build(deps): bump the vivisect group with 3 updates

Bumps the vivisect group with 3 updates: [msgpack](https://github.com/msgpack/msgpack-python), [pyasn1](https://github.com/pyasn1/pyasn1) and [pyasn1-modules](https://github.com/pyasn1/pyasn1-modules).


Updates `msgpack` from 1.0.8 to 1.1.2
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/ChangeLog.rst)
- [Commits](https://github.com/msgpack/msgpack-python/compare/v1.0.8...v1.1.2)

Updates `pyasn1` from 0.5.1 to 0.6.2
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](https://github.com/pyasn1/pyasn1/compare/v0.5.1...v0.6.2)

Updates `pyasn1-modules` from 0.3.0 to 0.4.2
- [Release notes](https://github.com/pyasn1/pyasn1-modules/releases)
- [Changelog](https://github.com/pyasn1/pyasn1-modules/blob/main/CHANGES.txt)
- [Commits](https://github.com/pyasn1/pyasn1-modules/compare/v0.3.0...v0.4.2)

---
updated-dependencies:
- dependency-name: msgpack
  dependency-version: 1.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: vivisect
- dependency-name: pyasn1
  dependency-version: 0.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: vivisect
- dependency-name: pyasn1-modules
  dependency-version: 0.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: vivisect
...

Signed-off-by: dependabot[bot] <support@github.com>

CHANGELOG.md

@@ -9,7 +9,7 @@
 
 ### Breaking Changes
 
-### New Rules (25)
+### New Rules (23)
 
 - nursery/run-as-nodejs-native-module mehunhoff@google.com
 - nursery/inject-shellcode-using-thread-pool-work-insertion-with-tp_io still@teamt5.org
@@ -34,8 +34,6 @@
 - host-interaction/process/create/create-process-in-dotnet moritz.raabe@mandiant.com social.tarang@gmail.com
 - nursery/read-file-in-dotnet moritz.raabe@mandiant.com anushka.virgaonkar@mandiant.com
 - nursery/write-file-in-dotnet william.ballenthin@mandiant.com anushka.virgaonkar@mandiant.com
-- nursery/escalate-privileges-via-commit_creds-on-linux aryanyk
-- nursery/register-netfilter-hook-on-linux aryanyk
 -
 
 ### Bug Fixes

pyproject.toml

@@ -150,7 +150,7 @@ dev = [
     "mypy==1.19.1",
     "mypy-protobuf==5.0.0",
     "PyGithub==2.8.1",
-    "bump-my-version==1.3.0",
+    "bump-my-version==1.2.4",
     # type stubs for mypy
     "types-backports==0.1.3",
     "types-colorama==0.4.15.11",
@@ -158,7 +158,7 @@ dev = [
     "types-psutil==7.2.0.20251228",
     "types_requests==2.32.0.20240712",
     "types-protobuf==6.32.1.20250918",
-    "deptry==0.25.1"
+    "deptry==0.24.0"
 ]
 build = [
     # Dev and build dependencies are not relaxed because

requirements.txt

@@ -18,13 +18,13 @@ ida-settings==3.2.2
 intervaltree==3.2.1
 markdown-it-py==4.0.0
 mdurl==0.1.2
-msgpack==1.0.8
+msgpack==1.1.2
 networkx==3.4.2
 pefile==2024.8.26
 pip==26.0
 protobuf==7.34.0
-pyasn1==0.5.1
-pyasn1-modules==0.3.0
+pyasn1==0.6.3
+pyasn1-modules==0.4.2
 pycparser==3.0
 pydantic==2.12.4
 # pydantic pins pydantic-core, 
@@ -46,4 +46,4 @@ sortedcontainers==2.4.0
 viv-utils==0.8.0
 vivisect==1.3.0
 msgspec==0.20.0
-bump-my-version==1.3.0
+bump-my-version==1.2.4

tests/test_match.py

@@ -46,7 +46,8 @@ def match(rules, features, va, scope=Scope.FUNCTION):
 
 
 def test_match_simple():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -56,7 +57,8 @@ def test_match_simple():
                 namespace: testns1/testns2
             features:
                 - number: 100
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     features, matches = match([r], {capa.features.insn.Number(100): {1, 2}}, 0x0)
@@ -67,7 +69,8 @@ def test_match_simple():
 
