || range === 'loopback' || range === 'linkLocal') {
+    throw new Error('blocked internal host');
+  }
+  return fetch('http://' + host + '/');
+}
+
+module.exports = { validateTargetHost };
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.aho-corasick-1.1.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.aho-corasick-1.1.3.bazel
@@ -98,8 +98,8 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.1.4",
+    version = "1.1.3",
    deps = [
-        "@vendor_ts__memchr-2.8.0//:memchr",
+        "@vendor_ts__memchr-2.7.5//:memchr",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.android_system_properties-0.1.5.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.android_system_properties-0.1.5.bazel
@@ -95,6 +95,6 @@ rust_library(
    }),
    version = "0.1.5",
    deps = [
-        "@vendor_ts__libc-0.2.186//:libc",
+        "@vendor_ts__libc-0.2.175//:libc",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstream-0.6.20.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstream-0.6.20.bazel
@@ -98,23 +98,23 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.0.0",
+    version = "0.6.20",
    deps = [
-        "@vendor_ts__anstyle-1.0.14//:anstyle",
-        "@vendor_ts__anstyle-parse-1.0.0//:anstyle_parse",
-        "@vendor_ts__anstyle-query-1.1.5//:anstyle_query",
-        "@vendor_ts__colorchoice-1.0.5//:colorchoice",
-        "@vendor_ts__is_terminal_polyfill-1.70.2//:is_terminal_polyfill",
+        "@vendor_ts__anstyle-1.0.11//:anstyle",
+        "@vendor_ts__anstyle-parse-0.2.7//:anstyle_parse",
+        "@vendor_ts__anstyle-query-1.1.4//:anstyle_query",
+        "@vendor_ts__colorchoice-1.0.4//:colorchoice",
+        "@vendor_ts__is_terminal_polyfill-1.70.1//:is_terminal_polyfill",
        "@vendor_ts__utf8parse-0.2.2//:utf8parse",
    ] + select({
        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
-            "@vendor_ts__anstyle-wincon-3.0.11//:anstyle_wincon",  # aarch64-pc-windows-msvc
+            "@vendor_ts__anstyle-wincon-3.0.10//:anstyle_wincon",  # aarch64-pc-windows-msvc
        ],
        "@rules_rust//rust/platform:i686-pc-windows-msvc": [
-            "@vendor_ts__anstyle-wincon-3.0.11//:anstyle_wincon",  # i686-pc-windows-msvc
+            "@vendor_ts__anstyle-wincon-3.0.10//:anstyle_wincon",  # i686-pc-windows-msvc
        ],
        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@vendor_ts__anstyle-wincon-3.0.11//:anstyle_wincon",  # x86_64-pc-windows-msvc
+            "@vendor_ts__anstyle-wincon-3.0.10//:anstyle_wincon",  # x86_64-pc-windows-msvc
        ],
        "//conditions:default": [],
    }),
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstyle-1.0.11.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstyle-1.0.11.bazel
@@ -97,5 +97,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.0.14",
+    version = "1.0.11",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstyle-parse-0.2.7.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstyle-parse-0.2.7.bazel
@@ -97,7 +97,7 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.0.0",
+    version = "0.2.7",
    deps = [
        "@vendor_ts__utf8parse-0.2.2//:utf8parse",
    ],
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstyle-query-1.1.4.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstyle-query-1.1.4.bazel
@@ -93,16 +93,16 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.1.5",
+    version = "1.1.4",
    deps = select({
        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.60.2//:windows_sys",  # cfg(windows)
        ],
        "@rules_rust//rust/platform:i686-pc-windows-msvc": [
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.60.2//:windows_sys",  # cfg(windows)
        ],
        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.60.2//:windows_sys",  # cfg(windows)
        ],
        "//conditions:default": [],
    }),
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstyle-wincon-3.0.10.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anstyle-wincon-3.0.10.bazel
@@ -93,21 +93,21 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "3.0.11",
+    version = "3.0.10",
    deps = [
-        "@vendor_ts__anstyle-1.0.14//:anstyle",
+        "@vendor_ts__anstyle-1.0.11//:anstyle",
    ] + select({
        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
-            "@vendor_ts__once_cell_polyfill-1.70.2//:once_cell_polyfill",  # cfg(windows)
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__once_cell_polyfill-1.70.1//:once_cell_polyfill",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.60.2//:windows_sys",  # cfg(windows)
        ],
        "@rules_rust//rust/platform:i686-pc-windows-msvc": [
-            "@vendor_ts__once_cell_polyfill-1.70.2//:once_cell_polyfill",  # cfg(windows)
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__once_cell_polyfill-1.70.1//:once_cell_polyfill",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.60.2//:windows_sys",  # cfg(windows)
        ],
        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@vendor_ts__once_cell_polyfill-1.70.2//:once_cell_polyfill",  # cfg(windows)
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__once_cell_polyfill-1.70.1//:once_cell_polyfill",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.60.2//:windows_sys",  # cfg(windows)
        ],
        "//conditions:default": [],
    }),
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anyhow-1.0.100.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.anyhow-1.0.100.bazel
@@ -43,7 +43,7 @@ rust_library(
        "std",
    ],
    crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2018",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -101,9 +101,9 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.0.102",
+    version = "1.0.100",
    deps = [
-        "@vendor_ts__anyhow-1.0.102//:build_script_build",
+        "@vendor_ts__anyhow-1.0.100//:build_script_build",
    ],
 )

@@ -144,7 +144,7 @@ cargo_build_script(
            "WORKSPACE.bazel",
        ],
    ),
-    edition = "2021",
+    edition = "2018",
    pkg_name = "anyhow",
    rustc_env_files = [
        ":cargo_toml_env_vars",
@@ -159,7 +159,7 @@ cargo_build_script(
        "noclippy",
        "norustfmt",
    ],
-    version = "1.0.102",
+    version = "1.0.100",
    visibility = ["//visibility:private"],
 )

--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.argfile-0.2.1.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.argfile-0.2.1.bazel
@@ -96,9 +96,9 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.0.0",
+    version = "0.2.1",
    deps = [
-        "@vendor_ts__fs-err-3.3.0//:fs_err",
-        "@vendor_ts__os_str_bytes-7.2.0//:os_str_bytes",
+        "@vendor_ts__fs-err-2.11.0//:fs_err",
+        "@vendor_ts__os_str_bytes-7.1.1//:os_str_bytes",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.atomic-0.6.1.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.atomic-0.6.1.bazel
@@ -99,6 +99,6 @@ rust_library(
    }),
    version = "0.6.1",
    deps = [
-        "@vendor_ts__bytemuck-1.25.0//:bytemuck",
+        "@vendor_ts__bytemuck-1.23.2//:bytemuck",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.atomic-polyfill-1.0.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.atomic-polyfill-1.0.3.bazel
@@ -1,163 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "atomic_polyfill",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=atomic-polyfill",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "1.0.3",
-    deps = [
-        "@vendor_ts__atomic-polyfill-1.0.3//:build_script_build",
-        "@vendor_ts__critical-section-1.2.0//:critical_section",
-    ],
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_name = "build_script_build",
-    crate_root = "build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2021",
-    pkg_name = "atomic-polyfill",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=atomic-polyfill",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "1.0.3",
-    visibility = ["//visibility:private"],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.autocfg-1.5.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.autocfg-1.5.0.bazel
@@ -93,5 +93,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.5.1",
+    version = "1.5.0",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bazel
@@ -32,38 +32,38 @@ filegroup(

 # Workspace Member Dependencies
 alias(
-    name = "anyhow-1.0.102",
-    actual = "@vendor_ts__anyhow-1.0.102//:anyhow",
+    name = "anyhow-1.0.100",
+    actual = "@vendor_ts__anyhow-1.0.100//:anyhow",
    tags = ["manual"],
 )

 alias(
    name = "anyhow",
-    actual = "@vendor_ts__anyhow-1.0.102//:anyhow",
+    actual = "@vendor_ts__anyhow-1.0.100//:anyhow",
    tags = ["manual"],
 )

 alias(
-    name = "argfile-1.0.0",
-    actual = "@vendor_ts__argfile-1.0.0//:argfile",
+    name = "argfile-0.2.1",
+    actual = "@vendor_ts__argfile-0.2.1//:argfile",
    tags = ["manual"],
 )

 alias(
    name = "argfile",
-    actual = "@vendor_ts__argfile-1.0.0//:argfile",
+    actual = "@vendor_ts__argfile-0.2.1//:argfile",
    tags = ["manual"],
 )

 alias(
-    name = "cc-1.2.62",
-    actual = "@vendor_ts__cc-1.2.62//:cc",
+    name = "cc-1.2.61",
+    actual = "@vendor_ts__cc-1.2.61//:cc",
    tags = ["manual"],
 )

 alias(
    name = "cc",
-    actual = "@vendor_ts__cc-1.2.62//:cc",
+    actual = "@vendor_ts__cc-1.2.61//:cc",
    tags = ["manual"],
 )

@@ -80,26 +80,26 @@ alias(
 )

 alias(
-    name = "chrono-0.4.44",
-    actual = "@vendor_ts__chrono-0.4.44//:chrono",
+    name = "chrono-0.4.42",
+    actual = "@vendor_ts__chrono-0.4.42//:chrono",
    tags = ["manual"],
 )

 alias(
    name = "chrono",
-    actual = "@vendor_ts__chrono-0.4.44//:chrono",
+    actual = "@vendor_ts__chrono-0.4.42//:chrono",
    tags = ["manual"],
 )

 alias(
-    name = "clap-4.6.1",
-    actual = "@vendor_ts__clap-4.6.1//:clap",
+    name = "clap-4.5.48",
+    actual = "@vendor_ts__clap-4.5.48//:clap",
    tags = ["manual"],
 )

 alias(
    name = "clap",
-    actual = "@vendor_ts__clap-4.6.1//:clap",
+    actual = "@vendor_ts__clap-4.5.48//:clap",
    tags = ["manual"],
 )

@@ -116,14 +116,14 @@ alias(
 )

 alias(
-    name = "either-1.16.0",
-    actual = "@vendor_ts__either-1.16.0//:either",
+    name = "either-1.15.0",
+    actual = "@vendor_ts__either-1.15.0//:either",
    tags = ["manual"],
 )

 alias(
    name = "either",
-    actual = "@vendor_ts__either-1.16.0//:either",
+    actual = "@vendor_ts__either-1.15.0//:either",
    tags = ["manual"],
 )

@@ -152,14 +152,14 @@ alias(
 )

 alias(
-    name = "flate2-1.1.9",
-    actual = "@vendor_ts__flate2-1.1.9//:flate2",
+    name = "flate2-1.1.2",
+    actual = "@vendor_ts__flate2-1.1.2//:flate2",
    tags = ["manual"],
 )

 alias(
    name = "flate2",
-    actual = "@vendor_ts__flate2-1.1.9//:flate2",
+    actual = "@vendor_ts__flate2-1.1.2//:flate2",
    tags = ["manual"],
 )

@@ -176,14 +176,14 @@ alias(
 )

 alias(
-    name = "globset-0.4.18",
-    actual = "@vendor_ts__globset-0.4.18//:globset",
+    name = "globset-0.4.16",
+    actual = "@vendor_ts__globset-0.4.16//:globset",
    tags = ["manual"],
 )

 alias(
    name = "globset",
-    actual = "@vendor_ts__globset-0.4.18//:globset",
+    actual = "@vendor_ts__globset-0.4.16//:globset",
    tags = ["manual"],
 )

