[dependabot]

Bumps the github-actions group with 7 updates in the / directory:

Package	From	To
vmactions/freebsd-vm	1.5.7	1.5.9
vmactions/solaris-vm	1.4.0	1.4.2
lukka/get-cmake	4.4.2	4.4.4
msys2/setup-msys2	2.32.0	2.33.0
vapier/coverity-scan-action	1.9.0	1.10.0
release-drafter/release-drafter	7.7.0	7.10.0
taiki-e/install-action	2.87.15	2.87.31

Updates vmactions/freebsd-vm from 1.5.7 to 1.5.9

Release notes

Sourced from vmactions/freebsd-vm's releases.

v1.5.9

Optional key suffix for the cache-after-prepare cache

New input cache-after-prepare-key-suffix: an optional value that is appended as-is to the cache key of the image cached after prepare. Changing it discards that cache and runs prepare again, without editing prepare itself. Requested in vmactions/freebsd-vm#167

Usage

  - uses: actions/checkout@v7
  - uses: vmactions/freebsd-vm@v1
    with:
      cache-after-prepare: true
      cache-after-prepare-key-suffix: deps-${{ hashFiles('deps.sh') }}
      prepare: |
        sh deps.sh

• The input is optional and empty by default. Left out, every cache key stays the same as in v1.5.8, so existing caches stay valid.
• The prepare script and the sync method are still part of the key; the suffix is only added at the end.
• hashFiles() is evaluated on the runner, relative to the workspace, so check out first. It returns an empty string when no file matches, and the key then no longer follows the file.

Pins

BUILDER_VERSION 2.2.8 (unchanged) ANYVM_VERSION 0.7.2 (unchanged)

v1.5.8

FreeBSD on ubuntu-26.04 runners

The action's test matrix, 10.4, 11.4 and 13.2 - 15.1 across x86_64, aarch64, riscv64 and powerpc64, now runs on ubuntu-26.04 and ubuntu-26.04-arm: 313 of 314 jobs pass, and the 9p job is skipped as before. 12.4, which the matrix leaves out, passes anyvm's own FreeBSD CI on the same runners.

What failed on 26.04

With v1.5.7 on a 26.04 runner:

... (truncated)

Commits

• c46abac Update vmactions/freebsd-vm from base-vm
• 83496ce Generated from base-vm
• abc5072 Sync from base-builder
• c6d9b09 Update vmactions/freebsd-vm from base-vm
• 6d69158 Generated from base-vm
• d1c0bc5 Update version to v1.5.8
• 6f16425 Update vmactions/freebsd-vm from base-vm
• 6f0e5ed Generated from base-vm
• eec490e Update vmactions/freebsd-vm from base-vm
• 40859e1 Generated from base-vm
• Additional commits viewable in compare view

Updates vmactions/solaris-vm from 1.4.0 to 1.4.2

Release notes

Sourced from vmactions/solaris-vm's releases.

v1.4.2

Solaris: non-root users can write the nfs-synced folder

The runtime moves to anyvm 0.7.4, whose nfs fix is the reason for this release: https://github.com/anyvm-org/anyvm/releases/tag/v0.7.4 On ubuntu-26.04 runners 23 of 25 test jobs pass; the 9p and sshfs jobs are skipped as before.

Fixed: non-root users could not write the nfs share

vmactions/solaris-vm#70: with sync: nfs, a build run as an ordinary user created in the guest failed with "Permission denied", while the same workflow worked on FreeBSD. The nfs export mapped only guest root to the runner user; any other guest account kept its own uid and met the runner-owned workspace as "other". FreeBSD worked by coincidence: its first pw useradd hands out uid 1001, the GitHub runner's own uid. Solaris useradd hands out 1000.

anyvm 0.7.4 now maps every guest uid to the runner user: the kernel nfs export of a Linux runner gets all_squash, and on other hosts the user-space nfsd 0.1.1 runs with -all_squash. Files any guest user creates are owned by the runner user on the host, as files from guest root already were. Nothing to change in your workflow.

The test matrix now checks this on every release: a guest user with uid 4321 creates, appends to and renames a file in the share, and the runner checks its content and that the runner user owns it.

New input: cache-after-prepare-key-suffix

Optional, empty by default. A non-empty value is appended to the cache-after-prepare key, so changing it rebuilds the prepared image. Use it when prepare runs a script from your repository, which the key vmactions/freebsd-vm#167

cache-after-prepare-key-suffix: deps-${{ hashFiles('ci/deps.sh') }}

Existing prepared-image caches stay valid when the input is not set.

