Bump the github-actions group across 1 directory with 5 updates - #1306
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions-rust-lang/setup-rust-toolchain](https://github.com/actions-rust-lang/setup-rust-toolchain) | `1.17.0` | `2.0.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.2` | `2.87.12` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.3` | `6.2.4` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.0.1` | `10.1.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.2` | `0.6.4` | Updates `actions-rust-lang/setup-rust-toolchain` from 1.17.0 to 2.0.0 - [Release notes](https://github.com/actions-rust-lang/setup-rust-toolchain/releases) - [Changelog](https://github.com/actions-rust-lang/setup-rust-toolchain/blob/main/CHANGELOG.md) - [Commits](actions-rust-lang/setup-rust-toolchain@166cdcf...ecabd13) Updates `taiki-e/install-action` from 2.87.2 to 2.87.12 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@1ed6d7b...3f74d7c) Updates `aws-actions/configure-aws-credentials` from 6.2.3 to 6.2.4 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@e6de054...cbe3b39) Updates `astral-sh/setup-uv` from 10.0.1 to 10.1.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@20cfd1b...bec219d) Updates `zizmorcore/zizmor-action` from 0.6.2 to 0.6.4 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@3dc1ecc...cc914d7) --- updated-dependencies: - dependency-name: actions-rust-lang/setup-rust-toolchain dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.87.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
|
||
| - name: Setup Rust | ||
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | ||
| uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 |
There was a problem hiding this comment.
🟡 Warning opt-outs no longer work
Upgrading setup-rust-toolchain leaves builds denying warnings despite their explicit rustflags: "" opt-out. Version 2 defaults build-warnings to deny, independently of rustflags. Windows tests and cross-platform release builds can now fail on warnings they intentionally allowed.
Learn more
Version 1 enforced warning-free builds through RUSTFLAGS=-D warnings, so rustflags: "" disabled that behavior. Version 2 changes the default mechanism to CARGO_BUILD_WARNINGS=deny; leaving rustflags empty no longer opts out. The same incomplete migration affects the nightly build setup, pcbc release setup, and Windows test setup.
Example: A Windows-only dependency warning previously remained a warning because the Windows test setup specified rustflags: "". After this upgrade, Cargo reads CARGO_BUILD_WARNINGS=deny, promotes it to an error, and aborts the test job.
Recommended fix: Add build-warnings: "" beside every existing rustflags: "" input. Keep rustflags: "" as well if these builds must continue avoiding injected Rust flags.
Was this helpful? React with 👍 or 👎 to provide feedback.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 78bce8f. Configure here.
| - name: Install Rust (Windows) | ||
| if: runner.os == 'Windows' | ||
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | ||
| uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0 |
There was a problem hiding this comment.
Warning deny override no longer works
Medium Severity
The setup-rust-toolchain v2 upgrade enforces warning-free builds through CARGO_BUILD_WARNINGS instead of RUSTFLAGS. Existing rustflags: "" overrides no longer disable that policy, so Windows tests and release jobs that previously opted out now treat compiler warnings as errors.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 78bce8f. Configure here.
Bumps the github-actions group with 5 updates in the / directory:
1.17.02.0.02.87.22.87.126.2.36.2.410.0.110.1.00.6.20.6.4Updates
actions-rust-lang/setup-rust-toolchainfrom 1.17.0 to 2.0.0Release notes
Sourced from actions-rust-lang/setup-rust-toolchain's releases.
Changelog
Sourced from actions-rust-lang/setup-rust-toolchain's changelog.
... (truncated)
Commits
ecabd13Prepare changelog for 2.0.0 releasedc00391Add error matcher for Rust panics70de7ebMerge pull request #103 from ChihweiLHBird/reuse-rustc-verbose-outputc420b69Merge pull request #105 from actions-rust-lang/use-build-warningsd94d10aUse CARGO_BUILD_WARNINGS for enforcing warning free compilations34430aaReuse rustc verbose output instead of invoking rustc three times.0267444Merge pull request #102 from actions-rust-lang/dependabot/github_actions/Swat...5fa2882Bump Swatinem/rust-cache from 2.9.1 to 2.9.28439c15Merge pull request #100 from actions-rust-lang/dependabot/github_actions/acti...c8f944aBump actions/checkout from 7.0.0 to 7.0.1Updates
taiki-e/install-actionfrom 2.87.2 to 2.87.12Release notes
Sourced from taiki-e/install-action's releases.
