Update github-actions dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
Kesin11/actions-timeline	action	minor	v3.1.1 → v3.2.0
Swatinem/rust-cache (changelog)	action	digest	e18b497 → 6323deb
docker/login-action (changelog)	action	digest	abd2ef4 → dbcb813
github/codeql-action (changelog)	action	digest	e4fba86 → 5595cca
release-drafter/release-drafter (changelog)	action	digest	eada3c9 → 34d8067

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

Kesin11/actions-timeline (Kesin11/actions-timeline)

v3.2.0

Compare Source

Changes

Support new parallel syntax.

Similar to composite action expansion, an overall parent span is created for steps executed in parallel. Child span names for steps running in parallel in the background are prefixed with (bg).

Sample screenshot:
https://github.com/user-attachments/assets/d92027fc-ded2-4b6e-9ab0-e3923b698ec3

Features

• timeline: Render parallel steps concurrently @​Kesin11 (#​362)

Fixes

• composite: Skip synthetic parallel parents @​Kesin11 (#​363)

Dependencies

13 changes

• chore(deps): update node.js to v24.18.1 @​renovate[bot] (#​361)
• chore(deps): update dependency deno to v2.9.4 @​renovate[bot] (#​360)
• chore(deps): update jdx/mise-action action to v4.2.3 @​renovate[bot] (#​357)
• chore(deps): update dependency deno to v2.9.3 @​renovate[bot] (#​356)
• chore(deps): update actions/setup-node action to v7 @​renovate[bot] (#​355)
• chore(deps): update auto merge major github-actions @​renovate[bot] (#​354)
• chore(deps): update dependency deno to v2.9.2 @​renovate[bot] (#​353)
• chore(deps): update dependency deno to v2.9.1 @​renovate[bot] (#​352)
• chore(deps): update dependency deno to v2.9.0 @​renovate[bot] (#​351)
• chore(deps): update dependency @​std/collections to ^1.3.0 @​renovate[bot] (#​350)
• chore(deps): update dependency @​std/yaml to ^1.1.2 @​renovate[bot] (#​349)
• chore(deps): update dependency @​std/encoding to ^1.0.11 @​renovate[bot] (#​348)
• chore(deps): update node.js to v24 @​renovate[bot] (#​346)

Internal improvement

• Fix GitHub App token creation in rebundle workflow @​Kesin11 (#​359)
• Using new parallel syntax for dogfooding @​Kesin11 (#​358)
• fix: migrate release-drafter.yml to v7 config schema @​Kesin11 (#​347)

v3.2

Compare Source

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "after 5pm on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Dependency bump review — reviewed, looks clean ✅

Verified each pinned digest against upstream and read the commit log for every bumped range. No findings.

Digest / comment accuracy

Action	New pin	Resolves to	Comment
docker/login-action	dbcb813	current tip of tag v4	# v4 ✅
release-drafter/release-drafter	34d8067	tag v7 (annotated) = v7.7.0	# v7 ✅
Kesin11/actions-timeline	57fc93f	tag v3.2.0	# v3.2.0 ✅ (correctly updated from v3.1.1)

All references in .github/ were updated consistently — no stale pins left behind (login-action appears in 4 workflows, all bumped).

Regression analysis

docker/login-action abd2ef4 → dbcb813 (18 commits, mostly Dependabot). Two functional changes, both unreachable from our usage:

• 8305724 harden buildx scoped config path handling — scopeToConfigDir() now path.resolves and throws on paths escaping the buildx config dir, on more than one @ in the scope, or on non-lowercase scope actions. Only reachable when the scope input is set; all four call sites pass only registry/username/password, so the function short-circuits to ''.
• 2aa1ede surface Docker Hub OIDC error responses — parseError no longer short-circuits on 401 before parsing the body, and now JSON.stringifys the entire error body instead of extracting known keys. This only runs on the Docker Hub OIDC path (login to docker.io without credentials); all four usages target ghcr.io with an explicit username/password, so it never executes. Flagged for awareness since it widens what a failed login can echo into the log — but the payload is a Docker Hub API error response, not credentials, and the path isn't exercised here.