Pins

BUILDER_VERSION 2.0.8 (unchanged) ANYVM_VERSION 0.7.2 -> 0.7.4

v1.4.1

Solaris on ubuntu-26.04 runners

... (truncated)

Commits

• 1c16697 Update vmactions/solaris-vm from base-vm
• 27dc585 Generated from base-vm
• a1e7c0a Update vmactions/solaris-vm from base-vm
• df6a72e Generated from base-vm
• 3b4f00d Bump versions from upstream releases
• 02dfac6 Update vmactions/solaris-vm from base-vm
• 21fd16c Generated from base-vm
• 1ac891c Update vmactions/solaris-vm from base-vm
• dad0f22 Generated from base-vm
• 1b672bd Update version to v1.4.1
• Additional commits viewable in compare view

Updates lukka/get-cmake from 4.4.2 to 4.4.4

Changelog

Sourced from lukka/get-cmake's changelog.

Release Process for get-cmake

This document describes the release process for the get-cmake action after a new CMake or Ninja version has been merged to the main branch.

Overview

The get-cmake action uses two key reference points for users:

1. latest branch - Points to the most recent stable release
2. Version tags (e.g., vX.Y.Z or ninja-vX.Y.Z) - Allow users to pin to specific catalog snapshots

When a new stable CMake, CMake release candidate, or Ninja version is merged to main via automated PR, a release is performed automatically (or can be done manually). Release detection and notes use fixed rules, without an LLM.

Release formats and tag policy

The shared publisher, .github/scripts/publish-release.js, compares these version markers:

Component	Version marker	Title entry	Notes
Stable CMake	.latest_cmake_version	CMake vX.Y.Z	New latest CMake version and one-line action usage
CMake RC	.latestrc_cmake_version	CMake vX.Y.Z-rcN	New latestrc version and usage with cmakeVersion: latestrc
Ninja	.latest_ninja_version	Ninja vX.Y.Z	New Ninja version available through @latest

Combined updates produce one release: title entries are joined with and, and the notes contain a separate entry for each changed component. For example, CMake v3.29.5 and CMake v3.30.0-rc1 follows the historical combined format. RC-only notes follow the historical RC format, rather than claiming the default CMake version changed.

Tag selection is deterministic:

1. If stable CMake changed, use v<CMake version>.
2. Otherwise, if Ninja changed, use ninja-v<Ninja version>. This also applies to combined Ninja + RC updates and avoids reusing an unchanged stable CMake tag.
3. Otherwise, use v<CMake RC version> and mark the release as a GitHub prerelease.

Combined updates containing stable CMake or Ninja are not marked as prereleases. An RC marker that resolves to the stable CMake version is not announced as a separate RC update. Without changed markers or an explicit matching recovery tag, the publisher makes no release, tag, or latest branch changes.

Release titles and tagged catalog versions describe the release target. Usage notes for @latest and cmakeVersion: latestrc use the markers from current main, which is where the moving latest branch is synchronized. When recovering an older catalog, notes distinguish its versions from the versions currently selected by those aliases.

Release Steps

Option 1: Automatic Release (Recommended)

The auto-release.yml workflow automatically handles releases when version markers change on main, including merged automated tool version PRs:

1. When a push to main changes any of the three version markers
2. The workflow automatically:
   • Compares all three markers between the push's before and after commits
   • Generates the title, notes, tag, and prerelease status using the rules above
   • Updates the latest branch to match main
   • Creates an annotated version tag at the exact pushed commit (if it doesn't exist)
   • Publishes a GitHub release with the generated title and notes

Detection does not depend on PR titles and covers merge commits, squash merges, multi-commit rebase merges, and direct version updates on main. Using the push's exact commit range prevents a later merge from changing the versions announced by a queued release. The moving latest branch still tracks current main.

