[dependabot]

Bumps the github-actions group with 6 updates in the / directory:

Package	From	To
dtolnay/rust-toolchain	2c7215f132e9ebf062739d9130488b56d53c060c	683b588c487a69d01f6c6ddf40f036ff682cc2c8
taiki-e/install-action	2.84.1	2.87.29
actions/upload-artifact	7.0.1	7.0.2
zizmorcore/zizmor-action	0.6.2	0.7.1
actions/download-artifact	8.0.1	8.0.2
actions/attest-build-provenance	4.1.1	4.2.2

Updates dtolnay/rust-toolchain from 2c7215f132e9ebf062739d9130488b56d53c060c to 683b588c487a69d01f6c6ddf40f036ff682cc2c8

Commits

• 683b588 Add 1.99.1 patch release
• e2a55d2 Merge pull request #187 from dtolnay/pwn
• 6af9a09 Unify flags[@] and downgrade[@]
• 83d0610 Safely handle action inputs
• 7e38f4b Merge pull request #186 from WaterWhisperer/feat/retry-install
• 7645b07 Retry release-server checksum failures
• 02cb101 Merge pull request 185 from fufesou/feat/force-non-host
• b38a663 Pass --force-non-host unconditionally
• a4f61a0 Document rustup non-host opt-in requirement
• 06b350f Support force-non-host toolchains
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.84.1 to 2.87.29

Release notes

Sourced from taiki-e/install-action's releases.

2.87.29

• Update zizmor@latest to 1.31.0.

• Update wasmtime@latest to 49.0.3.

• Update wasm-tools@latest to 1.262.0.

• Update uv@latest to 0.13.1.

• Update trivy@latest to 0.76.0.

• Update tombi@latest to 1.8.4.

• Update release-plz@latest to 0.3.172.

• Update osv-scanner@latest to 2.7.0.

• Update mise@latest to 2026.10.11.

• Update mdbook-d2@latest to 0.3.9.

• Update kingfisher@latest to 2.13.0.

• Update kache@latest to 1.2.1.

• Update just@latest to 1.59.0.

• Update dprint@latest to 0.63.0.

• Update cargo-crap@latest to 0.8.0.

• Update bpf-linker@latest to 0.12.0.

2.87.28

• Update dprint@latest to 0.62.0.

• Update vacuum@latest to 0.33.0.

• Update uv@latest to 0.13.0.

• Update tombi@latest to 1.8.1.

• Update release-plz@latest to 0.3.171.

• Update rclone@latest to 1.75.2.

• Update mise@latest to 2026.10.7.

• Update cargo-binstall@latest to 1.25.3.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.87.32] - 2026-10-26

• Update wild@latest to 0.11.0.

• Update vacuum@latest to 0.35.2.

• Update tombi@latest to 1.9.5.

• Update sccache@latest to 0.19.0.

• Update release-plz@latest to 0.4.1.

• Update mise@latest to 2026.10.19.

• Update knope@latest to 0.23.2.

• Update dprint@latest to 0.64.3.

• Update cargo-vet@latest to 0.10.3.

• Update cargo-sort@latest to 2.1.4.

• Update cargo-binstall@latest to 1.26.1.

• Update biome@latest to 2.6.3.

[2.87.31] - 2026-10-23

• Downgrade cargo-sort@latest to 2.1.3.

• Update vacuum@latest to 0.35.0.

• Update xh@latest to 0.26.3.

• Update uv@latest to 0.13.5.

• Update ubi@latest to 0.13.0.

... (truncated)

Commits

• 8cca091 Release 2.87.29
• fc26824 Update wasmtime manifest
• 5018b2e Update zizmor@latest to 1.31.0
• d0e5204 Update wasmtime@latest to 49.0.3
• 517774f Update wasm-tools@latest to 1.262.0
• 4bc69b1 Update vacuum manifest
• 0470a3f Update uv@latest to 0.13.1
• 7a2b747 Update trivy@latest to 0.76.0
• 7efb533 Update tombi@latest to 1.8.4
• e5d37d6 Update release-plz@latest to 0.3.172
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates zizmorcore/zizmor-action from 0.6.2 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
• 8eacaa5 README: bump pins (#167)
• cc914d7 Sync zizmor versions (#166)
• bae72b7 chore(deps): bump the github-actions group with 2 updates (#165)
• Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Updates actions/attest-build-provenance from 4.1.1 to 4.2.2

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in actions/attest-build-provenance#862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

Commits

• 4d10147 Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)
• e3fe62e Bump the actions-minor group with 2 updates (#860)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.