 
 def test_match_range_exact():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -76,7 +79,8 @@ def test_match_range_exact():
                     dynamic: process
             features:
                 - count(number(100)): 2
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     # just enough matches
@@ -93,7 +97,8 @@ def test_match_range_exact():
 
 
 def test_match_range_range():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
          rule:
              meta:
                 name: test rule
@@ -102,7 +107,8 @@ def test_match_range_range():
                     dynamic: process
              features:
                  - count(number(100)): (2, 3)
-         """)
+         """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     # just enough matches
@@ -123,7 +129,8 @@ def test_match_range_range():
 
 
 def test_match_range_exact_zero():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -139,7 +146,8 @@ def test_match_range_exact_zero():
                     # so we have this additional trivial feature.
                     - mnemonic: mov
 
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     # feature isn't indexed - good.
@@ -157,7 +165,8 @@ def test_match_range_exact_zero():
 
 
 def test_match_range_with_zero():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
          rule:
              meta:
                 name: test rule
@@ -172,7 +181,8 @@ def test_match_range_with_zero():
                     # since we don't support top level NOT statements.
                     # so we have this additional trivial feature.
                     - mnemonic: mov
-         """)
+         """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     # ok
@@ -190,7 +200,8 @@ def test_match_range_with_zero():
 
 def test_match_adds_matched_rule_feature():
     """show that using `match` adds a feature for matched rules."""
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -199,7 +210,8 @@ def test_match_adds_matched_rule_feature():
                     dynamic: process
             features:
                 - number: 100
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
     features, _ = match([r], {capa.features.insn.Number(100): {1}}, 0x0)
     assert capa.features.common.MatchedRule("test rule") in features
@@ -208,7 +220,9 @@ def test_match_adds_matched_rule_feature():
 def test_match_matched_rules():
     """show that using `match` adds a feature for matched rules."""
     rules = [
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: test rule1
@@ -217,8 +231,12 @@ def test_match_matched_rules():
                             dynamic: process
                     features:
                         - number: 100
-                """)),
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+                """
+            )
+        ),
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: test rule2
@@ -227,7 +245,9 @@ def test_match_matched_rules():
                             dynamic: process
                     features:
                         - match: test rule1
-                """)),
+                """
+            )
+        ),
     ]
 
     features, _ = match(
@@ -251,7 +271,9 @@ def test_match_matched_rules():
 
 def test_match_namespace():
     rules = [
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: CreateFile API
@@ -261,8 +283,12 @@ def test_match_namespace():
                         namespace: file/create/CreateFile
                     features:
                         - api: CreateFile
-                """)),
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+                """
+            )
+        ),
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: WriteFile API
@@ -272,8 +298,12 @@ def test_match_namespace():
                         namespace: file/write
                     features:
                         - api: WriteFile
-                """)),
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+                """
+            )
+        ),
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: file-create
@@ -282,8 +312,12 @@ def test_match_namespace():
                             dynamic: process
                     features:
                         - match: file/create
-                """)),
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+                """
+            )
+        ),
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: filesystem-any
@@ -292,7 +326,9 @@ def test_match_namespace():
                             dynamic: process
                     features:
                         - match: file
-                """)),
+                """
+            )
+        ),
     ]
 
     features, matches = match(
@@ -319,7 +355,9 @@ def test_match_namespace():
 
 def test_match_substring():
     rules = [
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: test rule
@@ -329,7 +367,9 @@ def test_match_substring():
                     features:
                         - and:
                             - substring: abc
-                """)),
+                """
+            )
+        ),
     ]
     features, _ = match(
         capa.rules.topologically_order_rules(rules),
@@ -369,7 +409,9 @@ def test_match_substring():
 
 def test_match_regex():
     rules = [
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: test rule
@@ -379,8 +421,12 @@ def test_match_regex():
                     features:
                         - and:
                             - string: /.*bbbb.*/
-                """)),
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+                """
+            )
+        ),
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: rule with implied wildcards
@@ -390,8 +436,12 @@ def test_match_regex():
                     features:
                         - and:
                             - string: /bbbb/
-                """)),
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+                """
+            )
+        ),
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: rule with anchor
@@ -401,7 +451,9 @@ def test_match_regex():
                     features:
                         - and:
                             - string: /^bbbb/
-                """)),
+                """
+            )
+        ),
     ]
     features, _ = match(
         capa.rules.topologically_order_rules(rules),
@@ -436,7 +488,9 @@ def test_match_regex():
 