... (truncated)

Commits

• a89e43e New CMake version(s): cmake-v4.4.4
• e22dd04 Restrict catalog PR creation to main
• df5af53 Namespace the cache entries by a collision resistant digest
• d520f90 Prove that the CMake manifest does list every tracked asset
• 2bc13fd Feed the hasher explicitly instead of ending it as a pipeline destination
• a4ab8fe Fail catalog generation when a release publishes no checksum of its own
• 0661582 Namespace the cache key and reject unverifiable packages before any lookup
• 25048e9 Rebuild dist/
• e1ba19e Document the integrity verification of the downloaded archives
• f3fcbbb Fail the build when dist/ is out of sync with the sources
• Additional commits viewable in compare view

Updates msys2/setup-msys2 from 2.32.0 to 2.33.0

Release notes

Sourced from msys2/setup-msys2's releases.

v2.33.0

• Update base distribution to 20260927. [#657]
• Due to dependency cleanups "perl" and some related libraries are no longer installed by default.
• Add a deprecation warning for MINGW32/MINGW64. See the new suppress-deprecation-warnings option for how to silence them. [#644]
• pacboy caching fixes [#650]
• Update dependencies

Changelog

Sourced from msys2/setup-msys2's changelog.

Changelog

2.33.0

• Update base distribution to 20260927. [#657]
• Due to dependency cleanups "perl" and some related libraries are no longer installed by default.
• Add a deprecation warning for MINGW32/MINGW64. See the new suppress-deprecation-warnings option for how to silence them. [#644]
• pacboy caching fixes [#650]
• Update dependencies

2.32.0

• Update base distribution to 20260611. [#624]
• Port from ncc to rolldown for bundling
• Include an SBOM of the bundle
• Update dependencies

2.31.1

• input: allow empty input for "install" and "pacboy", meaning not packages will be installed [#589]
• input: deprecate the special "RUNNER_TEMP" value for "location" in favor of an empty string
• Update dependencies

2.31.0

• Update base distribution to 20260322. [#597]
• Update dependencies
• Move to node24 from node20

2.30.0

• Update base distribution to 20251213. [#565]
• Remove folder-hash dependency [#555]
• Update dependencies

2.29.0

• Allow installation to C:\msys64 if it doesn't exist already. Like with the new windows-11-arm image, for example. [#542]
• Update base distribution to 20250830. [#548]
• Update dependencies

2.28.0

• Update base distribution to 20250622. [#518]
• Update dependencies

2.27.0

... (truncated)

Commits

• ec48f7c v2.33.0 d34ca6fb9f66412423e0ade249ca8a35b3715726
• See full diff in compare view

Updates vapier/coverity-scan-action from 1.9.0 to 1.10.0

Release notes

Sourced from vapier/coverity-scan-action's releases.

Support coverity capture

What's Changed

• Support coverity capture for interpreted languages #18
• Support disabling cov-build for interpreted languages #18

Full Changelog: vapier/coverity-scan-action@v1.9.0...v1.10.0

Commits

• 8fe7b0a add support for capturing sources only #18
• See full diff in compare view

Updates release-drafter/release-drafter from 7.7.0 to 7.10.0

Release notes

Sourced from release-drafter/release-drafter's releases.

v7.10.0

What's Changed

New

• feat(check-pr): validate base and proposed configuration (#1809) @​jetersen
• feat(replacers): select PR body sections by heading (#1808) @​jetersen
• feat: scope replacers to change titles (#1805) @​jetersen
• feat: scope replacers to pull request bodies (#1804) @​jetersen
• feat: add change-body-escapes (#1797) @​jetersen

Dependency Updates

• chore(deps): update dependency knip to 6.39.0 (#1830) @​renovate[bot]
• chore(deps): update dependency @​biomejs/biome to 2.5.15 (#1829) @​renovate[bot]
• chore(deps): update vitest to 5.0.3 (#1827) @​renovate[bot]
• chore(deps): lock file maintenance (#1826) @​renovate[bot]
• fix(deps): update dependency @​octokit/plugin-paginate-rest to 16.0.0 (#1813) @​renovate[bot]
• chore(deps): update dependency @​graphql-codegen/typescript-operations to 6.1.9 (#1818) @​renovate[bot]
• chore(deps): update dependency testcontainers to 12.2.0 (#1812) @​renovate[bot]
• chore(deps): update graphql-codegen (#1810) @​renovate[bot]
• fix(deps): update dependency undici to 6.29.0 (#1796) @​renovate[bot]
• chore(deps): update dependency @​types/node to 24.19.0 (#1798) @​renovate[bot]
• chore(deps): update vitest to 5.0.2 (#1795) @​renovate[bot]