... (truncated)
Changelog
Sourced from taiki-e/install-action's changelog.
... (truncated)
Commits
3f74d7cRelease 2.87.12e7f36aaUpdate wasmtime manifestb208ecfUpdate zola manifest4972682Updatewasmtime@latestto 48.0.29f978f5Updatewasm-tools@latestto 1.259.001d9694Updateuv@latestto 0.12.137af43afUpdaterelease-plz@latestto 0.3.1655ebe8aaUpdateprotoc-gen-connect-openapi@latestto 0.27.1c054431Updatemise@latestto 2026.9.52ad5cecUpdatecargo-nextest@latestto 0.9.144Updates
aws-actions/configure-aws-credentialsfrom 6.2.3 to 6.2.4Release notes
Sourced from aws-actions/configure-aws-credentials's releases.
Changelog
Sourced from aws-actions/configure-aws-credentials's changelog.
... (truncated)
Commits
cbe3b39chore(main): release 6.2.4 (#1942)58065dbchore(deps): bump js-yaml (#1944)609df23chore: Update distaa65264fix: account-ids handling, mask proxy as secret in logs (#1943)7fdbbb8chore: Update dist3852440fix: skip backoff sleep after the final retryAndBackoff attempt (#1937)c16f89bmention renamed repos use the new immutable identifiers (#1941)9c362eechore: Update distd5f8da8chore(deps): bump@aws-sdk/client-stsfrom 3.1111.0 to 3.1116.0 (#1935)2db2497chore: Update distUpdates
astral-sh/setup-uvfrom 10.0.1 to 10.1.0Release notes
Sourced from astral-sh/setup-uv's releases.
Commits
bec219dchore(deps-dev): roll up Dependabot updates (#1043)b90ec40fix: respect no proxy directive (#1037)421feb6chore: update known checksums for 0.12.12 (#1041)f634bf4Expose a Python "identity" output (#1036)a6772c8chore: update known checksums for 0.12.10/0.12.11 (#1038)e105c8fchore: update known checksums for 0.12.9 (#1035)cd13f92Verify downloads with astral-sh/versions checksums (#1033)3aef7b9chore: update known checksums for 0.12.7/0.12.8 (#1031)d08d816chore: update known checksums for 0.12.6 (#1030)19b4d1eHarden npm install defaults (#1026)Updates
zizmorcore/zizmor-actionfrom 0.6.2 to 0.6.4Release notes
Sourced from zizmorcore/zizmor-action's releases.
Commits
cc914d7Sync zizmor versions (#166)bae72b7chore(deps): bump the github-actions group with 2 updates (#165)27604f9chore(deps): bump the github-actions group with 2 updates (#164)c41d665README: bump pins (#163)70fb788Sync zizmor versions (#162)7999d8cchore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 in ...2ae1ce9chore(deps): bump github/codeql-action/upload-sarif (#160)951a5eeSkip prerelease versions in sync-zizmor-versions workflow (#158)79f0191chore(deps): bump github/codeql-action/upload-sarif (#156)26a3ae6sync-zizmor-versions: retry up to 5 times (#155)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsNote
Medium Risk
The setup-rust-toolchain major upgrade can change default CI compile/test behavior across all Rust jobs, and updated AWS credential action runs on release S3 uploads.
Overview
Updates pinned third-party GitHub Actions across CI, release, and security workflows—no step logic or inputs change beyond the new action versions.
actions-rust-lang/setup-rust-toolchainmoves from v1.17.0 to v2.0.0 everywhere Rust is installed (test, e2e, wasm, npm publish, build-perf, pcb/pcbc release and version-bump). Release/matrix jobs that already passrustflags: ""keep that explicit override.taiki-e/install-action(v2.87.2 → v2.87.12) is updated for wasm-pack and nextest installs.aws-actions/configure-aws-credentials(v6.2.3 → v6.2.4) is updated on S3 publish steps in pcb/pcbc release and nightly workflows.astral-sh/setup-uv(v10.0.1 → v10.1.0) is updated in Python tests and pcbc version bump.zizmorcore/zizmor-action(v0.6.2 → v0.6.4) is updated in the security scan workflow.Reviewed by Cursor Bugbot for commit 78bce8f. Bugbot is set up for automated code reviews on this repo. Configure here.