@@ -248,260 +248,260 @@ alias(
 )

 alias(
-    name = "proc-macro2-1.0.106",
-    actual = "@vendor_ts__proc-macro2-1.0.106//:proc_macro2",
+    name = "proc-macro2-1.0.101",
+    actual = "@vendor_ts__proc-macro2-1.0.101//:proc_macro2",
    tags = ["manual"],
 )

 alias(
    name = "proc-macro2",
-    actual = "@vendor_ts__proc-macro2-1.0.106//:proc_macro2",
+    actual = "@vendor_ts__proc-macro2-1.0.101//:proc_macro2",
    tags = ["manual"],
 )

 alias(
-    name = "quote-1.0.45",
-    actual = "@vendor_ts__quote-1.0.45//:quote",
+    name = "quote-1.0.41",
+    actual = "@vendor_ts__quote-1.0.41//:quote",
    tags = ["manual"],
 )

 alias(
    name = "quote",
-    actual = "@vendor_ts__quote-1.0.45//:quote",
+    actual = "@vendor_ts__quote-1.0.41//:quote",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_base_db-0.0.328",
-    actual = "@vendor_ts__ra_ap_base_db-0.0.328//:ra_ap_base_db",
+    name = "ra_ap_base_db-0.0.301",
+    actual = "@vendor_ts__ra_ap_base_db-0.0.301//:ra_ap_base_db",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_base_db",
-    actual = "@vendor_ts__ra_ap_base_db-0.0.328//:ra_ap_base_db",
+    actual = "@vendor_ts__ra_ap_base_db-0.0.301//:ra_ap_base_db",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_cfg-0.0.328",
-    actual = "@vendor_ts__ra_ap_cfg-0.0.328//:ra_ap_cfg",
+    name = "ra_ap_cfg-0.0.301",
+    actual = "@vendor_ts__ra_ap_cfg-0.0.301//:ra_ap_cfg",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_cfg",
-    actual = "@vendor_ts__ra_ap_cfg-0.0.328//:ra_ap_cfg",
+    actual = "@vendor_ts__ra_ap_cfg-0.0.301//:ra_ap_cfg",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_hir-0.0.328",
-    actual = "@vendor_ts__ra_ap_hir-0.0.328//:ra_ap_hir",
+    name = "ra_ap_hir-0.0.301",
+    actual = "@vendor_ts__ra_ap_hir-0.0.301//:ra_ap_hir",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_hir",
-    actual = "@vendor_ts__ra_ap_hir-0.0.328//:ra_ap_hir",
+    actual = "@vendor_ts__ra_ap_hir-0.0.301//:ra_ap_hir",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_hir_def-0.0.328",
-    actual = "@vendor_ts__ra_ap_hir_def-0.0.328//:ra_ap_hir_def",
+    name = "ra_ap_hir_def-0.0.301",
+    actual = "@vendor_ts__ra_ap_hir_def-0.0.301//:ra_ap_hir_def",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_hir_def",
-    actual = "@vendor_ts__ra_ap_hir_def-0.0.328//:ra_ap_hir_def",
+    actual = "@vendor_ts__ra_ap_hir_def-0.0.301//:ra_ap_hir_def",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_hir_expand-0.0.328",
-    actual = "@vendor_ts__ra_ap_hir_expand-0.0.328//:ra_ap_hir_expand",
+    name = "ra_ap_hir_expand-0.0.301",
+    actual = "@vendor_ts__ra_ap_hir_expand-0.0.301//:ra_ap_hir_expand",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_hir_expand",
-    actual = "@vendor_ts__ra_ap_hir_expand-0.0.328//:ra_ap_hir_expand",
+    actual = "@vendor_ts__ra_ap_hir_expand-0.0.301//:ra_ap_hir_expand",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_hir_ty-0.0.328",
-    actual = "@vendor_ts__ra_ap_hir_ty-0.0.328//:ra_ap_hir_ty",
+    name = "ra_ap_hir_ty-0.0.301",
+    actual = "@vendor_ts__ra_ap_hir_ty-0.0.301//:ra_ap_hir_ty",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_hir_ty",
-    actual = "@vendor_ts__ra_ap_hir_ty-0.0.328//:ra_ap_hir_ty",
+    actual = "@vendor_ts__ra_ap_hir_ty-0.0.301//:ra_ap_hir_ty",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_ide_db-0.0.328",
-    actual = "@vendor_ts__ra_ap_ide_db-0.0.328//:ra_ap_ide_db",
+    name = "ra_ap_ide_db-0.0.301",
+    actual = "@vendor_ts__ra_ap_ide_db-0.0.301//:ra_ap_ide_db",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_ide_db",
-    actual = "@vendor_ts__ra_ap_ide_db-0.0.328//:ra_ap_ide_db",
+    actual = "@vendor_ts__ra_ap_ide_db-0.0.301//:ra_ap_ide_db",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_intern-0.0.328",
-    actual = "@vendor_ts__ra_ap_intern-0.0.328//:ra_ap_intern",
+    name = "ra_ap_intern-0.0.301",
+    actual = "@vendor_ts__ra_ap_intern-0.0.301//:ra_ap_intern",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_intern",
-    actual = "@vendor_ts__ra_ap_intern-0.0.328//:ra_ap_intern",
+    actual = "@vendor_ts__ra_ap_intern-0.0.301//:ra_ap_intern",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_load-cargo-0.0.328",
-    actual = "@vendor_ts__ra_ap_load-cargo-0.0.328//:ra_ap_load_cargo",
+    name = "ra_ap_load-cargo-0.0.301",
+    actual = "@vendor_ts__ra_ap_load-cargo-0.0.301//:ra_ap_load_cargo",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_load-cargo",
-    actual = "@vendor_ts__ra_ap_load-cargo-0.0.328//:ra_ap_load_cargo",
+    actual = "@vendor_ts__ra_ap_load-cargo-0.0.301//:ra_ap_load_cargo",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_parser-0.0.328",
-    actual = "@vendor_ts__ra_ap_parser-0.0.328//:ra_ap_parser",
+    name = "ra_ap_parser-0.0.301",
+    actual = "@vendor_ts__ra_ap_parser-0.0.301//:ra_ap_parser",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_parser",
-    actual = "@vendor_ts__ra_ap_parser-0.0.328//:ra_ap_parser",
+    actual = "@vendor_ts__ra_ap_parser-0.0.301//:ra_ap_parser",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_paths-0.0.328",
-    actual = "@vendor_ts__ra_ap_paths-0.0.328//:ra_ap_paths",
+    name = "ra_ap_paths-0.0.301",
+    actual = "@vendor_ts__ra_ap_paths-0.0.301//:ra_ap_paths",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_paths",
-    actual = "@vendor_ts__ra_ap_paths-0.0.328//:ra_ap_paths",
+    actual = "@vendor_ts__ra_ap_paths-0.0.301//:ra_ap_paths",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_project_model-0.0.328",
-    actual = "@vendor_ts__ra_ap_project_model-0.0.328//:ra_ap_project_model",
+    name = "ra_ap_project_model-0.0.301",
+    actual = "@vendor_ts__ra_ap_project_model-0.0.301//:ra_ap_project_model",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_project_model",
-    actual = "@vendor_ts__ra_ap_project_model-0.0.328//:ra_ap_project_model",
+    actual = "@vendor_ts__ra_ap_project_model-0.0.301//:ra_ap_project_model",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_span-0.0.328",
-    actual = "@vendor_ts__ra_ap_span-0.0.328//:ra_ap_span",
+    name = "ra_ap_span-0.0.301",
+    actual = "@vendor_ts__ra_ap_span-0.0.301//:ra_ap_span",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_span",
-    actual = "@vendor_ts__ra_ap_span-0.0.328//:ra_ap_span",
+    actual = "@vendor_ts__ra_ap_span-0.0.301//:ra_ap_span",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_stdx-0.0.328",
-    actual = "@vendor_ts__ra_ap_stdx-0.0.328//:ra_ap_stdx",
+    name = "ra_ap_stdx-0.0.301",
+    actual = "@vendor_ts__ra_ap_stdx-0.0.301//:ra_ap_stdx",
    tags = ["manual"],
 )

 alias(
-    name = "stdx-0.0.328",
-    actual = "@vendor_ts__ra_ap_stdx-0.0.328//:ra_ap_stdx",
+    name = "stdx-0.0.301",
+    actual = "@vendor_ts__ra_ap_stdx-0.0.301//:ra_ap_stdx",
    tags = ["manual"],
 )

 alias(
    name = "stdx",
-    actual = "@vendor_ts__ra_ap_stdx-0.0.328//:ra_ap_stdx",
+    actual = "@vendor_ts__ra_ap_stdx-0.0.301//:ra_ap_stdx",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_syntax-0.0.328",
-    actual = "@vendor_ts__ra_ap_syntax-0.0.328//:ra_ap_syntax",
+    name = "ra_ap_syntax-0.0.301",
+    actual = "@vendor_ts__ra_ap_syntax-0.0.301//:ra_ap_syntax",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_syntax",
-    actual = "@vendor_ts__ra_ap_syntax-0.0.328//:ra_ap_syntax",
+    actual = "@vendor_ts__ra_ap_syntax-0.0.301//:ra_ap_syntax",
    tags = ["manual"],
 )

 alias(
-    name = "ra_ap_vfs-0.0.328",
-    actual = "@vendor_ts__ra_ap_vfs-0.0.328//:ra_ap_vfs",
+    name = "ra_ap_vfs-0.0.301",
+    actual = "@vendor_ts__ra_ap_vfs-0.0.301//:ra_ap_vfs",
    tags = ["manual"],
 )

 alias(
    name = "ra_ap_vfs",
-    actual = "@vendor_ts__ra_ap_vfs-0.0.328//:ra_ap_vfs",
+    actual = "@vendor_ts__ra_ap_vfs-0.0.301//:ra_ap_vfs",
    tags = ["manual"],
 )

 alias(
-    name = "rand-0.10.1",
-    actual = "@vendor_ts__rand-0.10.1//:rand",
+    name = "rand-0.9.2",
+    actual = "@vendor_ts__rand-0.9.2//:rand",
    tags = ["manual"],
 )

 alias(
    name = "rand",
-    actual = "@vendor_ts__rand-0.10.1//:rand",
+    actual = "@vendor_ts__rand-0.9.2//:rand",
    tags = ["manual"],
 )

 alias(
-    name = "rayon-1.12.0",
-    actual = "@vendor_ts__rayon-1.12.0//:rayon",
+    name = "rayon-1.11.0",
+    actual = "@vendor_ts__rayon-1.11.0//:rayon",
    tags = ["manual"],
 )

 alias(
    name = "rayon",
-    actual = "@vendor_ts__rayon-1.12.0//:rayon",
+    actual = "@vendor_ts__rayon-1.11.0//:rayon",
    tags = ["manual"],
 )

 alias(
-    name = "regex-1.12.3",
-    actual = "@vendor_ts__regex-1.12.3//:regex",
+    name = "regex-1.11.3",
+    actual = "@vendor_ts__regex-1.11.3//:regex",
    tags = ["manual"],
 )

 alias(
    name = "regex",
-    actual = "@vendor_ts__regex-1.12.3//:regex",
+    actual = "@vendor_ts__regex-1.11.3//:regex",
    tags = ["manual"],
 )

@@ -518,26 +518,26 @@ alias(
 )

 alias(
-    name = "serde_json-1.0.150",
-    actual = "@vendor_ts__serde_json-1.0.150//:serde_json",
+    name = "serde_json-1.0.145",
+    actual = "@vendor_ts__serde_json-1.0.145//:serde_json",
    tags = ["manual"],
 )

 alias(
    name = "serde_json",
-    actual = "@vendor_ts__serde_json-1.0.150//:serde_json",
+    actual = "@vendor_ts__serde_json-1.0.145//:serde_json",
    tags = ["manual"],
 )

 alias(
-    name = "serde_with-3.20.0",
-    actual = "@vendor_ts__serde_with-3.20.0//:serde_with",
+    name = "serde_with-3.14.1",
+    actual = "@vendor_ts__serde_with-3.14.1//:serde_with",
    tags = ["manual"],
 )

 alias(
    name = "serde_with",
-    actual = "@vendor_ts__serde_with-3.20.0//:serde_with",
+    actual = "@vendor_ts__serde_with-3.14.1//:serde_with",
    tags = ["manual"],
 )