 def test_match_regex_ignorecase():
     rules = [
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: test rule
@@ -446,7 +500,9 @@ def test_match_regex_ignorecase():
                     features:
                         - and:
                             - string: /.*bbbb.*/i
-                """)),
+                """
+            )
+        ),
     ]
     features, _ = match(
         capa.rules.topologically_order_rules(rules),
@@ -458,7 +514,9 @@ def test_match_regex_ignorecase():
 
 def test_match_regex_complex():
     rules = [
-        capa.rules.Rule.from_yaml(textwrap.dedent(r"""
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                r"""
                 rule:
                     meta:
                         name: test rule
@@ -468,7 +526,9 @@ def test_match_regex_complex():
                     features:
                         - or:
                             - string: /.*HARDWARE\\Key\\key with spaces\\.*/i
-                """)),
+                """
+            )
+        ),
     ]
     features, _ = match(
         capa.rules.topologically_order_rules(rules),
@@ -480,7 +540,9 @@ def test_match_regex_complex():
 
 def test_match_regex_values_always_string():
     rules = [
-        capa.rules.Rule.from_yaml(textwrap.dedent("""
+        capa.rules.Rule.from_yaml(
+            textwrap.dedent(
+                """
                 rule:
                     meta:
                         name: test rule
@@ -491,7 +553,9 @@ def test_match_regex_values_always_string():
                         - or:
                             - string: /123/
                             - string: /0x123/
-                """)),
+                """
+            )
+        ),
     ]
     features, _ = match(
         capa.rules.topologically_order_rules(rules),
@@ -523,7 +587,8 @@ def test_regex_get_value_str(pattern):
 
 @pytest.mark.xfail(reason="can't have top level NOT")
 def test_match_only_not():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -534,7 +599,8 @@ def test_match_only_not():
             features:
                 - not:
                     - number: 99
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     _, matches = match([r], {capa.features.insn.Number(100): {1, 2}}, 0x0)
@@ -542,7 +608,8 @@ def test_match_only_not():
 
 
 def test_match_not():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -555,7 +622,8 @@ def test_match_not():
                     - mnemonic: mov
                     - not:
                         - number: 99
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     _, matches = match([r], {capa.features.insn.Number(100): {1, 2}, capa.features.insn.Mnemonic("mov"): {1, 2}}, 0x0)
@@ -564,7 +632,8 @@ def test_match_not():
 
 @pytest.mark.xfail(reason="can't have nested NOT")
 def test_match_not_not():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -576,7 +645,8 @@ def test_match_not_not():
                 - not:
                     - not:
                         - number: 100
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     _, matches = match([r], {capa.features.insn.Number(100): {1, 2}}, 0x0)
@@ -584,7 +654,8 @@ def test_match_not_not():
 
 
 def test_match_operand_number():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -594,7 +665,8 @@ def test_match_operand_number():
             features:
                 - and:
                     - operand[0].number: 0x10
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     assert capa.features.insn.OperandNumber(0, 0x10) in {capa.features.insn.OperandNumber(0, 0x10)}
@@ -612,7 +684,8 @@ def test_match_operand_number():
 
 
 def test_match_operand_offset():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -622,7 +695,8 @@ def test_match_operand_offset():
             features:
                 - and:
                     - operand[0].offset: 0x10
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     assert capa.features.insn.OperandOffset(0, 0x10) in {capa.features.insn.OperandOffset(0, 0x10)}
@@ -640,7 +714,8 @@ def test_match_operand_offset():
 
 
 def test_match_property_access():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -650,7 +725,8 @@ def test_match_property_access():
             features:
                 - and:
                     - property/read: System.IO.FileInfo::Length
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     assert capa.features.insn.Property("System.IO.FileInfo::Length", capa.features.common.FeatureAccess.READ) in {
@@ -682,7 +758,8 @@ def test_match_property_access():
 
 
 def test_match_os_any():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -700,7 +777,8 @@ def test_match_os_any():
                     - and:
                         - os: any
                         - string: "Goodbye world"
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
 
