Bump the github-actions group across 1 directory with 9 updates

[dependabot]

Bumps the github-actions group with 9 updates in the / directory:

Package	From	To
docker/setup-buildx-action	4.3.0	4.4.1
docker/build-push-action	7.3.0	7.4.0
actions/upload-artifact	7.0.1	7.0.2
bencherdev/bencher	0.6.12	0.6.13
actions/download-artifact	8.0.1	8.0.2
hendrikmuhs/ccache-action	1.2.23	1.2.24
vmactions/freebsd-vm	1.5.5	1.5.9
vmactions/netbsd-vm	1.4.7	1.5.2
vmactions/openbsd-vm	1.4.7	1.4.8

Updates docker/setup-buildx-action from 4.3.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

• Skip BuildKit image pre-pulls for explicit endpoints by @​crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

• Use official Buildx releases for cloud driver by @​crazy-max in docker/setup-buildx-action#606
• Pull BuildKit image before builder creation by @​crazy-max in docker/setup-buildx-action#609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in docker/setup-buildx-action#620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614
• Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

Commits

• f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
• e700274 chore: update generated content
• 3061c91 skip BuildKit image pre-pulls for explicit endpoints
• 594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
• bd6e702 chore: update generated content
• 6268c9d pull BuildKit image before builder creation
• e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
• 533ed8e build(deps): bump the codeql-actions group with 2 updates
• bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
• d5079fb chore: update generated content
• Additional commits viewable in compare view

Updates docker/build-push-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

• Use the shared error helper for Buildx commands by @​crazy-max in docker/build-push-action#1620
• Prevent workflow command injection in metadata logs by @​crazy-max in docker/build-push-action#1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592
• Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613
• Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615
• Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611
• Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606
• Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577
• Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

Commits

• c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 459b674 [dependabot skip] chore: update generated content
• 4dedcb2 chore(deps): Bump @​docker/actions-toolkit from 0.99.0 to 0.100.0
• 379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
• 9877975 chore: update generated content
• 7ed0556 use the shared Buildx error summary helper
• 91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 80dbc86 [dependabot skip] chore: update generated content
• 50cac3a chore(deps): Bump @​docker/actions-toolkit from 0.98.0 to 0.99.0
• 03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates bencherdev/bencher from 0.6.12 to 0.6.13

Release notes

Sourced from bencherdev/bencher's releases.

v0.6.13

• Fix slow alert lists and perf queries on large projects
• Alert responses now name the variant the alert fired on
• BREAKING CHANGE Mark a Bare Metal job unknown instead of failed when the server loses contact with its runner
• Fix rate limit windows counting up to twice their length
• Write API server logs to stderr as JSON
• Add callbacks for detached Bare Metal jobs (Thank you jkaczman)
• BREAKING CHANGE --detach with --github-actions now requires --ci-callback-token, and no longer posts a comment or completes the GitHub Check before the job has run
• BREAKING CHANGE An empty --github-actions token is now refused

Commits

• f808474 Release v0.6.13
• 58957b6 Add job callback steps to the runner smoke test (#1065)
• 4936837 Document job callbacks and pull requests on bare metal (#1064)
• 50ceec8 Hand a detached GitHub Actions run's check to its attach (#1063)
• c7babb0 Add callback flags to a detached bencher run (#1062)
• bcc9ca2 Accept a run job callback, sealed for a paid plan or a GitHub dispatch (#1061)
• 0aab656 Add OpenTelemetry metrics for job callbacks (#1060)
• a36bc7a Fire job callbacks once a job reaches a terminal state (#1059)
• 3f46f76 Attach to a submitted job with bencher run --job (#1058)
• 4e72f65 Store job callbacks and show their state on JsonJob (#1057)
• Additional commits viewable in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Updates hendrikmuhs/ccache-action from 1.2.23 to 1.2.24

Release notes

Sourced from hendrikmuhs/ccache-action's releases.

v1.2.24

What's Changed

• metadata: Add release of ccache on linux-riscv64 by @​luhenry in hendrikmuhs/ccache-action#442
• Update sccache to 0.15.0 by @​luhenry in hendrikmuhs/ccache-action#444

dependabot updates

• Bump fast-xml-builder from 1.1.4 to 1.2.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#445
• Bump jest from 30.3.0 to 30.4.2 by @​dependabot[bot] in hendrikmuhs/ccache-action#446
• Bump @​types/node from 25.6.0 to 25.9.1 by @​dependabot[bot] in hendrikmuhs/ccache-action#449
• Bump fast-xml-parser from 5.5.7 to 5.8.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#443
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in hendrikmuhs/ccache-action#454
• Bump @​vercel/ncc from 0.38.4 to 0.44.1 by @​dependabot[bot] in hendrikmuhs/ccache-action#458
• Bump to sccache v0.17.0 and ccache v4.13.6 by @​luhenry in hendrikmuhs/ccache-action#464
• Bump @​types/node from 25.9.1 to 26.2.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#461
• Bump @​actions/cache from 6.0.0 to 6.2.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#460
• Bump undici from 6.24.1 to 6.28.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#462
• Bump brace-expansion by @​dependabot[bot] in hendrikmuhs/ccache-action#463