@@ -554,38 +554,38 @@ alias(
 )

 alias(
-    name = "syn-2.0.117",
-    actual = "@vendor_ts__syn-2.0.117//:syn",
+    name = "syn-2.0.106",
+    actual = "@vendor_ts__syn-2.0.106//:syn",
    tags = ["manual"],
 )

 alias(
    name = "syn",
-    actual = "@vendor_ts__syn-2.0.117//:syn",
+    actual = "@vendor_ts__syn-2.0.106//:syn",
    tags = ["manual"],
 )

 alias(
-    name = "toml-1.1.2+spec-1.1.0",
-    actual = "@vendor_ts__toml-1.1.2-spec-1.1.0//:toml",
+    name = "toml-0.9.7",
+    actual = "@vendor_ts__toml-0.9.7//:toml",
    tags = ["manual"],
 )

 alias(
    name = "toml",
-    actual = "@vendor_ts__toml-1.1.2-spec-1.1.0//:toml",
+    actual = "@vendor_ts__toml-0.9.7//:toml",
    tags = ["manual"],
 )

 alias(
-    name = "tracing-0.1.44",
-    actual = "@vendor_ts__tracing-0.1.44//:tracing",
+    name = "tracing-0.1.41",
+    actual = "@vendor_ts__tracing-0.1.41//:tracing",
    tags = ["manual"],
 )

 alias(
    name = "tracing",
-    actual = "@vendor_ts__tracing-0.1.44//:tracing",
+    actual = "@vendor_ts__tracing-0.1.41//:tracing",
    tags = ["manual"],
 )

@@ -602,26 +602,26 @@ alias(
 )

 alias(
-    name = "tracing-subscriber-0.3.23",
-    actual = "@vendor_ts__tracing-subscriber-0.3.23//:tracing_subscriber",
+    name = "tracing-subscriber-0.3.20",
+    actual = "@vendor_ts__tracing-subscriber-0.3.20//:tracing_subscriber",
    tags = ["manual"],
 )

 alias(
    name = "tracing-subscriber",
-    actual = "@vendor_ts__tracing-subscriber-0.3.23//:tracing_subscriber",
+    actual = "@vendor_ts__tracing-subscriber-0.3.20//:tracing_subscriber",
    tags = ["manual"],
 )

 alias(
-    name = "tree-sitter-0.26.9",
-    actual = "@vendor_ts__tree-sitter-0.26.9//:tree_sitter",
+    name = "tree-sitter-0.26.8",
+    actual = "@vendor_ts__tree-sitter-0.26.8//:tree_sitter",
    tags = ["manual"],
 )

 alias(
    name = "tree-sitter",
-    actual = "@vendor_ts__tree-sitter-0.26.9//:tree_sitter",
+    actual = "@vendor_ts__tree-sitter-0.26.8//:tree_sitter",
    tags = ["manual"],
 )

@@ -638,14 +638,14 @@ alias(
 )

 alias(
-    name = "tree-sitter-generate-0.26.9",
-    actual = "@vendor_ts__tree-sitter-generate-0.26.9//:tree_sitter_generate",
+    name = "tree-sitter-generate-0.26.8",
+    actual = "@vendor_ts__tree-sitter-generate-0.26.8//:tree_sitter_generate",
    tags = ["manual"],
 )

 alias(
    name = "tree-sitter-generate",
-    actual = "@vendor_ts__tree-sitter-generate-0.26.9//:tree_sitter_generate",
+    actual = "@vendor_ts__tree-sitter-generate-0.26.8//:tree_sitter_generate",
    tags = ["manual"],
 )

@@ -662,14 +662,14 @@ alias(
 )

 alias(
-    name = "tree-sitter-language-0.1.7",
-    actual = "@vendor_ts__tree-sitter-language-0.1.7//:tree_sitter_language",
+    name = "tree-sitter-language-0.1.5",
+    actual = "@vendor_ts__tree-sitter-language-0.1.5//:tree_sitter_language",
    tags = ["manual"],
 )

 alias(
    name = "tree-sitter-language",
-    actual = "@vendor_ts__tree-sitter-language-0.1.7//:tree_sitter_language",
+    actual = "@vendor_ts__tree-sitter-language-0.1.5//:tree_sitter_language",
    tags = ["manual"],
 )

@@ -722,14 +722,14 @@ alias(
 )

 alias(
-    name = "triomphe-0.1.15",
-    actual = "@vendor_ts__triomphe-0.1.15//:triomphe",
+    name = "triomphe-0.1.14",
+    actual = "@vendor_ts__triomphe-0.1.14//:triomphe",
    tags = ["manual"],
 )

 alias(
    name = "triomphe",
-    actual = "@vendor_ts__triomphe-0.1.15//:triomphe",
+    actual = "@vendor_ts__triomphe-0.1.14//:triomphe",
    tags = ["manual"],
 )

--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bindgen-0.72.1.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bindgen-0.72.1.bazel
@@ -106,18 +106,18 @@ rust_library(
    version = "0.72.1",
    deps = [
        "@vendor_ts__bindgen-0.72.1//:build_script_build",
-        "@vendor_ts__bitflags-2.11.1//:bitflags",
+        "@vendor_ts__bitflags-2.9.4//:bitflags",
        "@vendor_ts__cexpr-0.6.0//:cexpr",
        "@vendor_ts__clang-sys-1.8.1//:clang_sys",
-        "@vendor_ts__itertools-0.13.0//:itertools",
-        "@vendor_ts__log-0.4.29//:log",
+        "@vendor_ts__itertools-0.12.1//:itertools",
+        "@vendor_ts__log-0.4.28//:log",
        "@vendor_ts__prettyplease-0.2.37//:prettyplease",
-        "@vendor_ts__proc-macro2-1.0.106//:proc_macro2",
-        "@vendor_ts__quote-1.0.45//:quote",
-        "@vendor_ts__regex-1.12.3//:regex",
-        "@vendor_ts__rustc-hash-2.1.2//:rustc_hash",
+        "@vendor_ts__proc-macro2-1.0.101//:proc_macro2",
+        "@vendor_ts__quote-1.0.41//:quote",
+        "@vendor_ts__regex-1.11.3//:regex",
+        "@vendor_ts__rustc-hash-2.1.1//:rustc_hash",
        "@vendor_ts__shlex-1.3.0//:shlex",
-        "@vendor_ts__syn-2.0.117//:syn",
+        "@vendor_ts__syn-2.0.106//:syn",
    ],
 )

--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bitflags-1.3.2.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bitflags-1.3.2.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )

 rust_library(
-    name = "slab",
+    name = "bitflags",
    srcs = glob(
        include = ["**/*.rs"],
        allow_empty = True,
@@ -35,7 +35,7 @@ rust_library(
        ],
    ),
    crate_features = [
-        "std",
+        "default",
    ],
    crate_root = "src/lib.rs",
    edition = "2018",
@@ -47,7 +47,7 @@ rust_library(
    ],
    tags = [
        "cargo-bazel",
-        "crate-name=slab",
+        "crate-name=bitflags",
        "manual",
        "noclippy",
        "norustfmt",
@@ -96,5 +96,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.4.12",
+    version = "1.3.2",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bitflags-2.11.1.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bitflags-2.11.1.bazel
@@ -93,5 +93,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "2.11.1",
+    version = "2.9.4",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.borsh-1.5.7.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.borsh-1.5.7.bazel
@@ -97,9 +97,9 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.6.1",
+    version = "1.5.7",
    deps = [
-        "@vendor_ts__borsh-1.6.1//:build_script_build",
+        "@vendor_ts__borsh-1.5.7//:build_script_build",
    ],
 )

@@ -151,7 +151,7 @@ cargo_build_script(
        "noclippy",
        "norustfmt",
    ],
-    version = "1.6.1",
+    version = "1.5.7",
    visibility = ["//visibility:private"],
    deps = [
        "@vendor_ts__cfg_aliases-0.2.1//:cfg_aliases",
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bstr-1.12.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bstr-1.12.0.bazel
@@ -97,8 +97,8 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.12.1",
+    version = "1.12.0",
    deps = [
-        "@vendor_ts__memchr-2.8.0//:memchr",
+        "@vendor_ts__memchr-2.7.5//:memchr",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bumpalo-3.19.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bumpalo-3.19.0.bazel
@@ -96,5 +96,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "3.20.2",
+    version = "3.19.0",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bytemuck-1.23.2.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.bytemuck-1.23.2.bazel
@@ -93,5 +93,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.25.0",
+    version = "1.23.2",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.camino-1.1.12.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.camino-1.1.12.bazel
@@ -39,10 +39,11 @@ rust_library(
        ],
    ),
    crate_features = [
+        "serde",
        "serde1",
    ],
    crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2018",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -100,10 +101,10 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.2.2",
+    version = "1.1.12",
    deps = [
-        "@vendor_ts__camino-1.2.2//:build_script_build",
-        "@vendor_ts__serde_core-1.0.228//:serde_core",
+        "@vendor_ts__camino-1.1.12//:build_script_build",
+        "@vendor_ts__serde-1.0.228//:serde",
    ],
 )

@@ -127,6 +128,7 @@ cargo_build_script(
        ],
    ),
    crate_features = [
+        "serde",
        "serde1",
    ],
    crate_name = "build_script_build",
@@ -143,7 +145,7 @@ cargo_build_script(
            "WORKSPACE.bazel",
        ],
    ),
-    edition = "2021",
+    edition = "2018",
    pkg_name = "camino",
    rustc_env_files = [
        ":cargo_toml_env_vars",
@@ -158,7 +160,7 @@ cargo_build_script(
        "noclippy",
        "norustfmt",
    ],
-    version = "1.2.2",
+    version = "1.1.12",
    visibility = ["//visibility:private"],
 )