     _, matches = match(
@@ -734,7 +812,8 @@ def test_match_os_any():
 
 # this test demonstrates the behavior of unstable features that may change before the next major release.
 def test_index_features_and_unstable():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -745,7 +824,8 @@ def test_index_features_and_unstable():
                 - and:
                     - mnemonic: mov
                     - api: CreateFileW
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
     rr = capa.rules.RuleSet([r])
     index: capa.rules.RuleSet._RuleFeatureIndex = rr._feature_indexes_by_scopes[capa.rules.Scope.FUNCTION]
@@ -761,7 +841,8 @@ def test_index_features_and_unstable():
 
 # this test demonstrates the behavior of unstable features that may change before the next major release.
 def test_index_features_or_unstable():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -772,7 +853,8 @@ def test_index_features_or_unstable():
                 - or:
                     - mnemonic: mov
                     - api: CreateFileW
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
     rr = capa.rules.RuleSet([r])
     index: capa.rules.RuleSet._RuleFeatureIndex = rr._feature_indexes_by_scopes[capa.rules.Scope.FUNCTION]
@@ -789,7 +871,8 @@ def test_index_features_or_unstable():
 
 # this test demonstrates the behavior of unstable features that may change before the next major release.
 def test_index_features_nested_unstable():
-    rule = textwrap.dedent("""
+    rule = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test rule
@@ -802,7 +885,8 @@ def test_index_features_nested_unstable():
                     - or:
                         - api: CreateFileW
                         - string: foo
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule)
     rr = capa.rules.RuleSet([r])
     index: capa.rules.RuleSet._RuleFeatureIndex = rr._feature_indexes_by_scopes[capa.rules.Scope.FUNCTION]
@@ -820,7 +904,8 @@ def test_index_features_nested_unstable():
 
 def test_bytes_prefix_index_correctness():
     """Verify that the bytes prefix pre-filter preserves match behavior."""
-    rule_text = textwrap.dedent("""
+    rule_text = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test bytes prefix index
@@ -829,32 +914,35 @@ def test_bytes_prefix_index_correctness():
                     dynamic: process
             features:
                 - bytes: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule_text)
+    rr = capa.rules.RuleSet([r])
 
     # 16 nop bytes - exact match
     nop16 = b"\x90" * 16
-    _, matches = match([r], {capa.features.common.Bytes(nop16): {0x0}}, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, {capa.features.common.Bytes(nop16): {0x0}}, 0x0)
     assert "test bytes prefix index" in matches
 
     # 32 nop bytes - startswith match (first 16 bytes are nops)
     nop32 = b"\x90" * 32
-    _, matches = match([r], {capa.features.common.Bytes(nop32): {0x0}}, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, {capa.features.common.Bytes(nop32): {0x0}}, 0x0)
     assert "test bytes prefix index" in matches
 
     # Different bytes - should not match
     other = b"\x00" * 16
-    _, matches = match([r], {capa.features.common.Bytes(other): {0x0}}, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, {capa.features.common.Bytes(other): {0x0}}, 0x0)
     assert "test bytes prefix index" not in matches
 
     # Bytes shorter than pattern - should not match
     short = b"\x90" * 8
-    _, matches = match([r], {capa.features.common.Bytes(short): {0x0}}, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, {capa.features.common.Bytes(short): {0x0}}, 0x0)
     assert "test bytes prefix index" not in matches
 
 
 def test_bytes_prefix_index_collision():
-    rule_text = textwrap.dedent("""
+    rule_text = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test bytes prefix collision
@@ -863,19 +951,22 @@ def test_bytes_prefix_index_collision():
                     dynamic: process
             features:
                 - bytes: 41 42 43 44 45 46 47 48
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule_text)
+    rr = capa.rules.RuleSet([r])
 
     features = {
         capa.features.common.Bytes(b"ABCD1234"): {0x0},
         capa.features.common.Bytes(b"ABCDEFGHzz"): {0x1},
     }
-    _, matches = match([r], features, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, features, 0x0)
     assert "test bytes prefix collision" in matches
 
 
 def test_bytes_prefix_index_short_pattern_fallback():
-    rule_text = textwrap.dedent("""
+    rule_text = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test bytes short prefix fallback
@@ -884,19 +975,22 @@ def test_bytes_prefix_index_short_pattern_fallback():
                     dynamic: process
             features:
                 - bytes: 41 42 43
-        """)
+        """
+    )
     r = capa.rules.Rule.from_yaml(rule_text)
+    rr = capa.rules.RuleSet([r])
 
