chore(deps): update github actions

[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-buildx-action (changelog)	action	digest	37fe631 → f87e599
docker/setup-qemu-action (changelog)	action	digest	1f40c72 → 9901266
kindest/node	uses-with	minor	v1.32.2 → v1.37.0
rust (source, changelog)	uses-with	minor	1.98 → 1.99

---

Release Notes

rust-lang/rust (rust)

v1.99.0

Compare Source

==========================

Language

• Add allow-by-default raw_borrows_via_references lint that checks for references that decay immediately into raw borrows
• Extend unconditional_panic lint to function calls that panic when the chunks/windows size is zero
• Stabilize C-variadic function definitions
• Stabilize the ability to use #[unsafe(naked)] functions to define C-variadic functions (#![feature(c_variadic_naked_functions)]).
• Trait methods are now resolved on an adjusted never type (producing a FCW)
• Coerce from inference variables to trait objects if the inference variable is related via subtyping to a type that is known to be Sized
• Stabilize #[my_macro] mod foo;. This allows outlined modules (mod foo;) anywhere in the body of a custom attribute or derive macro.
• Fix the overflowing_literals lint with repeated negation. For instance, it will now no longer lint on --128_i8, which is already detected by the arithmetic_overflow lint.
• Add POSIX symbols to the invalid_runtime_symbol_definitions and suspicious_runtime_symbol_definitions lints
• Lint unused #[path] attributes on inline modules
• Enable unreachable_cfg_select_predicates lint as part of unused lint group
• Stabilize passing 128-bit integers via vector registers with asm! on x86
• Explicitly document that some allocations are allowed to grow in-place (but none are allowed to shrink)
• We now guarantee that the contents of an UnsafeCell can be accessed without going through get
  • The invalid_reference_casting lint was adjusted accordingly
• Account for globally enabled target features in global_asm!
• Warn if an invalid doc attribute is used on a macro invocation

Compiler

• Convert -Ctarget-cpu into a target-modifier for AVR, AMDGCN and NVPTX
• Enable static_position_independent_executables on all gnu targets
• When providing a suggestion about a missing method, rustc now prefers an exactly matching name from a doc alias attribute over a similarity search from other method names. If your new users sometimes expect a method under a different name, adding a doc alias will now help them find it via rustc suggestions, in addition to helping them find it via rustdoc search: When suggesting method names, prefer exact doc aliases over similar names

Platform Support

• Promote riscv64-unknown-linux-musl to Tier 2 with host tools

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

• Iteration on RangeInclusive (a..=b ranges) is now optimized better in some circumstances. As a side effect of this, the behavior of RangeInclusive values that has already been exhausted (as an iterator) has changed. For example, the return values of start() and end() on such ranges may return different values, and using such ranges as slice indexes may have different behavior. These behaviors were not guaranteed to be stable, so these changes are considered to not be breaking changes.
• Relax transmute_copy to accept ?Sized types
• Update transmute_copy to use a non-unwinding panic
• Don't escape U+FF9E and U+FF9F in escape_debug_ext
• Re-export core::fmt::NumBuffer in alloc (and std)

Stabilized APIs

• IntoIterator for Box<[T; N]>
• IntoIterator for &Box<[T; N]>
• IntoIterator for &mut Box<[T; N]>
• VecDeque::retain_back
• core::ffi::VaList
• Box::into_non_null
• Box::from_non_null
• Vec::into_parts
• Vec::from_parts
• core::mem::size_of_val_raw
• core::mem::align_of_val_raw
• core::alloc::Layout::for_value_raw
• String::from_utf8_lossy_owned
• string::FromUtf8Error::into_utf8_lossy
• FusedIterator for StepBy<I>
• std::fs::set_times
• std::fs::set_times_nofollow

Cargo

• Add a new built-in profile debug. This is a preparation for transitioning the dev profile away from debugging to give a saner default for faster development iterations. Currently there is no difference between dev and debug profiles. docs #​17214
• Workspace members on edition 2024 or later can now override an inherited workspace dependency's default-features field. For example, serde = { workspace = true, default-features = false } now turns off default features even when the workspace definition enables them. On earlier editions, default-features = false is ignored with a warning. (RFC 3945) #​17126

See also the full Cargo changelog

Rustdoc

• Add new unused_footnote_definition rustdoc lint
• Smarter filtering of trait impls yields performance improvements of 20% on average and up to 40% on some real-world crates. (1, 2, 3, 4, 5)