--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cargo-platform-0.2.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cargo-platform-0.2.0.bazel
@@ -35,7 +35,7 @@ rust_library(
        ],
    ),
    crate_root = "src/lib.rs",
-    edition = "2024",
+    edition = "2021",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -93,8 +93,8 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.3.3",
+    version = "0.2.0",
    deps = [
-        "@vendor_ts__serde_core-1.0.228//:serde_core",
+        "@vendor_ts__serde-1.0.228//:serde",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cargo-util-schemas-0.8.2.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cargo-util-schemas-0.8.2.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )

 rust_library(
-    name = "cobs",
+    name = "cargo_util_schemas",
    srcs = glob(
        include = ["**/*.rs"],
        allow_empty = True,
@@ -44,7 +44,7 @@ rust_library(
    ],
    tags = [
        "cargo-bazel",
-        "crate-name=cobs",
+        "crate-name=cargo-util-schemas",
        "manual",
        "noclippy",
        "norustfmt",
@@ -93,8 +93,15 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.3.0",
+    version = "0.8.2",
    deps = [
+        "@vendor_ts__semver-1.0.28//:semver",
+        "@vendor_ts__serde-1.0.228//:serde",
+        "@vendor_ts__serde-untagged-0.1.8//:serde_untagged",
+        "@vendor_ts__serde-value-0.7.0//:serde_value",
        "@vendor_ts__thiserror-2.0.18//:thiserror",
+        "@vendor_ts__toml-0.8.23//:toml",
+        "@vendor_ts__unicode-xid-0.2.6//:unicode_xid",
+        "@vendor_ts__url-2.5.7//:url",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cargo_metadata-0.21.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cargo_metadata-0.21.0.bazel
@@ -96,13 +96,14 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.23.1",
+    version = "0.21.0",
    deps = [
-        "@vendor_ts__camino-1.2.2//:camino",
-        "@vendor_ts__cargo-platform-0.3.3//:cargo_platform",
+        "@vendor_ts__camino-1.1.12//:camino",
+        "@vendor_ts__cargo-platform-0.2.0//:cargo_platform",
+        "@vendor_ts__cargo-util-schemas-0.8.2//:cargo_util_schemas",
        "@vendor_ts__semver-1.0.28//:semver",
        "@vendor_ts__serde-1.0.228//:serde",
-        "@vendor_ts__serde_json-1.0.150//:serde_json",
+        "@vendor_ts__serde_json-1.0.145//:serde_json",
        "@vendor_ts__thiserror-2.0.18//:thiserror",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cc-1.2.61.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cc-1.2.61.bazel
@@ -96,47 +96,47 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.2.62",
+    version = "1.2.61",
    deps = [
        "@vendor_ts__find-msvc-tools-0.1.9//:find_msvc_tools",
        "@vendor_ts__jobserver-0.1.34//:jobserver",
        "@vendor_ts__shlex-1.3.0//:shlex",
    ] + select({
        "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # aarch64-apple-darwin
+            "@vendor_ts__libc-0.2.175//:libc",  # aarch64-apple-darwin
        ],
        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # aarch64-unknown-linux-gnu
+            "@vendor_ts__libc-0.2.175//:libc",  # aarch64-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # aarch64-unknown-linux-gnu, aarch64-unknown-nixos-gnu
+            "@vendor_ts__libc-0.2.175//:libc",  # aarch64-unknown-linux-gnu, aarch64-unknown-nixos-gnu
        ],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # arm-unknown-linux-gnueabi
+            "@vendor_ts__libc-0.2.175//:libc",  # arm-unknown-linux-gnueabi
        ],
        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # i686-unknown-linux-gnu
+            "@vendor_ts__libc-0.2.175//:libc",  # i686-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # powerpc-unknown-linux-gnu
+            "@vendor_ts__libc-0.2.175//:libc",  # powerpc-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # riscv64gc-unknown-linux-gnu
+            "@vendor_ts__libc-0.2.175//:libc",  # riscv64gc-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # s390x-unknown-linux-gnu
+            "@vendor_ts__libc-0.2.175//:libc",  # s390x-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # x86_64-apple-darwin
+            "@vendor_ts__libc-0.2.175//:libc",  # x86_64-apple-darwin
        ],
        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [
-            "@vendor_ts__libc-0.2.186//:libc",  # x86_64-unknown-freebsd
+            "@vendor_ts__libc-0.2.175//:libc",  # x86_64-unknown-freebsd
        ],
        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # x86_64-unknown-linux-gnu
+            "@vendor_ts__libc-0.2.175//:libc",  # x86_64-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # x86_64-unknown-linux-gnu, x86_64-unknown-nixos-gnu
+            "@vendor_ts__libc-0.2.175//:libc",  # x86_64-unknown-linux-gnu, x86_64-unknown-nixos-gnu
        ],
        "//conditions:default": [],
    }),
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cfg-if-1.0.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cfg-if-1.0.3.bazel
@@ -93,5 +93,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.0.4",
+    version = "1.0.3",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chacha20-0.10.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chacha20-0.10.0.bazel
@@ -1,151 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "chacha20",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "rng",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2024",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=chacha20",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.10.0",
-    deps = [
-        "@vendor_ts__cfg-if-1.0.4//:cfg_if",
-        "@vendor_ts__rand_core-0.10.1//:rand_core",
-    ] + select({
-        "@rules_rust//rust/platform:i686-apple-darwin": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:i686-linux-android": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-linux-android": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [
-            "@vendor_ts__cpufeatures-0.3.0//:cpufeatures",  # cfg(any(target_arch = "x86_64", target_arch = "x86"))
-        ],
-        "//conditions:default": [],
-    }),
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-derive-0.103.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-derive-0.103.0.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )

 rust_proc_macro(
-    name = "ra_ap_macros",
+    name = "chalk_derive",
    srcs = glob(
        include = ["**/*.rs"],
        allow_empty = True,
@@ -35,7 +35,7 @@ rust_proc_macro(
        ],
    ),
    crate_root = "src/lib.rs",
-    edition = "2024",
+    edition = "2018",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -44,7 +44,7 @@ rust_proc_macro(
    ],
    tags = [
        "cargo-bazel",
-        "crate-name=ra_ap_macros",
+        "crate-name=chalk-derive",
        "manual",
        "noclippy",
        "norustfmt",
@@ -93,11 +93,11 @@ rust_proc_macro(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.0.328",
+    version = "0.103.0",
    deps = [
-        "@vendor_ts__proc-macro2-1.0.106//:proc_macro2",
-        "@vendor_ts__quote-1.0.45//:quote",
-        "@vendor_ts__syn-2.0.117//:syn",
+        "@vendor_ts__proc-macro2-1.0.101//:proc_macro2",
+        "@vendor_ts__quote-1.0.41//:quote",
+        "@vendor_ts__syn-2.0.106//:syn",
        "@vendor_ts__synstructure-0.13.2//:synstructure",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-derive-0.104.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-derive-0.104.0.bazel
@@ -95,9 +95,9 @@ rust_proc_macro(
    }),
    version = "0.104.0",
    deps = [
-        "@vendor_ts__proc-macro2-1.0.106//:proc_macro2",
-        "@vendor_ts__quote-1.0.45//:quote",
-        "@vendor_ts__syn-2.0.117//:syn",
+        "@vendor_ts__proc-macro2-1.0.101//:proc_macro2",
+        "@vendor_ts__quote-1.0.41//:quote",
+        "@vendor_ts__syn-2.0.106//:syn",
        "@vendor_ts__synstructure-0.13.2//:synstructure",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-ir-0.103.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-ir-0.103.0.bazel
@@ -0,0 +1,103 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "chalk_ir",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_root = "src/lib.rs",
+    edition = "2018",
+    proc_macro_deps = [
+        "@vendor_ts__chalk-derive-0.103.0//:chalk_derive",
+    ],
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=chalk-ir",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
+        "@rules_rust//rust/platform:aarch64-linux-android": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
+        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
+        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
+        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:i686-apple-darwin": [],
+        "@rules_rust//rust/platform:i686-linux-android": [],
+        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
+        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
+        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
+        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
+        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
+        "@rules_rust//rust/platform:wasm32-wasip1": [],
+        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
+        "@rules_rust//rust/platform:wasm32-wasip2": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-apple-ios": [],
+        "@rules_rust//rust/platform:x86_64-linux-android": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
+        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-none": [],
+        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.103.0",
+    deps = [
+        "@vendor_ts__bitflags-2.9.4//:bitflags",
+    ],
+)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-ir-0.104.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-ir-0.104.0.bazel
@@ -98,6 +98,6 @@ rust_library(
    }),
    version = "0.104.0",
    deps = [
-        "@vendor_ts__bitflags-2.11.1//:bitflags",
+        "@vendor_ts__bitflags-2.9.4//:bitflags",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-recursive-0.103.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-recursive-0.103.0.bazel
@@ -0,0 +1,106 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "chalk_recursive",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_root = "src/lib.rs",
+    edition = "2018",
+    proc_macro_deps = [
+        "@vendor_ts__chalk-derive-0.103.0//:chalk_derive",
+    ],
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=chalk-recursive",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
+        "@rules_rust//rust/platform:aarch64-linux-android": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
+        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
+        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
+        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:i686-apple-darwin": [],
+        "@rules_rust//rust/platform:i686-linux-android": [],
+        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
+        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
+        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
+        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
+        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
+        "@rules_rust//rust/platform:wasm32-wasip1": [],
+        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
+        "@rules_rust//rust/platform:wasm32-wasip2": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-apple-ios": [],
+        "@rules_rust//rust/platform:x86_64-linux-android": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
+        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-none": [],
+        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.103.0",
+    deps = [
+        "@vendor_ts__chalk-ir-0.103.0//:chalk_ir",
+        "@vendor_ts__chalk-solve-0.103.0//:chalk_solve",
+        "@vendor_ts__rustc-hash-1.1.0//:rustc_hash",
+        "@vendor_ts__tracing-0.1.41//:tracing",
+    ],
+)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-solve-0.103.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chalk-solve-0.103.0.bazel
@@ -0,0 +1,109 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "chalk_solve",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_root = "src/lib.rs",
+    edition = "2018",
+    proc_macro_deps = [
+        "@vendor_ts__chalk-derive-0.103.0//:chalk_derive",
+    ],
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=chalk-solve",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
+        "@rules_rust//rust/platform:aarch64-linux-android": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
+        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
+        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
+        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:i686-apple-darwin": [],
+        "@rules_rust//rust/platform:i686-linux-android": [],
+        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
+        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
+        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
+        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
+        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
+        "@rules_rust//rust/platform:wasm32-wasip1": [],
+        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
+        "@rules_rust//rust/platform:wasm32-wasip2": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-apple-ios": [],
+        "@rules_rust//rust/platform:x86_64-linux-android": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
+        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-none": [],
+        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.103.0",
+    deps = [
+        "@vendor_ts__chalk-ir-0.103.0//:chalk_ir",
+        "@vendor_ts__ena-0.14.3//:ena",
+        "@vendor_ts__indexmap-2.14.0//:indexmap",
+        "@vendor_ts__itertools-0.12.1//:itertools",
+        "@vendor_ts__petgraph-0.6.5//:petgraph",
+        "@vendor_ts__rustc-hash-1.1.0//:rustc_hash",
+        "@vendor_ts__tracing-0.1.41//:tracing",
+    ],
+)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chrono-0.4.42.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.chrono-0.4.42.bazel
@@ -108,104 +108,104 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.4.44",
+    version = "0.4.42",
    deps = [
        "@vendor_ts__num-traits-0.2.19//:num_traits",
        "@vendor_ts__serde-1.0.228//:serde",
    ] + select({
        "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # aarch64-apple-darwin
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # aarch64-apple-darwin
        ],
        "@rules_rust//rust/platform:aarch64-apple-ios": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # aarch64-apple-ios
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # aarch64-apple-ios
        ],
        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # aarch64-apple-ios-sim
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # aarch64-apple-ios-sim
        ],
        "@rules_rust//rust/platform:aarch64-linux-android": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # aarch64-linux-android
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # aarch64-linux-android
        ],
        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
-            "@vendor_ts__windows-link-0.2.1//:windows_link",  # aarch64-pc-windows-msvc
+            "@vendor_ts__windows-link-0.2.0//:windows_link",  # aarch64-pc-windows-msvc
        ],
        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # aarch64-unknown-fuchsia
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # aarch64-unknown-fuchsia
        ],
        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # aarch64-unknown-linux-gnu
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # aarch64-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # aarch64-unknown-linux-gnu, aarch64-unknown-nixos-gnu
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # aarch64-unknown-linux-gnu, aarch64-unknown-nixos-gnu
        ],
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # aarch64-unknown-nto-qnx710
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # aarch64-unknown-nto-qnx710
        ],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # arm-unknown-linux-gnueabi
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # arm-unknown-linux-gnueabi
        ],
        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # arm-unknown-linux-musleabi
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # arm-unknown-linux-musleabi
        ],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # armv7-linux-androideabi
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # armv7-linux-androideabi
        ],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # armv7-unknown-linux-gnueabi
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # armv7-unknown-linux-gnueabi
        ],
        "@rules_rust//rust/platform:i686-apple-darwin": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # i686-apple-darwin
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # i686-apple-darwin
        ],
        "@rules_rust//rust/platform:i686-linux-android": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # i686-linux-android
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # i686-linux-android
        ],
        "@rules_rust//rust/platform:i686-pc-windows-msvc": [
-            "@vendor_ts__windows-link-0.2.1//:windows_link",  # i686-pc-windows-msvc
+            "@vendor_ts__windows-link-0.2.0//:windows_link",  # i686-pc-windows-msvc
        ],
        "@rules_rust//rust/platform:i686-unknown-freebsd": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # i686-unknown-freebsd
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # i686-unknown-freebsd
        ],
        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # i686-unknown-linux-gnu
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # i686-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # powerpc-unknown-linux-gnu
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # powerpc-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # riscv64gc-unknown-linux-gnu
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # riscv64gc-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # s390x-unknown-linux-gnu
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # s390x-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # wasm32-unknown-emscripten
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # wasm32-unknown-emscripten
        ],
        "@rules_rust//rust/platform:wasm32-unknown-unknown": [
-            "@vendor_ts__js-sys-0.3.98//:js_sys",  # wasm32-unknown-unknown
-            "@vendor_ts__wasm-bindgen-0.2.121//:wasm_bindgen",  # wasm32-unknown-unknown
+            "@vendor_ts__js-sys-0.3.78//:js_sys",  # wasm32-unknown-unknown
+            "@vendor_ts__wasm-bindgen-0.2.101//:wasm_bindgen",  # wasm32-unknown-unknown
        ],
        "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # x86_64-apple-darwin
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # x86_64-apple-darwin
        ],
        "@rules_rust//rust/platform:x86_64-apple-ios": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # x86_64-apple-ios
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # x86_64-apple-ios
        ],
        "@rules_rust//rust/platform:x86_64-linux-android": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # x86_64-linux-android
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # x86_64-linux-android
        ],
        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@vendor_ts__windows-link-0.2.1//:windows_link",  # x86_64-pc-windows-msvc
+            "@vendor_ts__windows-link-0.2.0//:windows_link",  # x86_64-pc-windows-msvc
        ],
        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # x86_64-unknown-freebsd
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # x86_64-unknown-freebsd
        ],
        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # x86_64-unknown-fuchsia
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # x86_64-unknown-fuchsia
        ],
        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # x86_64-unknown-linux-gnu
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # x86_64-unknown-linux-gnu
        ],
        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [
-            "@vendor_ts__iana-time-zone-0.1.65//:iana_time_zone",  # x86_64-unknown-linux-gnu, x86_64-unknown-nixos-gnu
+            "@vendor_ts__iana-time-zone-0.1.63//:iana_time_zone",  # x86_64-unknown-linux-gnu, x86_64-unknown-nixos-gnu
        ],
        "//conditions:default": [],
    }),
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clang-sys-1.8.1.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clang-sys-1.8.1.bazel
@@ -118,7 +118,7 @@ rust_library(
    deps = [
        "@vendor_ts__clang-sys-1.8.1//:build_script_build",
        "@vendor_ts__glob-0.3.3//:glob",
-        "@vendor_ts__libc-0.2.186//:libc",
+        "@vendor_ts__libc-0.2.175//:libc",
        "@vendor_ts__libloading-0.8.9//:libloading",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clap-4.5.48.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clap-4.5.48.bazel
@@ -45,9 +45,9 @@ rust_library(
        "usage",
    ],
    crate_root = "src/lib.rs",
-    edition = "2024",
+    edition = "2021",
    proc_macro_deps = [
-        "@vendor_ts__clap_derive-4.6.1//:clap_derive",
+        "@vendor_ts__clap_derive-4.5.47//:clap_derive",
    ],
    rustc_env_files = [
        ":cargo_toml_env_vars",
@@ -106,8 +106,8 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "4.6.1",
+    version = "4.5.48",
    deps = [
-        "@vendor_ts__clap_builder-4.6.0//:clap_builder",
+        "@vendor_ts__clap_builder-4.5.48//:clap_builder",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clap_builder-4.5.48.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clap_builder-4.5.48.bazel
@@ -43,7 +43,7 @@ rust_library(
        "usage",
    ],
    crate_root = "src/lib.rs",
-    edition = "2024",
+    edition = "2021",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -101,11 +101,11 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "4.6.0",
+    version = "4.5.48",
    deps = [
-        "@vendor_ts__anstream-1.0.0//:anstream",
-        "@vendor_ts__anstyle-1.0.14//:anstyle",
-        "@vendor_ts__clap_lex-1.1.0//:clap_lex",
+        "@vendor_ts__anstream-0.6.20//:anstream",
+        "@vendor_ts__anstyle-1.0.11//:anstyle",
+        "@vendor_ts__clap_lex-0.7.5//:clap_lex",
        "@vendor_ts__strsim-0.11.1//:strsim",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clap_derive-4.5.47.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clap_derive-4.5.47.bazel
@@ -38,7 +38,7 @@ rust_proc_macro(
        "default",
    ],
    crate_root = "src/lib.rs",
-    edition = "2024",
+    edition = "2021",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -96,11 +96,11 @@ rust_proc_macro(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "4.6.1",
+    version = "4.5.47",
    deps = [
        "@vendor_ts__heck-0.5.0//:heck",
-        "@vendor_ts__proc-macro2-1.0.106//:proc_macro2",
-        "@vendor_ts__quote-1.0.45//:quote",
-        "@vendor_ts__syn-2.0.117//:syn",
+        "@vendor_ts__proc-macro2-1.0.101//:proc_macro2",
+        "@vendor_ts__quote-1.0.41//:quote",
+        "@vendor_ts__syn-2.0.106//:syn",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clap_lex-0.7.5.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.clap_lex-0.7.5.bazel
@@ -35,7 +35,7 @@ rust_library(
        ],
    ),
    crate_root = "src/lib.rs",
-    edition = "2024",
+    edition = "2021",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -93,5 +93,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.1.0",
+    version = "0.7.5",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.colorchoice-1.0.4.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.colorchoice-1.0.4.bazel
@@ -93,5 +93,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.0.5",
+    version = "1.0.4",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cov-mark-2.1.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cov-mark-2.1.0.bazel
@@ -97,5 +97,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "2.2.0",
+    version = "2.1.0",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cpufeatures-0.3.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.cpufeatures-0.3.0.bazel
@@ -1,118 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "cpufeatures",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2024",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=cpufeatures",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.3.0",
-    deps = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(target_arch = "aarch64", target_vendor = "apple"))
-        ],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(target_arch = "aarch64", target_vendor = "apple"))
-        ],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(target_arch = "aarch64", target_vendor = "apple"))
-        ],
-        "@rules_rust//rust/platform:aarch64-linux-android": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(target_arch = "aarch64", target_os = "android"))
-        ],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(target_arch = "aarch64", target_os = "linux"))
-        ],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(target_arch = "aarch64", target_os = "linux"))
-        ],
-        "//conditions:default": [],
-    }),
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.crc32fast-1.5.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.crc32fast-1.5.0.bazel
@@ -103,7 +103,7 @@ rust_library(
    }),
    version = "1.5.0",
    deps = [
-        "@vendor_ts__cfg-if-1.0.4//:cfg_if",
+        "@vendor_ts__cfg-if-1.0.3//:cfg_if",
        "@vendor_ts__crc32fast-1.5.0//:build_script_build",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.critical-section-1.2.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.critical-section-1.2.0.bazel
@@ -1,97 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "critical_section",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2018",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=critical-section",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "1.2.0",
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.darling-0.21.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.darling-0.21.3.bazel
@@ -41,7 +41,7 @@ rust_library(
    crate_root = "src/lib.rs",
    edition = "2021",
    proc_macro_deps = [
-        "@vendor_ts__darling_macro-0.23.0//:darling_macro",
+        "@vendor_ts__darling_macro-0.21.3//:darling_macro",
    ],
    rustc_env_files = [
        ":cargo_toml_env_vars",
@@ -100,8 +100,8 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.23.0",
+    version = "0.21.3",
    deps = [
-        "@vendor_ts__darling_core-0.23.0//:darling_core",
+        "@vendor_ts__darling_core-0.21.3//:darling_core",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.darling_core-0.21.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.darling_core-0.21.3.bazel
@@ -97,12 +97,13 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.23.0",
+    version = "0.21.3",
    deps = [
+        "@vendor_ts__fnv-1.0.7//:fnv",
        "@vendor_ts__ident_case-1.0.1//:ident_case",
-        "@vendor_ts__proc-macro2-1.0.106//:proc_macro2",
-        "@vendor_ts__quote-1.0.45//:quote",
+        "@vendor_ts__proc-macro2-1.0.101//:proc_macro2",
+        "@vendor_ts__quote-1.0.41//:quote",
        "@vendor_ts__strsim-0.11.1//:strsim",
-        "@vendor_ts__syn-2.0.117//:syn",
+        "@vendor_ts__syn-2.0.106//:syn",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.darling_macro-0.21.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.darling_macro-0.21.3.bazel
@@ -93,10 +93,10 @@ rust_proc_macro(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.23.0",
+    version = "0.21.3",
    deps = [
-        "@vendor_ts__darling_core-0.23.0//:darling_core",
-        "@vendor_ts__quote-1.0.45//:quote",
-        "@vendor_ts__syn-2.0.117//:syn",
+        "@vendor_ts__darling_core-0.21.3//:darling_core",
+        "@vendor_ts__quote-1.0.41//:quote",
+        "@vendor_ts__syn-2.0.106//:syn",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.dashmap-6.1.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.dashmap-6.1.0.bazel
@@ -99,11 +99,11 @@ rust_library(
    }),
    version = "6.1.0",
    deps = [
-        "@vendor_ts__cfg-if-1.0.4//:cfg_if",
+        "@vendor_ts__cfg-if-1.0.3//:cfg_if",
        "@vendor_ts__crossbeam-utils-0.8.21//:crossbeam_utils",
        "@vendor_ts__hashbrown-0.14.5//:hashbrown",
-        "@vendor_ts__lock_api-0.4.14//:lock_api",
-        "@vendor_ts__once_cell-1.21.4//:once_cell",
-        "@vendor_ts__parking_lot_core-0.9.12//:parking_lot_core",
+        "@vendor_ts__lock_api-0.4.13//:lock_api",
+        "@vendor_ts__once_cell-1.21.3//:once_cell",
+        "@vendor_ts__parking_lot_core-0.9.11//:parking_lot_core",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.deranged-0.5.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.deranged-0.5.3.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )

 rust_library(
-    name = "bs58",
+    name = "deranged",
    srcs = glob(
        include = ["**/*.rs"],
        allow_empty = True,
@@ -44,7 +44,7 @@ rust_library(
    ],
    tags = [
        "cargo-bazel",
-        "crate-name=bs58",
+        "crate-name=deranged",
        "manual",
        "noclippy",
        "norustfmt",
@@ -93,5 +93,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.5.1",
+    version = "0.5.3",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.derive-where-1.6.1.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.derive-where-1.6.1.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )

 rust_proc_macro(
-    name = "derive_where",
+    name = "displaydoc",
    srcs = glob(
        include = ["**/*.rs"],
        allow_empty = True,
@@ -44,7 +44,7 @@ rust_proc_macro(
    ],
    tags = [
        "cargo-bazel",
-        "crate-name=derive-where",
+        "crate-name=displaydoc",
        "manual",
        "noclippy",
        "norustfmt",
@@ -93,10 +93,10 @@ rust_proc_macro(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.6.1",
+    version = "0.2.5",
    deps = [
-        "@vendor_ts__proc-macro2-1.0.106//:proc_macro2",
-        "@vendor_ts__quote-1.0.45//:quote",
-        "@vendor_ts__syn-2.0.117//:syn",
+        "@vendor_ts__proc-macro2-1.0.101//:proc_macro2",
+        "@vendor_ts__quote-1.0.41//:quote",
+        "@vendor_ts__syn-2.0.106//:syn",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.dissimilar-1.0.11.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.dissimilar-1.0.11.bazel
@@ -1,97 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "dissimilar",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=dissimilar",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "1.0.11",
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.either-1.15.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.either-1.15.0.bazel
@@ -98,5 +98,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.16.0",
+    version = "1.15.0",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.embedded-io-0.4.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.embedded-io-0.4.0.bazel
@@ -1,97 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "embedded_io",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=embedded-io",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.4.0",
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.ena-0.14.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.ena-0.14.3.bazel
@@ -93,8 +93,8 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.14.4",
+    version = "0.14.3",
    deps = [
-        "@vendor_ts__log-0.4.29//:log",
+        "@vendor_ts__log-0.4.28//:log",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.erased-serde-0.4.6.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.erased-serde-0.4.6.bazel
@@ -0,0 +1,104 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "erased_serde",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "alloc",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=erased-serde",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
+        "@rules_rust//rust/platform:aarch64-linux-android": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
+        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
+        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
+        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:i686-apple-darwin": [],
+        "@rules_rust//rust/platform:i686-linux-android": [],
+        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
+        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
+        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
+        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
+        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
+        "@rules_rust//rust/platform:wasm32-wasip1": [],
+        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
+        "@rules_rust//rust/platform:wasm32-wasip2": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-apple-ios": [],
+        "@rules_rust//rust/platform:x86_64-linux-android": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
+        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-none": [],
+        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.4.6",
+    deps = [
+        "@vendor_ts__serde-1.0.228//:serde",
+        "@vendor_ts__typeid-1.0.3//:typeid",
+    ],
+)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.fixedbitset-0.4.2.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.fixedbitset-0.4.2.bazel
@@ -35,7 +35,7 @@ rust_library(
        ],
    ),
    crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2015",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -93,5 +93,5 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.5.7",
+    version = "0.4.2",
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.flate2-1.1.2.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.flate2-1.1.2.bazel
@@ -99,7 +99,7 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "1.1.9",
+    version = "1.1.2",
    deps = [
        "@vendor_ts__crc32fast-1.5.0//:crc32fast",
        "@vendor_ts__miniz_oxide-0.8.9//:miniz_oxide",
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.form_urlencoded-1.2.2.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.form_urlencoded-1.2.2.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )

 rust_library(
-    name = "futures_task",
+    name = "form_urlencoded",
    srcs = glob(
        include = ["**/*.rs"],
        allow_empty = True,
@@ -48,7 +48,7 @@ rust_library(
    ],
    tags = [
        "cargo-bazel",
-        "crate-name=futures-task",
+        "crate-name=form_urlencoded",
        "manual",
        "noclippy",
        "norustfmt",
@@ -97,5 +97,8 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.3.32",
+    version = "1.2.2",
+    deps = [
+        "@vendor_ts__percent-encoding-2.3.2//:percent_encoding",
+    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.fs-err-2.11.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.fs-err-2.11.0.bazel
@@ -97,9 +97,9 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "3.3.0",
+    version = "2.11.0",
    deps = [
-        "@vendor_ts__fs-err-3.3.0//:build_script_build",
+        "@vendor_ts__fs-err-2.11.0//:build_script_build",
    ],
 )

@@ -151,10 +151,10 @@ cargo_build_script(
        "noclippy",
        "norustfmt",
    ],
-    version = "3.3.0",
+    version = "2.11.0",
    visibility = ["//visibility:private"],
    deps = [
-        "@vendor_ts__autocfg-1.5.1//:autocfg",
+        "@vendor_ts__autocfg-1.5.0//:autocfg",
    ],
 )

--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.fsevent-sys-4.1.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.fsevent-sys-4.1.0.bazel
@@ -95,6 +95,6 @@ rust_library(
    }),
    version = "4.1.0",
    deps = [
-        "@vendor_ts__libc-0.2.186//:libc",
+        "@vendor_ts__libc-0.2.175//:libc",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.futures-util-0.3.32.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.futures-util-0.3.32.bazel
@@ -1,108 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "futures_util",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "alloc",
-        "slab",
-        "std",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2018",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=futures-util",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.3.32",
-    deps = [
-        "@vendor_ts__futures-core-0.3.32//:futures_core",
-        "@vendor_ts__futures-task-0.3.32//:futures_task",
-        "@vendor_ts__pin-project-lite-0.2.17//:pin_project_lite",
-        "@vendor_ts__slab-0.4.12//:slab",
-    ],
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.getrandom-0.3.3.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.getrandom-0.3.3.bazel
@@ -100,88 +100,88 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.3.4",
+    version = "0.3.3",
    deps = [
-        "@vendor_ts__cfg-if-1.0.4//:cfg_if",
-        "@vendor_ts__getrandom-0.3.4//:build_script_build",
+        "@vendor_ts__cfg-if-1.0.3//:cfg_if",
+        "@vendor_ts__getrandom-0.3.3//:build_script_build",
    ] + select({
        "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
        ],
        "@rules_rust//rust/platform:aarch64-apple-ios": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
        ],
        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
        ],
        "@rules_rust//rust/platform:aarch64-linux-android": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "haiku", target_os = "redox", target_os = "nto", target_os = "aix"))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "haiku", target_os = "redox", target_os = "nto", target_os = "aix"))
        ],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:i686-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
        ],
        "@rules_rust//rust/platform:i686-linux-android": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:i686-unknown-freebsd": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "hurd", target_os = "illumos", target_os = "cygwin", all(target_os = "horizon", target_arch = "arm")))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "hurd", target_os = "illumos", target_os = "cygwin", all(target_os = "horizon", target_arch = "arm")))
        ],
        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
        ],
        "@rules_rust//rust/platform:wasm32-wasip2": [
-            "@vendor_ts__wasip2-1.0.3-wasi-0.2.9//:wasip2",  # cfg(all(target_arch = "wasm32", target_os = "wasi", target_env = "p2"))
+            "@vendor_ts__wasi-0.14.5-wasi-0.2.4//:wasi",  # cfg(all(target_arch = "wasm32", target_os = "wasi", target_env = "p2"))
        ],
        "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
        ],
        "@rules_rust//rust/platform:x86_64-apple-ios": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
        ],
        "@rules_rust//rust/platform:x86_64-linux-android": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "hurd", target_os = "illumos", target_os = "cygwin", all(target_os = "horizon", target_arch = "arm")))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "hurd", target_os = "illumos", target_os = "cygwin", all(target_os = "horizon", target_arch = "arm")))
        ],
        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@vendor_ts__libc-0.2.175//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
        ],
        "//conditions:default": [],
    }),
@@ -238,7 +238,7 @@ cargo_build_script(
        "noclippy",
        "norustfmt",
    ],
-    version = "0.3.4",
+    version = "0.3.3",
    visibility = ["//visibility:private"],
 )

--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.getrandom-0.4.2.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.getrandom-0.4.2.bazel
@@ -1,252 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "getrandom",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "std",
-        "sys_rng",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2024",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=getrandom",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.4.2",
-    deps = [
-        "@vendor_ts__cfg-if-1.0.4//:cfg_if",
-        "@vendor_ts__getrandom-0.4.2//:build_script_build",
-        "@vendor_ts__rand_core-0.10.1//:rand_core",
-    ] + select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
-        ],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
-        ],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
-        ],
-        "@rules_rust//rust/platform:aarch64-linux-android": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "haiku", target_os = "redox", target_os = "nto", target_os = "aix"))
-        ],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:i686-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
-        ],
-        "@rules_rust//rust/platform:i686-linux-android": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "hurd", target_os = "illumos", target_os = "cygwin", all(target_os = "horizon", target_arch = "arm")))
-        ],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
-        ],
-        "@rules_rust//rust/platform:wasm32-wasip2": [
-            "@vendor_ts__wasip2-1.0.3-wasi-0.2.9//:wasip2",  # cfg(all(target_arch = "wasm32", target_os = "wasi", target_env = "p2"))
-        ],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
-        ],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "ios", target_os = "visionos", target_os = "watchos", target_os = "tvos"))
-        ],
-        "@rules_rust//rust/platform:x86_64-linux-android": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(any(target_os = "dragonfly", target_os = "freebsd", target_os = "hurd", target_os = "illumos", target_os = "cygwin", all(target_os = "horizon", target_arch = "arm")))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [
-            "@vendor_ts__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
-        ],
-        "//conditions:default": [],
-    }),
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "std",
-        "sys_rng",
-    ],
-    crate_name = "build_script_build",
-    crate_root = "build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2024",
-    pkg_name = "getrandom",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=getrandom",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "0.4.2",
-    visibility = ["//visibility:private"],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.globset-0.4.16.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.globset-0.4.16.bazel
@@ -39,7 +39,7 @@ rust_library(
        "log",
    ],
    crate_root = "src/lib.rs",
-    edition = "2024",
+    edition = "2021",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -97,12 +97,12 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.4.18",
+    version = "0.4.16",
    deps = [
-        "@vendor_ts__aho-corasick-1.1.4//:aho_corasick",
-        "@vendor_ts__bstr-1.12.1//:bstr",
-        "@vendor_ts__log-0.4.29//:log",
-        "@vendor_ts__regex-automata-0.4.14//:regex_automata",
-        "@vendor_ts__regex-syntax-0.8.10//:regex_syntax",
+        "@vendor_ts__aho-corasick-1.1.3//:aho_corasick",
+        "@vendor_ts__bstr-1.12.0//:bstr",
+        "@vendor_ts__log-0.4.28//:log",
+        "@vendor_ts__regex-automata-0.4.11//:regex_automata",
+        "@vendor_ts__regex-syntax-0.8.6//:regex_syntax",
    ],
 )
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.hash32-0.2.1.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.hash32-0.2.1.bazel
@@ -1,100 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "hash32",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2015",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=hash32",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.2.1",
-    deps = [
-        "@vendor_ts__byteorder-1.5.0//:byteorder",
-    ],
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.heapless-0.7.17.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.heapless-0.7.17.bazel
@@ -1,213 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "heapless",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "atomic-polyfill",
-        "cas",
-        "serde",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2018",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=heapless",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios": [],
-        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
-        "@rules_rust//rust/platform:aarch64-linux-android": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
-        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
-        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
-        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
-        "@rules_rust//rust/platform:i686-apple-darwin": [],
-        "@rules_rust//rust/platform:i686-linux-android": [],
-        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
-        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
-        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
-        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
-        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
-        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
-        "@rules_rust//rust/platform:wasm32-wasip1": [],
-        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
-        "@rules_rust//rust/platform:wasm32-wasip2": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [],
-        "@rules_rust//rust/platform:x86_64-linux-android": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.7.17",
-    deps = [
-        "@vendor_ts__hash32-0.2.1//:hash32",
-        "@vendor_ts__heapless-0.7.17//:build_script_build",
-        "@vendor_ts__serde-1.0.228//:serde",
-        "@vendor_ts__stable_deref_trait-1.2.1//:stable_deref_trait",
-    ] + select({
-        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [
-            "@vendor_ts__atomic-polyfill-1.0.3//:atomic_polyfill",  # riscv32imc-unknown-none-elf
-        ],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-apple-ios": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-linux-android": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-none": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-uefi": [
-            "@vendor_ts__spin-0.9.8//:spin",  # cfg(target_arch = "x86_64")
-        ],
-        "//conditions:default": [],
-    }),
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "atomic-polyfill",
-        "cas",
-        "serde",
-    ],
-    crate_name = "build_script_build",
-    crate_root = "build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2018",
-    pkg_name = "heapless",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=heapless",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "0.7.17",
-    visibility = ["//visibility:private"],
-    deps = [
-        "@vendor_ts__rustc_version-0.4.1//:rustc_version",
-    ],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.home-0.5.11.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.home-0.5.11.bazel
@@ -35,7 +35,7 @@ rust_library(
        ],
    ),
    crate_root = "src/lib.rs",
-    edition = "2024",
+    edition = "2021",
    rustc_env_files = [
        ":cargo_toml_env_vars",
    ],
@@ -93,16 +93,16 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.5.12",
+    version = "0.5.11",
    deps = select({
        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.59.0//:windows_sys",  # cfg(windows)
        ],
        "@rules_rust//rust/platform:i686-pc-windows-msvc": [
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.59.0//:windows_sys",  # cfg(windows)
        ],
        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@vendor_ts__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
+            "@vendor_ts__windows-sys-0.59.0//:windows_sys",  # cfg(windows)
        ],
        "//conditions:default": [],
    }),
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.iana-time-zone-0.1.63.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.iana-time-zone-0.1.63.bazel
@@ -96,7 +96,7 @@ rust_library(
        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
        "//conditions:default": ["@platforms//:incompatible"],
    }),
-    version = "0.1.65",
+    version = "0.1.63",
    deps = select({
        "@rules_rust//rust/platform:aarch64-apple-darwin": [
            "@vendor_ts__core-foundation-sys-0.8.7//:core_foundation_sys",  # cfg(target_vendor = "apple")
@@ -111,7 +111,7 @@ rust_library(
            "@vendor_ts__android_system_properties-0.1.5//:android_system_properties",  # cfg(target_os = "android")
        ],
        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
-            "@vendor_ts__windows-core-0.62.2//:windows_core",  # cfg(target_os = "windows")
+            "@vendor_ts__windows-core-0.61.2//:windows_core",  # cfg(target_os = "windows")
        ],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [
            "@vendor_ts__android_system_properties-0.1.5//:android_system_properties",  # cfg(target_os = "android")
@@ -123,12 +123,12 @@ rust_library(
            "@vendor_ts__android_system_properties-0.1.5//:android_system_properties",  # cfg(target_os = "android")
        ],
        "@rules_rust//rust/platform:i686-pc-windows-msvc": [
-            "@vendor_ts__windows-core-0.62.2//:windows_core",  # cfg(target_os = "windows")
+            "@vendor_ts__windows-core-0.61.2//:windows_core",  # cfg(target_os = "windows")
        ],
        "@rules_rust//rust/platform:wasm32-unknown-unknown": [
-            "@vendor_ts__js-sys-0.3.98//:js_sys",  # cfg(all(target_arch = "wasm32", target_os = "unknown"))
-            "@vendor_ts__log-0.4.29//:log",  # cfg(all(target_arch = "wasm32", target_os = "unknown"))
-            "@vendor_ts__wasm-bindgen-0.2.121//:wasm_bindgen",  # cfg(all(target_arch = "wasm32", target_os = "unknown"))
+            "@vendor_ts__js-sys-0.3.78//:js_sys",  # cfg(all(target_arch = "wasm32", target_os = "unknown"))
+            "@vendor_ts__log-0.4.28//:log",  # cfg(all(target_arch = "wasm32", target_os = "unknown"))
+            "@vendor_ts__wasm-bindgen-0.2.101//:wasm_bindgen",  # cfg(all(target_arch = "wasm32", target_os = "unknown"))
        ],
        "@rules_rust//rust/platform:x86_64-apple-darwin": [
            "@vendor_ts__core-foundation-sys-0.8.7//:core_foundation_sys",  # cfg(target_vendor = "apple")
@@ -140,7 +140,7 @@ rust_library(
            "@vendor_ts__android_system_properties-0.1.5//:android_system_properties",  # cfg(target_os = "android")
        ],
        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@vendor_ts__windows-core-0.62.2//:windows_core",  # cfg(target_os = "windows")
+            "@vendor_ts__windows-core-0.61.2//:windows_core",  # cfg(target_os = "windows")
        ],
        "//conditions:default": [],
    }),
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.iana-time-zone-haiku-0.1.2.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.iana-time-zone-haiku-0.1.2.bazel
@@ -154,7 +154,7 @@ cargo_build_script(
    version = "0.1.2",
    visibility = ["//visibility:private"],
    deps = [
-        "@vendor_ts__cc-1.2.62//:cc",
+        "@vendor_ts__cc-1.2.61//:cc",
    ],
 )