-    _, matches = match([r], {capa.features.common.Bytes(b"ABCDEF"): {0x0}}, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, {capa.features.common.Bytes(b"ABCDEF"): {0x0}}, 0x0)
     assert "test bytes short prefix fallback" in matches
 
-    _, matches = match([r], {capa.features.common.Bytes(b"XABCDEF"): {0x0}}, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, {capa.features.common.Bytes(b"XABCDEF"): {0x0}}, 0x0)
     assert "test bytes short prefix fallback" not in matches
 
 
 def test_bytes_prefix_index_mixed_short_and_long_patterns():
     """A rule with both a short (<4B) and a long (>=4B) bytes pattern exercises both code paths."""
-    short_rule_text = textwrap.dedent("""
+    short_rule_text = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test short pattern rule
@@ -905,8 +999,10 @@ def test_bytes_prefix_index_mixed_short_and_long_patterns():
                     dynamic: process
             features:
                 - bytes: AA BB
-        """)
-    long_rule_text = textwrap.dedent("""
+        """
+    )
+    long_rule_text = textwrap.dedent(
+        """
         rule:
             meta:
                 name: test long pattern rule
@@ -915,27 +1011,29 @@ def test_bytes_prefix_index_mixed_short_and_long_patterns():
                     dynamic: process
             features:
                 - bytes: CC DD EE FF 11 22 33 44
-        """)
+        """
+    )
     short_rule = capa.rules.Rule.from_yaml(short_rule_text)
     long_rule = capa.rules.Rule.from_yaml(long_rule_text)
+    rr = capa.rules.RuleSet([short_rule, long_rule])
 
     # Both rules match their respective extracted values.
     features = {
         capa.features.common.Bytes(b"\xaa\xbb\xcc"): {0x0},
         capa.features.common.Bytes(b"\xcc\xdd\xee\xff\x11\x22\x33\x44\x55"): {0x1},
     }
-    _, matches = match([short_rule, long_rule], features, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, features, 0x0)
     assert "test short pattern rule" in matches
     assert "test long pattern rule" in matches
 
     # Only the short rule matches when the long pattern is absent.
-    _, matches = match([short_rule, long_rule], {capa.features.common.Bytes(b"\xaa\xbb\xcc"): {0x0}}, 0x0)
+    _, matches = rr.match(capa.rules.Scope.FUNCTION, {capa.features.common.Bytes(b"\xaa\xbb\xcc"): {0x0}}, 0x0)
     assert "test short pattern rule" in matches
     assert "test long pattern rule" not in matches
 
     # Only the long rule matches when the short pattern is absent.
-    _, matches = match(
-        [short_rule, long_rule],
+    _, matches = rr.match(
+        capa.rules.Scope.FUNCTION,
         {capa.features.common.Bytes(b"\xcc\xdd\xee\xff\x11\x22\x33\x44"): {0x0}},
         0x0,
     )

web/explorer/package-lock.json

@@ -3171,9 +3171,9 @@
             "license": "ISC"
         },
         "node_modules/picomatch": {
-            "version": "2.3.2",
-            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-            "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+            "version": "2.3.1",
+            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+            "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -3751,9 +3751,9 @@
             }
         },
         "node_modules/tinyglobby/node_modules/picomatch": {
-            "version": "4.0.4",
-            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-            "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+            "version": "4.0.2",
+            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.2.tgz",
+            "integrity": "sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -4028,9 +4028,9 @@
             }
         },
         "node_modules/vite/node_modules/picomatch": {
-            "version": "4.0.4",
-            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-            "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+            "version": "4.0.2",
+            "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.2.tgz",
+            "integrity": "sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==",
             "dev": true,
             "license": "MIT",
             "engines": {