release-drafter v7.6.0 → v7.7.0 (20 commits). The highest-risk changes sit on the PR-discovery path this repo actually uses:

• #1679 replaced the hand-rolled paginateGraphql helper with @octokit/plugin-paginate-graphql, and #1680 added @octokit/plugin-retry for transient API failures. That rewrite of getOctokit() dropped the explicit fetch: global.fetch — #1682 preserve proxy-aware fetch in octokit client fixes the fallout and is included in this range, so the regression window is already closed.
• New features are opt-in and inert for our config (.github/release-drafter.yml is just template/version-resolver/name-template/tag-template): the conventional: category predicate (#1556) requires a categories: block we don't define, and no-new-contributor-template (#1687) only affects $NEW_CONTRIBUTORS, which our template doesn't use. parse-categories also stopped spreading changeConditionSchemaDefaults into when branches — again, categories-only.
• #1674 now emits one Config fetched … line per config source, including owner/repo/filepath@ref. Paths only — no token or secret material.
• No schema fields became required, so our existing config still validates. No regression reports upstream; only two markdown-formatting commits landed after the tag.

Kesin11/actions-timeline v3.1.1 → v3.2.0. Adds rendering for GitHub's new parallel: step syntax. The one change touching existing behaviour is #363, which adds if (apiStep.timelineRowKind === "parallel-parent") continue; to identifyCompositeSteps — relevant because tilt-flow.yml sets expand-composite-actions: true, but the synthetic parallel-parent row only exists for jobs using parallel: steps, which no workflow here does. Effectively a no-op for us. No issues filed upstream since release.

Secrets / PII

The diff itself adds no new stdout, stderr, or log output. The two upstream log-surface changes noted above (login-action OIDC error body, release-drafter config-source logging) neither print credentials nor run on paths this repo exercises.

[claude]

Renovate bump review — no findings

Reviewed per .claude/REVIEW.md. All four bumps are clean for how this repo uses them. Details below so the analysis is auditable.

1. Pin integrity — all four SHAs match their claimed tags

Action	Pinned SHA	Resolves to	Comment accurate?
Kesin11/actions-timeline	57fc93f2	tag v3.2.0	✅ # v3.2.0
docker/login-action	dbcb8138	tag v4.6.0 == current v4	✅ # v4
github/codeql-action	5595ccaf	annotated tag v4.37.6 == current v4	✅ # v4
release-drafter/release-drafter	34d80673	annotated tag v7.7.0 == current v7	✅ # v7

(The codeql-action and release-drafter refs are annotated tags, so git/ref/tags/... returns a tag object that must be dereferenced — both deref to exactly the pinned commits. No unreleased or off-branch commits are being pinned.)

2. Upstream regression analysis

Kesin11/actions-timeline v3.1.1 → v3.2.0 (37 commits) — adds rendering for the new GitHub parallel: step syntax, which introduces a new API call: downloadJobLogsForWorkflowRun. Worth a look because tilt-flow.yml (the only consumer) sets an explicit permissions: block with id-token: write / contents: read and no actions: read, so a new log-download call could have started warning. It does not: expandParallelSteps early-returns unless a job contains a step literally named Parallel group, and no workflow in this repo uses parallel: syntax — the new path never executes. Even if it did, download failures degrade to a warning() annotation plus the standard timeline layout, never a step failure. Also checked against the secrets-in-logs rule: the new code extracts only step names from log group markers (and GH masks secrets regardless) — relevant since tilt-flow.yml carries a large workflow-level secret env block, but moot as the path is unreachable here.

docker/login-action → v4.6.0 (18 commits) — two real source changes:

• src/dockerhub.ts: parseError now dumps the entire JSON error body via JSON.stringify instead of cherry-picking description/message/detail/error, and the 401 short-circuit moved after body parsing, so a 401 with a JSON body now surfaces its content. This is the only change in the whole PR touching the "no secrets in logs" rule. Not reachable here: all four usages are registry: ghcr.io with static username/password, and dockerhub.ts is exercised only on the Docker Hub OIDC token-exchange path. (The surfaced body is the Docker Hub API error JSON, not the credential.) Flagging for awareness if anyone later adds a Docker Hub OIDC login.
• src/context.ts: scopeToConfigDir hardened against path traversal and now throws on scopes with more than one @ or with non-lowercase action lists. No workflow uses the scope input → no impact.

github/codeql-action v4.37.3 → v4.37.6 (133 commits) — user-facing changes: default bundle → CodeQL 2.26.2; a fix for a network error while streaming the bundle download aborting init instead of falling back; new github-codeql-tools repository-property support; and DEFAULT_CONFIG_FILE_NAME for the new remote config-file address format changed to .github/codeql-config.yml. That last one is the only behavioral change that could bite, and only for users of the remote config-file format — codeql-analysis.yml passes no config-file, so no impact. The 2.26.2 bundle may shift alert counts, which is normal for a CodeQL bump. Non-defect note: the workflow supplies no tools input, so if the org ever sets the github-codeql-tools repo property it would now apply to this advanced-setup workflow.

release-drafter → v7.7.0 (20 commits) — features: conventional-commit-title categorization (#1556), retry on transient GitHub API failures, an Octokit GraphQL pagination refactor, a proxy-aware fetch fix, and a "no new contributors" template. The categorization is opt-in (a new conventional predicate inside categories conditions); .github/release-drafter.yml defines no categories — only template/version-resolver/name-template/tag-template — so drafted notes keep their current shape. The new "log all config sources" change (#1674) logs only owner/repo/filepath@ref, no secrets.

Verdict

No inline findings. No secret/PII exposure introduced on any reachable path, and no behavioral regression given this repo's configuration.

[claude]

Renovate bump review — looks clean ✅

Reviewed per .claude/REVIEW.md. No findings; nothing blocking. Details below so the verification is on the record.

Pin integrity — every new SHA was resolved against the upstream repo and matches the version in its trailing comment (annotated tags dereferenced):

Action	New SHA	Resolves to
Kesin11/actions-timeline	57fc93f	v3.2.0 / v3.2 / v3 ✔
docker/login-action	dbcb813	v4.6.0 / v4 ✔
github/codeql-action	5595cca	v4 (v4.37.6) ✔
release-drafter/release-drafter	34d8067	v7 (v7.7.0) ✔

All four ranges are fast-forwards (status: ahead, behind_by: 0), and grep over .github/ confirms no stale pins of these actions were left behind.

Upstream changes in each bumped range, against how we actually use them:

• docker/login-action abd2ef4…dbcb813 (18 commits, → v4.6.0). Two behavioral commits plus dep bumps (aws-sdk, js-yaml, postcss, brace-expansion).
  • surface Docker Hub OIDC error responses rewrites parseError in src/dockerhub.ts to throw the entire raw JSON body (JSON.stringify(errResp)) instead of extracting only known message fields, and demotes the 401 → "operation not permitted" special case to a fallback. Flagging it because REVIEW.md's first rule is about new output that could carry secrets — but this path is getOIDCToken, reached only for Docker Hub OIDC login (registry: docker.io, no password). All five of our call sites use registry: ghcr.io with an explicit username/password, so the code path is unreachable here. The body is also an OAuth-style error object (error/error_description/error_uri), not a token.
  • harden buildx scoped config path handling adds path-traversal validation to scopeToConfigDir and now throws on scopes/registries that escape the buildx config dir. We pass no scope input, so scopeToConfigDir short-circuits to '' — no impact.
• github/codeql-action e4fba86…5595cca (v4.37.3 → v4.37.6). Changelog: default CodeQL bundle 2.26.1 → 2.26.2; a fix so a network error while streaming the bundle download falls back instead of killing init (chore(deps): update temporalio/ui docker tag to v2.47.3 #4061); tools input settable via the github-codeql-tools repo property (fix e2e test #4037, opt-in, and a workflow-supplied tools still wins); and DEFAULT_CONFIG_FILE_NAME changed to .github/codeql-config.yml (classification: mongo disconnect should alert internal #4070) — that only affects the new remote config-file address format, and codeql-analysis.yml passes no config-file, so it's a no-op for us. Only expected effect is the usual one: the 2.26.2 bundle may shift alert results on the go / javascript-typescript matrix legs.
• release-drafter eada3c9…34d8067 (20 commits, → v7.7.0). The notable feature is feat: categorize PRs based on conventional title (UI: Add create mirror buttons #1556) — it adds an opt-in conventional predicate to category conditions; our .github/release-drafter.yml defines no categories at all (just template/version-resolver/name-template/tag-template), so drafted notes are unchanged. Rest is a GraphQL pagination refactor (BigQuery: Improve intermediate Avro methods #1679) + GraphQL 17 support (fix ci #1678), transient-API-failure retries (Incontinency whit Postgres Schemas with double qutes #1680), and PopulateCountMap: use atomics #1682 which fixes the proxy-aware-fetch regression introduced by that refactor — the regression and its fix are both inside this range, so we don't land a half-baked state. swapping out custom error for errors.ErrUnsupported #1674 adds per-source config logging; I checked the patch, it logs repo/path/ref only, no token material. Existing contents: write + pull-requests: write permissions remain sufficient.
• Kesin11/actions-timeline v3.1.1 → v3.2.0. Adds rendering for GitHub's new parallel: step syntax. Worth noting the new expandParallelSteps runs unconditionally (not gated behind our expand-composite-actions: true) and fetches job logs — but it short-circuits immediately unless a job has a step literally named Parallel group, which no PeerDB workflow produces today. So: zero extra API calls, zero output change for tilt-flow.yml. Failures are caught per-job and downgraded to warning() + a summary note rather than thrown, so it can't fail the job even once that changes. No action.yml change, so no new inputs or permissions are required — relevant since tilt-flow.yml grants only id-token: write + contents: read.

No new logging of credentials or PII is introduced on any path this repo exercises.

[claude]

Dependency bump review — no findings

Reviewed per .claude/REVIEW.md. All four pins were verified against upstream tags, and each behavioral change in the bumped ranges was traced to its call sites in this repo. No regressions or secret/PII logging found. Also confirmed no stale copies of the old digests remain anywhere in the repo.

Digest ↔ tag verification

Action	Old → New	Resolves to
Kesin11/actions-timeline	7bf7999 → 57fc93f	v3.2.0 tag (and v3) ✅
docker/login-action	abd2ef4 → dbcb813	v4.6.0 tag (was v4.5.1) ✅
github/codeql-action	e4fba86 → 5595cca	v4 tag = v4.37.6 (was v4.37.3) ✅
release-drafter	eada3c9 → 34d8067	v7.7.0 tag (was v7.6.0) ✅

Every pin is an ancestor-clean fast-forward (status: ahead, behind_by: 0), and each version comment matches the resolved tag.

Regression analysis

Kesin11/actions-timeline v3.1.1 → v3.2.0 — adds parallel: step rendering (#362). This introduces a new API call, downloadJobLogsForWorkflowRun (src/github.ts), to derive parallel children from log markers. Two reasons that is a non-issue for tilt-flow.yml:

• expandParallelSteps early-returns when no job contains a parallel group (src/parallel.ts:205), and tilt-flow.yml uses no parallel: syntax, so the log fetch never runs. Relevant because that job grants only contents: read / id-token: write, no actions: read.
• Even if reached, the fetch is wrapped in try/catch that degrades to a warning (src/parallel.ts:218), so it cannot fail the step.