Maintenance

• fix: authorize publication at the original release commit (#1793) @​jetersen
• fix: handle missing release tags during discovery (#1792) @​jetersen
• fix: publish merged release PRs from main pushes (#1791) @​jetersen
• test: run GitLab conformance against GitLab CE 19.4.1 (#1825) @​jetersen
• test: use the GitLab image that caches Mustermann's encoded characters (#1824) @​jetersen
• ci: speed up forge conformance with a preseeded GitLab image (#1819) @​jetersen
• ci: run workflows on Ubuntu 26.04 and cache node_modules (#1823) @​jetersen
• test: expand coverage and reduce test runtime (#1794) @​jetersen
• ci: report actionlint findings on its workflow job (#1817) @​jetersen
• build: simplify tooling validation and coverage reporting (#1816) @​jetersen
• build: simplify workspace dependency checks (#1815) @​jetersen
• refactor: use runtime fetch in the public facade (#1800) @​jetersen
• test: allow dependency version updates in package consumer contract (#1799) @​jetersen

Documentation

• docs: simplify agent guidance and require the PR template (#1807) @​jetersen
• docs: summarize deployment options and add npm branding (#1802) @​jetersen

... (truncated)

Commits

• 978bb0b chore: release v7.10.0 (#1828)
• 7875ba4 chore(deps): update dependency knip to 6.39.0 (#1830)
• cab3fb0 chore(deps): update dependency @​biomejs/biome to 2.5.15 (#1829)
• eea1614 chore(deps): update vitest to 5.0.3 (#1827)
• c91bcd7 chore(deps): lock file maintenance (#1826)
• 9fece4e test: run GitLab conformance against GitLab CE 19.4.1 (#1825)
• f8732bf test: use the GitLab image that caches Mustermann's encoded characters (#1824)
• 20ee3a7 feat(check-pr): validate base and proposed configuration (#1809)
• 4248c85 fix(deps): update dependency @​octokit/plugin-paginate-rest to 16.0.0 (#1813)
• 988dde1 feat(replacers): select PR body sections by heading (#1808)
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.15 to 2.87.31

Release notes

Sourced from taiki-e/install-action's releases.

2.87.31

• Downgrade cargo-sort@latest to 2.1.3.

• Update vacuum@latest to 0.35.0.

• Update xh@latest to 0.26.3.

• Update uv@latest to 0.13.5.

• Update ubi@latest to 0.13.0.

• Update trivy@latest to 0.76.1.

• Update tombi@latest to 1.9.0.

• Update release-plz@latest to 0.3.174.

• Update prek@latest to 0.5.7.

• Update mise@latest to 2026.10.17.

• Update jaq@latest to 3.1.2.

• Update espup@latest to 0.17.1.

• Update cargo-zigbuild@latest to 0.24.0.

• Update cargo-nextest@latest to 0.9.149.

• Update biome@latest to 2.6.2.

2.87.30

• Update zizmor@latest to 1.31.1.

• Update wasmtime@latest to 50.0.0.

• Update vacuum@latest to 0.33.2.

• Update uv@latest to 0.13.4.

• Update trunk@latest to 0.22.0.

• Update tombi@latest to 1.8.9.

• Update syft@latest to 1.55.0.

• Update release-plz@latest to 0.3.173.

• Update prek@latest to 0.5.6.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.87.31] - 2026-10-23

• Downgrade cargo-sort@latest to 2.1.3.

• Update vacuum@latest to 0.35.0.

• Update xh@latest to 0.26.3.

• Update uv@latest to 0.13.5.

• Update ubi@latest to 0.13.0.

• Update trivy@latest to 0.76.1.

• Update tombi@latest to 1.9.0.

• Update release-plz@latest to 0.3.174.

• Update prek@latest to 0.5.7.

• Update mise@latest to 2026.10.17.

• Update jaq@latest to 3.1.2.

• Update espup@latest to 0.17.1.

• Update cargo-zigbuild@latest to 0.24.0.

• Update cargo-nextest@latest to 0.9.149.

• Update biome@latest to 2.6.2.

[2.87.30] - 2026-10-21

• Update zizmor@latest to 1.31.1.

• Update wasmtime@latest to 50.0.0.

... (truncated)

Commits

• 1e29709 Release 2.87.31
• 30fbbdf Update cargo-sort@latest to 2.1.3
• bce00a3 Update vacuum@latest to 0.35.0
• dce055e Update tombi manifest
• 28b8d62 Update release-plz manifest
• 44d13e3 Update mise manifest
• 510b77d Update xh@latest to 0.26.3
• 601130d Update vacuum manifest
• 8e70b88 Update uv@latest to 0.13.5
• 9092880 Update ubi@latest to 0.13.0
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
taiki-e/install-action	[< 2.63, > 2.62.12]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.