--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.icu_collections-2.0.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.icu_collections-2.0.0.bazel
@@ -0,0 +1,106 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "icu_collections",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    proc_macro_deps = [
+        "@vendor_ts__displaydoc-0.2.5//:displaydoc",
+    ],
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=icu_collections",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
+        "@rules_rust//rust/platform:aarch64-linux-android": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
+        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
+        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
+        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:i686-apple-darwin": [],
+        "@rules_rust//rust/platform:i686-linux-android": [],
+        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
+        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
+        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
+        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
+        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
+        "@rules_rust//rust/platform:wasm32-wasip1": [],
+        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
+        "@rules_rust//rust/platform:wasm32-wasip2": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-apple-ios": [],
+        "@rules_rust//rust/platform:x86_64-linux-android": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
+        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-none": [],
+        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "2.0.0",
+    deps = [
+        "@vendor_ts__potential_utf-0.1.3//:potential_utf",
+        "@vendor_ts__yoke-0.8.0//:yoke",
+        "@vendor_ts__zerofrom-0.1.6//:zerofrom",
+        "@vendor_ts__zerovec-0.11.4//:zerovec",
+    ],
+)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.icu_locale_core-2.0.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.icu_locale_core-2.0.0.bazel
@@ -0,0 +1,109 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "icu_locale_core",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "zerovec",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    proc_macro_deps = [
+        "@vendor_ts__displaydoc-0.2.5//:displaydoc",
+    ],
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=icu_locale_core",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
+        "@rules_rust//rust/platform:aarch64-linux-android": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
+        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
+        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
+        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:i686-apple-darwin": [],
+        "@rules_rust//rust/platform:i686-linux-android": [],
+        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
+        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
+        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
+        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
+        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
+        "@rules_rust//rust/platform:wasm32-wasip1": [],
+        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
+        "@rules_rust//rust/platform:wasm32-wasip2": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-apple-ios": [],
+        "@rules_rust//rust/platform:x86_64-linux-android": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
+        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-none": [],
+        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "2.0.0",
+    deps = [
+        "@vendor_ts__litemap-0.8.0//:litemap",
+        "@vendor_ts__tinystr-0.8.1//:tinystr",
+        "@vendor_ts__writeable-0.6.1//:writeable",
+        "@vendor_ts__zerovec-0.11.4//:zerovec",
+    ],
+)
--- a/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.icu_normalizer-2.0.0.bazel
+++ b/misc/bazel/3rdparty/tree_sitter_extractors_deps/BUILD.icu_normalizer-2.0.0.bazel
@@ -0,0 +1,110 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//misc/bazel/3rdparty:vendor_tree_sitter_extractors
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "icu_normalizer",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "compiled_data",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    proc_macro_deps = [
+        "@vendor_ts__displaydoc-0.2.5//:displaydoc",
+    ],
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=icu_normalizer",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios": [],
+        "@rules_rust//rust/platform:aarch64-apple-ios-sim": [],
+        "@rules_rust//rust/platform:aarch64-linux-android": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
+        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
+        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
+        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:i686-apple-darwin": [],
+        "@rules_rust//rust/platform:i686-linux-android": [],
+        "@rules_rust//rust/platform:i686-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:i686-unknown-freebsd": [],
+        "@rules_rust//rust/platform:i686-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:powerpc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv32imc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:riscv64gc-unknown-none-elf": [],
+        "@rules_rust//rust/platform:s390x-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:thumbv7em-none-eabi": [],
+        "@rules_rust//rust/platform:thumbv8m.main-none-eabi": [],
+        "@rules_rust//rust/platform:wasm32-unknown-emscripten": [],
+        "@rules_rust//rust/platform:wasm32-unknown-unknown": [],
+        "@rules_rust//rust/platform:wasm32-wasip1": [],
+        "@rules_rust//rust/platform:wasm32-wasip1-threads": [],
+        "@rules_rust//rust/platform:wasm32-wasip2": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-apple-ios": [],
+        "@rules_rust//rust/platform:x86_64-linux-android": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-freebsd": [],
+        "@rules_rust//rust/platform:x86_64-unknown-fuchsia": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-nixos-gnu": [],
+        "@rules_rust//rust/platform:x86_64-unknown-none": [],
+        "@rules_rust//rust/platform:x86_64-unknown-uefi": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "2.0.0",
+    deps = [
+        "@vendor_ts__icu_collections-2.0.0//:icu_collections",
+        "@vendor_ts__icu_normalizer_data-2.0.0//:icu_normalizer_data",
+        "@vendor_ts__icu_provider-2.0.0//:icu_provider",
+        "@vendor_ts__smallvec-1.15.1//:smallvec",
+        "@vendor_ts__zerovec-0.11.4//:zerovec",
+    ],
+)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Owen Mansel-Chan	7126b95b16	Add test with MISSING alerts	2026-06-11 07:22:17 +02:00
Asger F	b60bf8c79f	Merge pull request #21950 from tonghuaroot/experimental-ssrf-ipv6-transition-js Add experimental query: SSRF host guard missing IPv6-transition unwrap (CWE-918/CWE-1389)	2026-06-10 21:42:54 +02:00
tonghuaroot (童话)	4c1a0058bf	Add SsrfIpv6TransitionIncompleteGuard.ql to not_included_in_qls.expected Fix the JS integration test failure flagged in review by listing the new experimental CWE-918 query in the expected not-included-in-qls suite, in sorted order.	2026-06-10 08:42:42 +08:00
Tom Hvitved	f5919875b7	Merge pull request #21941 from hvitved/python/content-approx Python: Implement `ContentApprox`	2026-06-09 15:46:04 +02:00
Owen Mansel-Chan	8d456df26f	Merge pull request #21960 from github/dependabot/go_modules/go/extractor/extractor-dependencies-28a04969f3 Bump golang.org/x/mod from 0.36.0 to 0.37.0 in /go/extractor in the extractor-dependencies group	2026-06-09 05:30:45 +01:00
dependabot[bot]	72fcf27d1a	Bump golang.org/x/mod Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/mod](https://github.com/golang/mod). Updates `golang.org/x/mod` from 0.36.0 to 0.37.0 - [Commits](https://github.com/golang/mod/compare/v0.36.0...v0.37.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: extractor-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-09 03:03:37 +00:00
yoff	0cea01c22f	Merge pull request #21926 from github/yoff/python-simplify-decorator-predicates Python: simplify decorator-detection predicates to pure AST match	2026-06-08 22:04:33 +02:00
Anders Schack-Mulligen	a473565256	Merge pull request #21954 from aschackmull/cfg/consistency-child-idx Cfg: Add consistency check for relevant child indices.	2026-06-08 14:44:20 +02:00
Anders Schack-Mulligen	c47135a40b	Cfg: Add consistency check for relevant child indices.	2026-06-08 13:40:33 +02:00
Owen Mansel-Chan	3cbc8f0262	Merge pull request #21951 from github/workflow/go-version-update Go: Update to 1.26.4	2026-06-08 11:47:47 +01:00
Tom Hvitved	cc1ea25856	Python: Implement `ContentApprox`	2026-06-08 08:41:28 +02:00
github-actions[bot]	5a38cbd5d5	Go: Update to 1.26.4	2026-06-08 04:30:10 +00:00
tonghuaroot	e93bc11f6f	Add experimental JS query for SSRF guards missing IPv6-transition unwrap Add javascript/ssrf-ipv6-transition-incomplete-guard, an experimental @kind problem query that flags hand-rolled SSRF host guards which reject private/loopback IPv4 ranges but never unwrap IPv6-transition forms (IPv4-mapped ::ffff:, NAT64 64:ff9b::, 6to4 2002::). Such guards can be bypassed by wrapping an internal IPv4 address in a transition literal. Includes a .qhelp with good/bad examples, a change note, and a test pack with two true-positive fixtures (private-ip package guard and a hand-written RFC 1918 denylist) and two negative-control fixtures (ipaddr.js range classifier and an explicit ::ffff: unwrap). Signed-off-by: tonghuaroot <23011166+tonghuaroot@users.noreply.github.com>	2026-06-06 21:47:24 +08:00