Worth noting that #363 (composite: skip synthetic parallel parents) fixes the interaction between #362 and composite expansion. This repo sets expand-composite-actions: true, and both PRs shipped in the same release, so there is no broken window.

docker/login-action v4.5.1 → v4.6.0 — two real behavior changes, neither reachable here (all four call sites use registry: ghcr.io with username/password, no Docker Hub OIDC and no scope input):

• src/dockerhub.ts (#1058) now JSON.stringifys the entire API error body into the thrown error instead of whitelisting description/message/detail/error, and the 401 short-circuit moved to after the body dump, so 401 bodies are now echoed too. Flagging this explicitly against the log-hygiene rule: it widens what upstream prints on failure, but it only executes on the Docker Hub token-exchange path, which these workflows never take. No action needed unless a Docker Hub OIDC login is added later.
• scopeToConfigDir (#1059) hardens path handling with path.resolve plus containment checks, and now throws on a registry/scope that escapes the Buildx config dir, on more than one @ in a scope, or on non-lowercase scope actions. Strictly a new failure mode for malformed scope values; no call site passes scope.

github/codeql-action v4.37.3 → v4.37.6 — changelog reviewed:

• v4.37.6: default filepath for the remote config-file address format changed to .github/codeql-config.yml (#4070). codeql-analysis.yml passes no config-file, so it is unaffected.
• v4.37.5: fix for a network error during bundle streaming terminating init instead of falling back (#4061) — strict improvement.
• v4.37.4: github-codeql-tools repository-property support (feature-flagged, gradual rollout; a workflow-supplied tools always wins, and it is not set here) and default bundle → CodeQL 2.26.2.
• Only expected side effect: the CodeQL CLI/bundle update can surface new or shifted alerts on the next scan. Normal for a codeql-action bump, not a regression.

release-drafter v7.6.0 → v7.7.0 — the headline feature, conventional-title categorization (#1556), is fully opt-in: matchesConventionalTitle returns true immediately when condition.conventional is unset, and .github/release-drafter.yml declares no categories at all. Likewise, no new contributor template (#1687) only affects $NEW_CONTRIBUTORS, while our template uses $CHANGES alone. The substantive changes are the Octokit GraphQL pagination refactor (#1679), transient-failure retries (#1680), and a proxy-aware fetch fix (#1682) — all reliability-positive. The four keys our config uses (template, version-resolver, name-template, tag-template) remain valid in the v7 schema; the only common-config.schema.ts edit in range is a doc-comment master → main rename.

🤖 Generated with Claude Code

[claude]

Renovate review — GitHub Actions bumps ✅

Reviewed per .claude/REVIEW.md. No findings — no defects or PII/secret-logging changes introduced, and no regressions that affect how this repo uses these actions. Details of the upstream diff review below.

Digest ↔ tag verification

All five pinned digests resolve to the tag claimed in the trailing comment (no mismatched or unreleased pins):

Action	Pinned digest	Resolves to
Kesin11/actions-timeline	57fc93f	tag v3.2.0 ✅
Swatinem/rust-cache	6323deb	tag v2 → v2.9.2 ✅
docker/login-action	dbcb813	tag v4 → v4.6.0 ✅
github/codeql-action	5595cca	tag v4 → v4.37.6 ✅
release-drafter/release-drafter	34d8067	tag v7 → v7.7.0 ✅

All 9 call sites were updated consistently — no stale digests left anywhere in .github/.

Upstream commit-log / release-notes review

Swatinem/rust-cache v2.9.1 → v2.9.2 (45 commits) — the largest real change in this PR. Internals were migrated to Rollup with bundle splitting, so action.yml now points at dist/restore.js / dist/save.js instead of dist/{restore,save}/index.js. I verified the new dist/ tree is self-consistent (chunk cleanup-BWEbZ6YT.js is present and correctly referenced by both entrypoints).