Full Changelog: hendrikmuhs/ccache-action@v1.2.23...v1.2.24

Commits

• f09c25b update code
• 19aa42b Bump brace-expansion (#463)
• de5fb03 Bump undici from 6.24.1 to 6.28.0 (#462)
• 480c732 Bump @​actions/cache from 6.0.0 to 6.2.0 (#460)
• 613119f Bump @​types/node from 25.9.1 to 26.2.0 (#461)
• 32bcd49 Bump to sccache v0.17.0 and ccache v4.13.6 (#464)
• 9e3d904 Bump @​vercel/ncc from 0.38.4 to 0.44.1 (#458)
• 9bb417d Bump actions/checkout from 6 to 7 (#454)
• 9e72c68 update code after package updates
• 5685f76 Bump fast-xml-parser from 5.5.7 to 5.8.0 (#443)
• Additional commits viewable in compare view

Updates vmactions/freebsd-vm from 1.5.5 to 1.5.9

Release notes

Sourced from vmactions/freebsd-vm's releases.

v1.5.9

Optional key suffix for the cache-after-prepare cache

New input cache-after-prepare-key-suffix: an optional value that is appended as-is to the cache key of the image cached after prepare. Changing it discards that cache and runs prepare again, without editing prepare itself. Requested in vmactions/freebsd-vm#167

Usage

  - uses: actions/checkout@v7
  - uses: vmactions/freebsd-vm@v1
    with:
      cache-after-prepare: true
      cache-after-prepare-key-suffix: deps-${{ hashFiles('deps.sh') }}
      prepare: |
        sh deps.sh

• The input is optional and empty by default. Left out, every cache key stays the same as in v1.5.8, so existing caches stay valid.
• The prepare script and the sync method are still part of the key; the suffix is only added at the end.
• hashFiles() is evaluated on the runner, relative to the workspace, so check out first. It returns an empty string when no file matches, and the key then no longer follows the file.

Pins

BUILDER_VERSION 2.2.8 (unchanged) ANYVM_VERSION 0.7.2 (unchanged)

v1.5.8

FreeBSD on ubuntu-26.04 runners

The action's test matrix, 10.4, 11.4 and 13.2 - 15.1 across x86_64, aarch64, riscv64 and powerpc64, now runs on ubuntu-26.04 and ubuntu-26.04-arm: 313 of 314 jobs pass, and the 9p job is skipped as before. 12.4, which the matrix leaves out, passes anyvm's own FreeBSD CI on the same runners.

What failed on 26.04

With v1.5.7 on a 26.04 runner:

... (truncated)

Commits

• c46abac Update vmactions/freebsd-vm from base-vm
• 83496ce Generated from base-vm
• abc5072 Sync from base-builder
• c6d9b09 Update vmactions/freebsd-vm from base-vm
• 6d69158 Generated from base-vm
• d1c0bc5 Update version to v1.5.8
• 6f16425 Update vmactions/freebsd-vm from base-vm
• 6f0e5ed Generated from base-vm
• eec490e Update vmactions/freebsd-vm from base-vm
• 40859e1 Generated from base-vm
• Additional commits viewable in compare view

Updates vmactions/netbsd-vm from 1.4.7 to 1.5.2

Release notes

Sourced from vmactions/netbsd-vm's releases.

v1.5.2

NetBSD 10.2

New release

NetBSD 10.2 on x86_64, aarch64 and sparc64, from image builder 2.2.7 (#39). The default is still 11.0.

• uses: vmactions/netbsd-vm@v1 with: release: "10.2"

The leading-part form follows: release: "10" now picks 10.2, the newest 10.x.

The test matrix runs on ubuntu-26.04 and ubuntu-26.04-arm: 244 of 245 jobs pass, all 24 new 10.2 jobs among them, and the 9p job is skipped as before.

9.x packages

ftp.NetBSD.org dropped every 9.x package directory between 2026-09-17 and 2026-09-25, and with it the 9.0_2026Q1 tree the 9.x images had baked into their PKG_PATH. Image builder 2.2.7 takes that PKG_PATH from ftp.fr.NetBSD.org, else ftp.jaist.ac.jp, and lists every 9.0 quarterly there (9.0_2026Q2 has no fuse-sshfs, 9.0_2026Q1 does).

10.x and 11.x keep their PKG_PATH, except on sparc64, where the build now uses the newest 10.0 quarterly that still carries tree, rsync and fuse-sshfs: upstream deleted 10.0_2024Q3, the only complete sparc64 set.

