From 609661c4c1b2bb51251a0c6277a66355e5bce874 Mon Sep 17 00:00:00 2001
From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com>
Date: Thu, 27 Aug 2026 17:15:11 -0700
Subject: [PATCH 1/2] bump rusty_alloc-api to =1.1.4

---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index c3f1ece..c7f71dd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -24,4 +24,4 @@ secure = ["rusty_alloc-api/secure"]
 
 [dependencies]
 # Pin exactly: rusty_alloc is 0.x and earlier releases had UAFs on all targets.
-rusty_alloc-api = { version = "=0.4.0" }
+rusty_alloc-api = { version = "=1.1.4" }

From 0221cbd8affa0085a3b4c3c900fd9fdb00229dd2 Mon Sep 17 00:00:00 2001
From: farmer_timmm <63073761+Ttimmahlax@users.noreply.github.com>
Date: Thu, 27 Aug 2026 17:15:13 -0700
Subject: [PATCH 2/2] add the shared portfolio check so a dependency bump can
 be gated on a real green

---
 .github/workflows/portfolio-check.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 .github/workflows/portfolio-check.yml

diff --git a/.github/workflows/portfolio-check.yml b/.github/workflows/portfolio-check.yml
new file mode 100644
index 0000000..5ea53fb
--- /dev/null
+++ b/.github/workflows/portfolio-check.yml
@@ -0,0 +1,19 @@
+# Portfolio check - calls the shared harness in Remade-With-Rust/.github.
+#
+# Managed by remade-updater. Edit the shared workflow, not this file: this exists
+# only so the run attaches to the pull request, where a merge can wait on it.
+
+name: portfolio-check
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: Remade-With-Rust/.github/.github/workflows/portfolio-test.yml@main
+    with:
+      command: test