• Cache keys are unaffected. getRustVersions was refactored from Set<RustVersion> (objects — so both dedupe and sort() were silently broken) to a sorted Set<string>, but the string fed to the hasher is still exactly `${release} ${host} ${commitHash}`. Same input → same key, so nexus caches are not invalidated by this bump. It actually fixes latent key instability for multi-toolchain setups.
• Cleanup fixes (credentials.toml path, including target names + cdylib/rlib/dylib/staticlib in build/ and .fingerprint/ cleanup, inverted target/profile check) all err toward preserving more valid artifacts — worst case is a slightly larger cache, not a broken one.
• The Rollup migration did introduce one regression upstream (Windows cache-path validation), but it was fixed within this same range (Adds variable assignments in clonetable #355) and is Windows-only regardless — ci.yml runs this on ubuntu.
• Minor heads-up, not applicable here: cache-provider dropped buildjet support. ci.yml only passes workspaces: nexus, so no impact.

docker/login-action v4.5.1 → v4.6.0

• v4.5.2 rewrote parseError in src/dockerhub.ts to JSON.stringify the whole error body instead of extracting only whitelisted keys (description/message/detail/error), and moved the 401 short-circuit after body parsing. This widens what can land in logs — flagged against REVIEW.md's log-content rule, but not exercised here: dockerhub.ts is only on the Docker Hub OIDC/PAT path, and all four workflows log in to ghcr.io with GITHUB_TOKEN.
• v4.6.0 hardened scopeToConfigDir to throw when a registry/scope value resolves outside the Buildx config dir, and to reject scopes with more than one @ or non-lowercase actions. No workflow here passes scope, so the function returns early and the new throws are unreachable.

github/codeql-action v4.37.3 → v4.37.6 (133 commits, mostly internal refactors and rebuilds)

• v4.37.4: default bundle → CodeQL 2.26.2; adds support for setting tools via the github-codeql-tools repository property. For Advanced Setup (what codeql-analysis.yml uses) the workflow value wins unless the property starts with ! — and we don't set tools at all, so behavior only changes if someone sets that org/repo property.
• v4.37.5: fixes a network error during bundle streaming aborting init instead of falling back to download-then-extract — strictly an improvement for CI flakiness.
• v4.37.6: changed the default filepath for the remote-file-address config format to .github/codeql-config.yml. No impact — codeql-analysis.yml passes no config-file.

release-drafter/release-drafter v7 → v7.7.0 (20 commits)

• The headline feature (UI: Add create mirror buttons #1556, categorize PRs by conventional title) is opt-in via a new conventional predicate inside categories. .github/release-drafter.yml defines no categories, so drafted notes are unchanged.
• Remaining changes are robustness work: retry on transient GitHub API failures, Octokit GraphQL pagination, preserved proxy-aware fetch, GraphQL 17 support. Our config (template, version-resolver, name-template, tag-template) uses no fields touched by the schema updates.

Kesin11/actions-timeline v3.1.1 → v3.2.0 (37 commits) — adds rendering for GitHub's new parallel step syntax, which required reworking composite-action matching (src/composite.ts, new src/parallel.ts). tilt-flow.yml sets expand-composite-actions: true, so it does hit the reworked path, but expandParallelSteps degrades to warnings plus the standard layout rather than throwing, and the blast radius is a cosmetic run-summary Gantt chart either way.

[claude]

Dependency bump review — reviewed, looks clean ✅

Reviewed per .claude/REVIEW.md (secret/PII logging + upstream regression check for each bumped range). No blocking findings, so no inline comments — details below so the check isn't a black box.

Pin integrity

Every pinned SHA resolves to the tag in its trailing comment, and every range is ahead-only on the upstream default branch (behind_by = 0, i.e. fast-forward, no history rewrite):

Action	Range	Resolved
Swatinem/rust-cache	e18b497 → 6323deb (45 commits)	v2 / v2.9.2 → 6323deb ✅
docker/login-action	abd2ef4 → dbcb813 (18 commits)	v4.5.1 → v4.6.0 = dbcb813, v4 → dbcb813 ✅
github/codeql-action	e4fba86 → 5595cca (133 commits)	v4.37.3 → v4.37.6, v4 → 5595cca ✅
release-drafter/release-drafter	eada3c9 → 34d8067 (20 commits)	v7 / v7.7.0 → 34d8067 ✅
Kesin11/actions-timeline	7bf7999 → 57fc93f (37 commits)	v3.2.0 → 57fc93f ✅

grep over .github/ confirms all 9 call sites in 8 workflows were bumped consistently — no stale SHAs left behind (both codeql-action/init and /analyze moved together).