Pins

BUILDER_VERSION 2.2.6 -> 2.2.7 ANYVM_VERSION 0.7.2 (unchanged)

v1.5.1

NetBSD on ubuntu-26.04 runners, and packages on 9.5 again

The action's test matrix now runs on ubuntu-26.04 and ubuntu-26.04-arm: 220 of 221 jobs pass, and the 9p job is skipped as before.

What failed on 26.04

With v1.5.0 on a 26.04 runner:

... (truncated)

Commits

• c8a0d7d Update vmactions/netbsd-vm from base-vm
• 054725d Generated from base-vm
• 5b23cf3 Bump versions from upstream releases
• 7ed8c60 Update version to v1.5.1
• 876c34f Update vmactions/netbsd-vm from base-vm
• f7357ac Generated from base-vm
• d9f80b5 fix 9.5
• 35f290d Update vmactions/netbsd-vm from base-vm
• 59429fe Generated from base-vm
• 55d652b Bump versions from upstream releases
• Additional commits viewable in compare view

Updates vmactions/openbsd-vm from 1.4.7 to 1.4.8

Release notes

Sourced from vmactions/openbsd-vm's releases.

v1.4.8

OpenBSD on ubuntu-26.04 runners

The action's test matrix now runs on ubuntu-26.04 and ubuntu-26.04-arm: 113 of 114 jobs pass, and the 9p job is skipped as before.

What failed on 26.04

With v1.4.7 on a 26.04 runner:

• Every riscv64 job stopped at

  Error: QEMU binary 'qemu-system-riscv64' not found (searched PATH and common install locations).

  Since Ubuntu 25.10 the riscv64 emulator ships in a separate qemu-system-riscv package, no longer in qemu-system-misc.

x86_64, aarch64 and sparc64 were not affected.

Fixes

• The action installs qemu-system-riscv instead of qemu-system-misc for riscv64 on Ubuntu releases newer than 24.04.

The package fix engages only on Ubuntu releases newer than 24.04, so jobs on ubuntu-24.04 run as before. The rest of anyvm 0.7.2's 26.04 work: https://github.com/anyvm-org/anyvm/releases/tag/v0.7.2

Fixed: a lost network probe no longer fails as "Unsupported OS"

vmactions/freebsd-vm#163: a job failed after three minutes with

Error: Unsupported OS: freebsd. Builder repository anyvm-org/freebsd-builder not found.

although the image exists. A single failed probe of the release download URL sent the run down the GitHub REST API. The action never passed a token, so that request was unauthenticated and shared the 60/hour per-IP limit with every other job on the runner IP; the 403 was retried for three minutes and then reported as an unsupported OS. This action took the same path. Two changes close it:

• New input: token. It defaults to github.token and is handed to the VM runtime, so the release lookup is authenticated (1000 requests per hour per repository instead of 60 shared). Nothing to change in

... (truncated)

Commits

• 5f7b2c9 Update vmactions/openbsd-vm from base-vm
• 5119f71 Generated from base-vm
• d22f98e Bump versions from upstream releases
• 37423cc Update vmactions/openbsd-vm from base-vm
• ced3989 Generated from base-vm
• 5ca77d9 Update vmactions/openbsd-vm from base-vm
• 01dd796 Generated from base-vm
• 104bc8f Bump versions from upstream releases
• 8ae27e6 Update vmactions/openbsd-vm from base-vm
• c439765 Generated from base-vm
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage report (cross-platform merged)

Lines covered (src/snmalloc/**): 2832 / 3200 (88.50%)

Merged line coverage is the per-line union across all platforms. Region coverage is reported per-platform only; no cross-platform region total is computed.

Per-directory breakdown

Directory	Lines covered	Lines executable	%
src/snmalloc/stl	2	4	50.00%
src/snmalloc/override	94	156	60.26%
src/snmalloc/pal	343	455	75.38%
src/snmalloc/mitigations	14	18	77.78%
src/snmalloc/aal	52	60	86.67%
src/snmalloc/ds_core	349	399	87.47%
src/snmalloc/global	266	303	87.79%
src/snmalloc/ds	328	357	91.88%
src/snmalloc/backend_helpers	336	356	94.38%
src/snmalloc/mem	849	886	95.82%
src/snmalloc/ds_aal	109	113	96.46%
src/snmalloc/backend	90	93	96.77%

Per-platform contributions (advisory)

Platform	Lines covered	Lines executable	Lines %	Regions covered	Regions executable	Regions %
freebsd-14	4415	4874	90.58%	4115	6282	65.50%
linux-self-host-shim-checks	4572	5033	90.84%	4344	6748	64.37%
linux-self-host-shim-checks-selfhost	1648	2337	70.52%	1503	2931	51.28%
macos-26	4387	4836	90.72%	4142	6303	65.71%
windows-2022	4339	4900	88.55%	4117	6307	65.28%