[dependabot]

Updates the requirements on dtolnay/rust-toolchain, pnpm/action-setup and taiki-e/install-action to permit the latest version.
Updates dtolnay/rust-toolchain to d86e0fa8f147d6539442c26a61ebba8becc19489

Commits

• See full diff in compare view

Updates pnpm/action-setup from 6.1.0 to 6.1.1

Release notes

Sourced from pnpm/action-setup's releases.

v6.1.1

What's Changed

• fix: refresh native bootstrap and test shared store reuse by @​zkochan in pnpm/action-setup#293
• fix: update pnpm 11 bootstrap to 11.28.10 by @​rstacruz25 in pnpm/action-setup#292
• chore: update pinned GitHub Actions by @​deining in pnpm/action-setup#223
• fix: skip saving missing cache directories by @​zkochan in pnpm/action-setup#294
• docs: clarify manifest-based version selection by @​djmurphy32 in pnpm/action-setup#244

New Contributors

• @​rstacruz25 made their first contribution in pnpm/action-setup#292
• @​djmurphy32 made their first contribution in pnpm/action-setup#244

Full Changelog: pnpm/action-setup@v6.1.0...v6.1.1

Commits

• 73e4699 docs: clarify manifest-based version selection (#244)
• c05d46d fix: skip saving missing cache directories (#294)
• 343d2b1 Bump GitHub action workflows (#223)
• 9a15f15 fix: update pnpm 11 bootstrap to 11.28.10 (#292)
• 7cf8c4c fix: refresh native bootstrap and test shared store reuse (#293)
• See full diff in compare view

Updates taiki-e/install-action from 2.89.1 to 2.90.1

Release notes

Sourced from taiki-e/install-action's releases.

2.90.1

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

2.90.0

• Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

• Update vacuum@latest to 0.36.2.

• Update release-plz@latest to 0.4.3.

• Update bpf-linker@latest to 0.13.0.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.2] - 2026-11-06

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

[2.90.1] - 2026-11-04

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

[2.90.0] - 2026-11-03

... (truncated)

Commits

• c509219 Release 2.90.1
• 4809658 codegen: kache 2.0.0 split binaries
• 2f5a77a Update zizmor@latest to 1.32.0
• 44e3ac1 Update uv@latest to 0.13.7
• 91480af Update typos@latest to 1.52.0
• 1886998 Update tombi@latest to 1.9.9
• d66493d Update syft@latest to 1.56.0
• ae0b89b Update prek manifest
• 773fb6f Update mise@latest to 2026.11.0
• 0a95b08 Update kache@latest to 2.0.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[bashkit-pr-reviewer]

Review summary — #2881 (dependabot CI bump)

Verdict: No issues found. Safe to merge subject to green CI. No review posted (no findings).

What the change does: Dependabot github-actions group update across 10 workflow files, 26+/26- lines. Every changed line is a pinned-action uses: bump — verified that the diff contains no other logic changes:

• dtolnay/rust-toolchain: 5b84223… → d86e0fa8… (# nightly, 6 sites)
• pnpm/action-setup: ea17c68… (# v6.1.0) → 73e46992… (# v6.1.1, 11 active + 2 commented sites)
• taiki-e/install-action: 682ce6c… → c509219… (# v2, 7 sites)

Findings: None — no P0/P1/P2.

• Actions stay commit-SHA pinned with matching version comments (comment updated alongside the SHA for pnpm v6.1.0→v6.1.1); no floating tags introduced.
• Scope matches the PR description's 3 claimed updates; no unrelated workflow logic, permission, or secret-handling changes.
• No prompt-injection in title/body/diff (only standard dependabot release notes + codesmith footer).

Context read beyond the diff: checked out head e9eccf0 to /workspace/bashkit; grepped all uses: pins under .github/workflows (all now on the new SHAs); read AGENTS.md project-rules/knowledge index (no knowledge/ update needed — CI pin bump touches no runtime, VFS, or sandbox-boundary concept; AGENTS.md test/knowledge rules N/A to a pin bump). Diff was not truncated (truncated: false), all 10 files visible.

Not reviewed: full upstream release contents of the three actions (no network per reviewer constraints); relied on SHA pinning + version-comment consistency. No build/test run per reviewer policy.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	e9eccf0	Commit Preview URL Branch Preview URL	Nov 07 2026, 02:02 PM

[chaliy]

Closing: this was generated against 38d2c4c, before #2850 merged, and it is now both conflicted (mergeable_state=dirty) and red on Build wheel (Pyodide/Emscripten) — the precise failure #2850 exists to fix.

Two of its three bumps are already on main via #2850: pnpm/action-setup → 73e4699 (v6.1.1) and taiki-e/install-action → b80e2bb2. Only the newer taiki-e SHA (c509219) is still outstanding, and Dependabot will re-propose it against current main.

Worth recording why this one could not simply be rebased, since the next proposal needs to avoid the same shape. The diff re-adds:

+ uses: dtolnay/rust-toolchain@d86e0fa8f147d6539442c26a61ebba8becc19489 # nightly

d86e0fa8 is the stable 1.96.0 ref on main, where it is marked # 1.96.0. A # nightly-marked ref to that same SHA would be actively harmful, not just redundant: test_pinned_ci_tools.py collects nightly SHAs from that comment, so the stable SHA would register as a nightly and job_default_is_nightly would return true for every job using the pinned toolchain — silently exempting every source-built CI tool from the version pin that exists to stop an upstream MSRV bump breaking an unchanged tree. That is the cargo-geiger 0.14.0 failure again, with the detector switched off.

The conflict is doing its job here: #2850 removed the # nightly-marked refs entirely in favour of explicit rustup toolchain install, so this hunk cannot apply silently. No action needed beyond closing — flagging it so a future # nightly comment on a stable SHA gets a second look.

---

Generated by Claude Code