Secrets / PII in logs

One thing flagged and cleared: docker/login-action 2aa1ede changed parseError in src/dockerhub.ts to JSON.stringify the entire Docker Hub API error body into the thrown error, instead of only whitelisting description/message/detail/error (and the 401 short-circuit now runs after the body is surfaced). That's more response content in job logs than before, but the path is only reached via isDockerHubOIDC(registry, password) — all four of our login steps (customer-docker, dev-docker, mysql-debug-docker, stable-docker) target ghcr.io with a password secret, so it is dead code for us. Credentials still go via --password-stdin with silent: true. Nothing else in the five ranges adds credential-bearing output.

Per-action regression notes

• rust-cache 2.9.1 → 2.9.2 — the largest change here: rollup bundle-splitting (dist/restore/index.js → dist/restore.js + shared chunks, action.yml main/post updated accordingly, still node24), a target/ cleanup rewrite for Cargo's V2 build-dir layout, cdylib/rlib/dylib/staticlib added to SAVE_TARGETS, and cleanBin inverted to keep build-installed binaries. Three things worth knowing:
  • Expect a one-time cache miss on nexus. getRustVersions now returns sorted, deduped strings; previously it was a Set of objects, so .sort() was a no-op and identical toolchains never deduped. Same inputs → different key → one cold rebuild, then back to normal.
  • cleanRegistry now deletes $CARGO_HOME/credentials.toml instead of the never-existing $CARGO_HOME/.cargo/credentials.toml — a genuine fix that stops cargo registry credentials from being saved into the Actions cache. No exposure for us (nexus doesn't authenticate to a private registry), but good to have.
  • Upstream has one post-2.9.2 fix not in this bump (#377: rmExcept's timestamp branch returned after the first entry, so at most one outdated item was ever pruned). It is pre-existing — also present in 2.9.1 — so not a regression from this bump; it will arrive with the next v2 digest bump. No open upstream issues reporting 2.9.2 regressions.
  • CI evidence: build (ubuntu-latest, 14–18) — the ci.yml job that actually restores/saves this cache — passes on all five matrix legs.
• codeql-action 4.37.3 → 4.37.6 — no breaking changes. Default CodeQL bundle 2.26.1 → 2.26.2 (may surface slightly different alerts, expected), a bundle-download network-error fallback fix, and github-codeql-tools repository-property support. 4.37.6's DEFAULT_CONFIG_FILE_NAME change only affects the remote config-file input, which codeql-analysis.yml doesn't set. Both Analyze (go) and Analyze (javascript-typescript) pass on the new SHA.
• login-action v4.5.1 → v4.6.0 — besides the above, 8305724 hardens scopeToConfigDir with path-escape validation that now throws on malformed scope input. None of our login steps pass scope, so no behavior change.
• release-drafter v7.7.0 — new features (conventional-title category matching, no-new-contributor-template) are opt-in schema additions; our .github/release-drafter.yml only uses template/version-resolver/name-template/tag-template and stays valid. The real behavior changes to keep an eye on are the Octokit GraphQL pagination refactor, GraphQL 17 support, and transient-API-failure retries — failure mode would be a malformed draft release, not a merge-blocking break. Config-source logging was expanded to one line per source (paths only, nothing sensitive).
• actions-timeline v3.1.1 → v3.2.0 — adds rendering for GitHub's new parallel: step syntax, which we don't use. The only live change for tilt-flow.yml is "skip synthetic parallel parents" during composite matching, relevant because we set expand-composite-actions: true. Root action.yml is unchanged — no new inputs and no new permissions: needed. Worst case is a cosmetic timeline in the job summary; it cannot fail the job.

Only renovate/stability-days and the long-running flow_test legs were still pending at review time.