Owen Mansel-Chan	cf6d94cf8a	Merge pull request #21324 from github/copilot/automate-go-version-updates-again Automate Go version updates via scheduled workflow	2026-06-06 03:03:03 +01:00
Owen Mansel-Chan	292fc8b777	Fix detection of failed text replacement I checked and the comment seems to be correct. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-06 02:52:21 +01:00
Owen Mansel-Chan	a1759d9834	Use --force-with-lease for slightly improved safety Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-06 02:51:36 +01:00
Owen Mansel-Chan	6b74874372	Minor improvement to PR text	2026-06-06 02:32:43 +01:00
copilot-swe-agent[bot]	ef29d22c75	Update Go version workflow to include patch numbers in messages	2026-06-06 01:03:44 +00:00
Owen Mansel-Chan	1f91f915c7	Merge pull request #21888 from owen-mc/py/remove-imprecise-container-steps Python: Remove imprecise container steps #2	2026-06-04 22:16:24 +01:00
Jon Janego	ba8eebe2b5	Merge pull request #21948 from github/codeql-spark-run-26974832191 Update changelog documentation site for codeql-cli-2.25.6	2026-06-04 14:55:17 -05:00
github-actions[bot]	dc1409e5f4	update codeql documentation	2026-06-04 19:36:45 +00:00
Mario Campos	284f42bb9e	Merge pull request #21945 from github/codeql-spark-run-26947645690 Update changelog documentation site for codeql-cli-2.25.6	2026-06-04 13:09:04 -05:00
Henry Mercer	2f3524de74	Merge branch 'rc/3.22' into codeql-spark-run-26947645690	2026-06-04 16:01:11 +01:00
github-actions[bot]	b32573b060	update codeql documentation	2026-06-04 14:57:38 +00:00
Owen Mansel-Chan	cd2398aeea	Merge pull request #21936 from github/workflow/coverage/update Update CSV framework coverage reports	2026-06-04 12:45:21 +01:00
Sotiris Dragonas	d6892eaf0d	Merge pull request #21900 from github/bazookamusic/range-analysis-bound-move-to-shared Bound.qll - Replace utility for range analysis duplicate across java and cs with shared file	2026-06-04 12:45:11 +02:00
BazookaMusic	d2972cb53f	Add back alias for module	2026-06-04 11:08:49 +02:00
github-actions[bot]	5576d30780	Add changed framework coverage reports	2026-06-04 01:04:50 +00:00
Owen Mansel-Chan	da999ee440	Address review comments	2026-06-03 21:24:16 +01:00
Tom Hvitved	3da195f50f	Merge pull request #21918 from hvitved/rust/expose-resolution Rust: Add `Impl::getSelf()` and `Impl::getTrait()`	2026-06-03 20:18:05 +02:00
Henry Mercer	93a4b427e3	Merge pull request #21933 from github/post-release-prep/codeql-cli-2.25.6 Post-release preparation for codeql-cli-2.25.6	2026-06-03 16:57:48 +01:00
BazookaMusic	f34275636c	No duplicate Ssa and remove release changenot	2026-06-03 11:54:24 +02:00
BazookaMusic	0a801440b9	review comments	2026-06-03 10:48:50 +02:00
Owen Mansel-Chan	6f2cc43f32	Remove imprecise model for `tuple()`	2026-06-02 21:59:48 +01:00
Owen Mansel-Chan	5042fdee84	Remove imprecise model for `list()`	2026-06-02 21:59:46 +01:00
Owen Mansel-Chan	04341c47bd	Tweak model for str.join	2026-06-02 21:59:44 +01:00
Tom Hvitved	af45e53e77	Rust: Rename parameter in DB upgrade script	2026-06-02 21:18:53 +02:00
Owen Mansel-Chan	b27d08ee32	Update edges in expected test output	2026-06-02 18:29:56 +01:00
Owen Mansel-Chan	20ce679d61	Accept changed edges in test output No changes to alerts	2026-06-02 16:15:08 +01:00
Owen Mansel-Chan	f62ebef9e0	Adjust expected test output	2026-06-02 16:15:06 +01:00
Owen Mansel-Chan	c3ef1ddd64	Add MaD models for lxml and xml etree.fromstringlist	2026-06-02 16:15:01 +01:00
Owen Mansel-Chan	dede5bc49b	Track flow through `tuple()` with list with tainted elements	2026-06-02 16:14:59 +01:00
Owen Mansel-Chan	ad97b6dd64	Use access path for `str.join` model	2026-06-02 16:14:56 +01:00
Sotiris Dragonas	61a5cece56	Merge branch 'main' into bazookamusic/range-analysis-bound-move-to-shared	2026-06-02 10:41:49 +02:00
BazookaMusic	566a92e555	formatting again	2026-06-02 10:41:10 +02:00
BazookaMusic	2a3cff382c	more specific comment	2026-06-01 18:20:50 +02:00
BazookaMusic	c610af88d3	fix comment and add overlay[local?]	2026-06-01 18:18:37 +02:00
BazookaMusic	fa63dad1d1	change note	2026-06-01 18:16:51 +02:00
Sotiris Dragonas	019a5c01ad	Merge branch 'main' into bazookamusic/range-analysis-bound-move-to-shared	2026-06-01 18:10:02 +02:00
yoff	5fb75ac987	Python: simplify decorator-detection predicates to pure AST match The internal predicates that identify `@staticmethod`, `@classmethod` and `@property` decorators previously required the decorator's `NameNode` to satisfy `isGlobal()` (i.e. no SSA def reaches the decorator's name use). That filter was correct but unnecessarily indirect: these three names are builtins, and even when a class body redefines one, the class body has not started executing at the decorator position, so Python uses the builtin. Match the decorator's AST `Name` directly instead, dropping the CFG/SSA detour. The slight semantic change — `isGlobal()` would have rejected module-level shadowing of these builtins — is negligible in practice and explicitly documented in the change note. `hasContextmanagerDecorator` and `hasOverloadDecorator` keep the `NameNode.isGlobal()` check because their target names (`contextmanager`, `overload`) are imported, not builtin, and local shadowing is a real concern. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-01 14:04:43 +00:00
BazookaMusic	c1c9287535	restore file header	2026-06-01 15:48:26 +02:00
BazookaMusic	d1226b71de	formatting	2026-06-01 15:46:52 +02:00
BazookaMusic	71a363545a	formatting	2026-06-01 15:24:06 +02:00
Tom Hvitved	62207f152c	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-01 13:55:22 +02:00
Tom Hvitved	d5f94475b5	Rust: DB upgrade/downgrade scripts	2026-06-01 10:38:10 +02:00
Tom Hvitved	00e95a0757	Rust: Add `Impl::getSelf()` and `Impl::getTrait()`	2026-06-01 10:38:09 +02:00
Tom Hvitved	c695c151ea	Rust: Rename `Impl::getTrait` to `Impl::getTraitTy`	2026-06-01 10:38:07 +02:00
Owen Mansel-Chan	b38440490a	Address review comment	2026-05-31 21:47:44 +01:00
Owen Mansel-Chan	aee33a0cc9	Add missing code for `TAnyTupleOrDictionaryElement`	2026-05-29 10:26:24 +01:00
Owen Mansel-Chan	df15a719cb	Add a `ContentSet` for any tuple or dictionary element	2026-05-28 16:48:23 +01:00
Owen Mansel-Chan	812e8e6b34	Add change note	2026-05-28 11:37:54 +01:00
Owen Mansel-Chan	80c6f082d1	Fix TODO in `containerStep`	2026-05-28 11:34:02 +01:00
BazookaMusic	cc12740c0e	remove check for files in sync	2026-05-27 17:41:44 +02:00
BazookaMusic	acb5c0e70f	missed changes	2026-05-27 17:23:45 +02:00
BazookaMusic	6042adebae	move identical java and cs bound.qll to shared library	2026-05-27 17:23:28 +02:00
Owen Mansel-Chan	ec13e1bcd3	Add wildcard `ContentSet`s to avoid performance problems	2026-05-27 15:28:07 +01:00
Owen Mansel-Chan	e8779295ee	Update test results	2026-05-22 11:43:18 +01:00
Rasmus Lerchedahl Petersen	fa758d6bf5	python: fix test	2026-05-21 16:59:19 +01:00
Rasmus Lerchedahl Petersen	fa9426c749	Python: extra tests for comprehension	2026-05-21 16:59:18 +01:00
Rasmus Lerchedahl Petersen	0ecca91dea	Python: typo	2026-05-21 16:59:16 +01:00
Rasmus Lerchedahl Petersen	f669a4f3bf	Python: Make sure all imprecise taint bubbles up	2026-05-21 16:59:14 +01:00
Rasmus Lerchedahl Petersen	3275c814bd	Python: reset test expectations	2026-05-21 16:59:11 +01:00
Rasmus Lerchedahl Petersen	9a180036a5	Python: conversion step for `format_map` and adjust collection test	2026-05-21 16:59:08 +01:00
Rasmus Lerchedahl Petersen	93e7ab52b7	Python: adjust test expectations We now find an alert on this line as we hope to It is not an alert for _full_ SSRF, though, since that configuration cannot handle multiple substitutions.	2026-05-21 16:58:51 +01:00
Rasmus Lerchedahl Petersen	facb3b681d	Python: recover taint for % format strings	2026-05-21 16:57:50 +01:00
Rasmus Lerchedahl Petersen	b67694b2ab	Python: Remove imprecise container steps - remove `tupleStoreStep` and `dictStoreStep` from `containerStep` These are imprecise compared to the content being precise. - add implicit reads to recover taint at sinks - add implicit read steps for decoders to supplement the `AdditionalTaintStep` that now only covers when the full container is tainted.	2026-05-21 16:57:44 +01:00
Owen Mansel-Chan	a367294c23	Merge branch 'main' into copilot/automate-go-version-updates-again	2026-04-23 14:41:46 +01:00
copilot-swe-agent[bot]	b6004045bd	Clean up Go version workflow - remove unnecessary escaping and checks Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:23:44 +00:00
copilot-swe-agent[bot]	cc7e03b0f5	Add error handling and validation to Go version workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:22:36 +00:00
copilot-swe-agent[bot]	1cbd423251	Improve portability and fix PR detection in Go version workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:21:13 +00:00
copilot-swe-agent[bot]	437244fe90	Fix portability issues in Go version update workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:19:56 +00:00
copilot-swe-agent[bot]	f7cf24d1f9	Add Go version update workflow Co-authored-by: mbg <278086+mbg@users.noreply.github.com>	2026-02-13 11:17:57 +00:00
copilot-swe-agent[bot]	c3bafacf81	Initial plan	2026-02-13 11:15:15 +00:00
				`@@ -0,0 +1 @@`
				`experimental/Security/CWE-918/SsrfIpv6TransitionIncompleteGuard.ql`