Compatibility Notes

• Fully deprecate the legacy integral modules. For example, std::i32::MAX should be accessed via i32::MAX instead.
• Upgrade no_mangle_generic_items into hard error
• The Pin::new_unchecked has had its safety invariants changed slightly
• Do not promote references to extern statics
• Ensure that the inferred types of let patterns typecheck
• hermit/fs: Return unsupported() instead of from_raw_os_error(22)
• Fixed a bug where #[repr(simd)] was accidentally allowed on macro invocations on stable Rust
• Abort const-eval when there are generics in the type of the value being produced
• Attributes not applying to anything are now an error in code blocks in doc comments
• Box::leak: tell people to avoid unleaking
• PowerPC inline ASM: Fix scalar floats being in the wrong vector lane on little endian
• Do not take doc(cfg()) into account when filtering doctests
• Infer anonymous lifetimes in the types of associated consts as 'static
• Macros that expand to a semicolon now produce a warning lint (semicolon_in_expressions_from_non_local_macros) even when the macro comes from another crate. Previously, such warnings only appeared for macros from the same crate, to avoid showing warnings that can't be fixed locally; however, this masked problems, as integration tests from the crate providing the macro get compiled as a separate crate, so tests often wouldn't reveal this issue. If you encounter a lint like this, please make sure to report it to the crate providing the macro so they can fix it; don't just silence it in your own crate.
  • semicolon_in_expressions_from_macros: Lint on non-local macros too
  • Split non-local semicolon_in_expressions_from_macros into a separate lint
• In Cargo, incremental compilation is now disabled by default when running in CI. CI is detected via the CI environment variable. #​17220
• The Rust Reference no longer recommends using a single pattern to match a union alongside another value, such as in a manually-written tagged union. This was because it was found that such code would, in some circumstances, result in the compiler reading the contents of the union before checking if the rest of the scrutinee matches the rest of the pattern. This can cause undefined behavior in code similar to what the reference previously recommended.

Internal Changes

These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.

• Update to LLVM 23

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Three changes: digest bumps for docker/setup-qemu-action and docker/setup-buildx-action (both stay on v4, no tag change), and kindest/node v1.32.2 → v1.37.0 in .github/workflows/e2e.yml.

The node image bump is worth calling out as a positive: go.mod pins k8s.io/api, k8s.io/client-go, k8s.io/apimachinery all at v0.37.0, so the e2e cluster was previously running 5 minors behind the client library version skew the operator is built against. This bump actually removes an existing version mismatch rather than introducing one.

No API usage in this repo is affected by either docker action's digest-only update. CI is still finishing at review time (kind smoke test, CI/Test, CI/Lint, opengrep in progress), but everything that has completed so far is green and nothing points at these three lines.

Nothing blocking.

[github-actions]

SonarQube — aucune nouvelle issue

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}

[ferrfleet]

Follow-up on my earlier approval at d8f6383. Two things changed since then.

CI has now finished, and kind smoke test fails on ad6cd14. The cause is the kindest/node bump, detail inline. That reverses the "nothing blocking" I gave when the job was still running: the version-skew argument for the bump still holds, it just needs the kind version bumped alongside it.

The branch also gained a third digest bump, github/codeql-action/upload-sarif b96794f → 2892aa5, which was not in what I reviewed. That digest is the v4.38.2 release commit on the v4 line, the # v4 comment stays accurate, and scorecard.yml passes no inputs that changed. No concern there. The two docker digests resolve to v4.4.0 (qemu) and v4.4.1 (buildx), both still under the v4 tag.

Automerge is on for this PR, so the failing required check is the only thing holding it.

[ferrfleet]

Follow-up at 736c1cd. Renovate rebuilt the branch and added a Rust toolchain bump (1.98 to 1.99) in ci-rust.yml and cli-release.yml.

Nit: that bump does nothing as it stands. rust-toolchain.toml still has channel = "1.98", and rustup follows it for every cargo call made inside the repo. So the workflow installs 1.99, then lint, test and the release binaries still build on 1.98. Set channel = "1.99" in rust-toolchain.toml in this PR too, so the toolchain is defined in one place. If you'd rather keep Renovate from editing the workflows at all, drop the toolchain: input and let the file decide.

The e2e kind-action thread is still open: node_image is still v1.37.0 and kind is still on the action's default version. kind smoke test was still running when I posted this.

[ferrfleet]

Follow-up at 7a5dd3d. Since 736c1cd, one thing changed: dtolnay/rust-toolchain moved from 6bed076 to 89b1218 in ci-rust.yml and cli-release.yml. 89b1218 is the current head of the action's stable branch, so the # stable comment is still accurate. The new commits add --force-non-host and a retry on checksum failures. That's fine.

The blocking kind-action thread is still open: e2e.yml hasn't changed, so kind still runs at the action's default v0.31.0 against kindest/node:v1.37.0. kind smoke test was still running when I posted this.

[ferrfleet]

Follow-up at af32fd2. Renovate rebased the branch. The four workflow hunks are identical to 7a5dd3d, and scorecard.yml is no longer in the diff, so nothing new to review.

The blocking kind-action thread still applies: node_image is kindest/node:v1.37.0 while kind stays on the action's default v0.31.0, and version/kubectl_version are still unset. kind smoke test was still running when I posted this.

[ferrfleet]

Follow-up at 244885f. The blocking kind-action finding is fixed: e2e.yml now pins kind v0.33.0 and kubectl v1.37.0 for the v1.37.0 node image. I resolved that thread.

The PR no longer bumps dtolnay/rust-toolchain (it stays on 6bed076, same as main). kind smoke test was still running when I posted this, so I haven't seen it pass yet.

[ferrlabs-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.