[dependabot]

Bumps the actions group with 5 updates in the / directory:

Package	From	To
pnpm/setup	3.1.1	3.1.2
astral-sh/setup-uv	10.3.0	10.3.3
taiki-e/install-action	2.87.27	2.88.1
step-security/harden-runner	2.22.1	2.22.3
actions/create-github-app-token	3.2.0	3.3.0

Updates pnpm/setup from 3.1.1 to 3.1.2

Release notes

Sourced from pnpm/setup's releases.

v3.1.2

What's Changed

• fix: update get-pnpm to v0.0.6 by @​zkochan in pnpm/setup#86
• perf: stop lockfile reads after the environment document by @​MindTooth in pnpm/setup#75
• fix: skip saving the cache when the pruned store matches the restored one by @​poulet42 in pnpm/setup#77
• fix: save the lockfile verification cache at most once per job by @​zkochan in pnpm/setup#87
• fix: let get-pnpm resolve the pnpm version by @​zkochan in pnpm/setup#88
• fix: read only the path from pnpm's cache directory output by @​zkochan in pnpm/setup#89
• fix: read the runtime versions when pnpm prints more than the listing by @​zkochan in pnpm/setup#90
• chore: lint with the ESLint rules pnpm/pnpm and get-pnpm use by @​zkochan in pnpm/setup#91
• fix: read the lockfile from lockfileDir when the workspace sets it by @​zkochan in pnpm/setup#92

Full Changelog: pnpm/setup@v3.1.1...v3.1.2

Commits

• fa36a5e fix: read the lockfile from lockfileDir when the workspace sets it (#92)
• 7b46571 chore: lint with the ESLint rules pnpm/pnpm and get-pnpm use (#91)
• 1790073 fix: read the runtime versions when pnpm prints more than the listing (#90)
• 394b371 fix: read only the path from pnpm's cache directory output (#89)
• edc3899 fix: let get-pnpm resolve the pnpm version (#88)
• a56770c fix: save the lockfile verification cache at most once per job (#87)
• a11a5fc fix: skip saving the cache when the pruned store matches the restored one (#77)
• 8ae1084 perf: stop lockfile reads after the environment document (#75)
• 45cafbe fix: update get-pnpm to v0.0.6 (#86)
• See full diff in compare view

Updates astral-sh/setup-uv from 10.3.0 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#1113)
• docs: update version references to v10.3.2 @github-actions[bot] (#1104)

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

• chore: update known checksums for 0.13.5 @github-actions[bot] (#1103)

📚 Documentation

• docs: update version references to v10.3.1 @github-actions[bot] (#1102)

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

• fix: preserve cache error class names in save-cache bundle @​dannyward630 (#1093)

🧰 Maintenance

... (truncated)

Commits

• 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
• 0192b69 chore: update known checksums for 0.13.6 (#1117)
• 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
• 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
• 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
• 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
• 56618ca docs: update version references to v10.3.2 (#1104)
• 07a047e chore: update known checksums for 0.13.5 (#1103)
• e1b8536 docs: update version references to v10.3.1 (#1102)
• 18d369b chore(deps): roll up Dependabot updates (#1101)
• Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.27 to 2.88.1

Release notes

Sourced from taiki-e/install-action's releases.

2.88.1

• Update wasmtime@latest to 50.0.1.

• Update vacuum@latest to 0.36.0.

• Update tombi@latest to 1.9.8.

• Update mise@latest to 2026.10.23.

• Update kingfisher@latest to 2.15.0.

• Update espup@latest to 0.19.0.

• Update deepsource@latest to 0.10.2.

• Update biome@latest to 2.6.4.

2.88.0

• Support similarity-rs. (#2017, thanks @​HardMax71)

2.87.33

• Update vacuum@latest to 0.35.4.

• Update uv@latest to 0.13.6.

• Update trunk@latest to 0.22.1.

• Update tombi@latest to 1.9.6.

• Update release-plz@latest to 0.4.2.

• Update mise@latest to 2026.10.21.

• Update cargo-nextest@latest to 0.9.150.

• Update cargo-about@latest to 0.9.3.

2.87.32

• Update wild@latest to 0.11.0.

• Update vacuum@latest to 0.35.2.

• Update tombi@latest to 1.9.5.

• Update sccache@latest to 0.19.0.

• Update release-plz@latest to 0.4.1.

• Update mise@latest to 2026.10.19.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.2] - 2026-11-06

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

[2.90.1] - 2026-11-04

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

[2.90.0] - 2026-11-03

... (truncated)

Commits

• 68a389c Release 2.88.1
• e31c3b8 Update wasmtime manifest
• e30a869 Update wasmtime@latest to 50.0.1
• bca7759 Update tombi@latest to 1.9.8
• 53e7fa7 ci: Mark deepsource as glibc_pre_2_34_incompat
• 8f5b3ba Update wasmtime manifest
• c6e228d Update wasm-pack manifest
• 46c9dcf Update wasm-bindgen manifest
• 4136a69 Update vacuum@latest to 0.36.0
• bf9426f Update tombi@latest to 1.9.7
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.22.1 to 2.22.3

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.3

What's Changed

• Added support for Avrea-hosted runners (enterprise tier)
• Fixed unexpected blocking of allowed connections caused by GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners
• Added a feature flag to disable implicit AWS endpoint allowances on self-hosted Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.2...v2.22.3

v2.22.2

What's Changed

• Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
• Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
• Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

Commits

• 46b06ce Merge pull request #711 from step-security/rc-46
• f82eb4b Merge pull request #710 from h0x0er/jatin/tp-avrea
• 665b85a update agent-self-hosted, agent-bravo to v1.9.5 and agent to v0.18.0
• 80fffe1 detect avrea runners
• dc2769a Merge pull request #707 from step-security/rc-45
• ab0b273 Merge pull request #706 from h0x0er/rc-45
• 03ccff8 Remove agent-preinstalled skip for third-party runners
• 815e48d Skip agent install and post-step cleanup when agent is already installed
• See full diff in compare view

Updates actions/create-github-app-token from 3.2.0 to 3.3.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.3.0

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.3.0 (2026-10-12)

Features

• update permission inputs (#399) (a47236f)

Bug Fixes

• deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
• deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

3.2.0 (2026-05-12)

Features

• add support for enterprise-level GitHub Apps (#263) (952a2a7)
• support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
• validate private-key input (#376) (f24bbd8)

Commits

• 64ab729 chore(main): release 3.3.0 (#402)
• f3a828e ci: create signed dist commits in release workflow (#404)
• 655017f docs: clarify when owner grants access to all repositories (#378)
• 12461a3 fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)
• a47236f feat: update permission inputs (#399)
• a69c19d fix(deps): bump the production-dependencies group across 1 directory with 3 u...
• d5cb7ae build(deps): bump actions/checkout from 6 to 7 (#384)
• 575da86 build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...
• e85f677 test: omit stack traces from snapshots (#401)
• 9419396 build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions