chore: bump the github-actions group across 1 directory with 11 updates

[dependabot]

Bumps the github-actions group with 11 updates in the / directory:

Package	From	To
dflook/tofu-plan	3.0.0	3.1.0
github/codeql-action/init	4.37.4	4.38.0
github/codeql-action/analyze	4.37.4	4.38.0
docker/setup-qemu-action	4.2.0	4.4.0
docker/setup-buildx-action	4.2.0	4.4.0
docker/build-push-action	7.3.0	7.4.0
actions/attest-build-provenance	4.1.1	4.2.2
DeterminateSystems/determinate-nix-action	3.21.9	3.22.3
jdx/mise-action	4.2.3	4.3.0
Swatinem/rust-cache	2.9.1	2.9.2
gradle/actions/setup-gradle	6.2.0	6.3.0

Updates dflook/tofu-plan from 3.0.0 to 3.1.0

Release notes

Sourced from dflook/tofu-plan's releases.

v3.1.0

This is one of a suite of terraform related actions - find them at dflook/terraform-github-actions.

You can see the changes for this release in the CHANGELOG

You can specify the action version as:

• @v3.1.0 to use exactly this release
• @v3.1 to use the latest patch release for the specific minor version
• @v3 to use the latest patch release for the specific major version

v3.0.1

This is one of a suite of terraform related actions - find them at dflook/terraform-github-actions.

You can see the changes for this release in the CHANGELOG

You can specify the action version as:

• @v3.0.1 to use exactly this release
• @v3.0 to use the latest patch release for the specific minor version
• @v3 to use the latest patch release for the specific major version

Commits

• c741623 v3.1.0
• 5a47499 v3.0.1
• See full diff in compare view

Updates github/codeql-action/init from 4.37.4 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.4 to 4.38.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates docker/setup-qemu-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v4.4.0

• Use the shared error helper for Docker commands by @​crazy-max in docker/setup-qemu-action#345
• Bump @​docker/actions-toolkit from 0.96.0 to 0.100.0 in docker/setup-qemu-action#344
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-qemu-action#340
• Bump js-yaml from 4.3.1 to 4.3.2 in docker/setup-qemu-action#342
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-qemu-action#337

Full Changelog: docker/setup-qemu-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.96.0 in docker/setup-qemu-action#336
• Bump @​sigstore/verify from 3.1.0 to 3.1.1 in docker/setup-qemu-action#316
• Bump brace-expansion from 1.1.15 to 1.1.18 in docker/setup-qemu-action#332
• Bump js-yaml from 4.2.0 to 4.3.1 in docker/setup-qemu-action#334
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-qemu-action#331
• Bump sigstore from 4.1.0 to 4.1.1 in docker/setup-qemu-action#317
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-qemu-action#333

Full Changelog: docker/setup-qemu-action@v4.2.0...v4.3.0

Commits

• 9901266 Merge pull request #342 from docker/dependabot/npm_and_yarn/js-yaml-4.3.2
• 9364d8b Merge pull request #340 from docker/dependabot/npm_and_yarn/humanfs/node-0.16.8
• 95c3240 Merge pull request #337 from docker/dependabot/npm_and_yarn/postcss-selector-...
• c24671a Merge pull request #338 from docker/dependabot/github_actions/codeql-actions-...
• fa83965 Merge pull request #345 from crazy-max/shared-error-helpers
• f396a65 build(deps): bump the codeql-actions group across 1 directory with 2 updates
• a63df2f chore: update generated content
• 3e4165f use the shared error helper for Docker commands
• 18c52d9 Merge pull request #344 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 896cbed [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates docker/setup-buildx-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.0

• Use official Buildx releases for cloud driver by @​crazy-max in docker/setup-buildx-action#606
• Pull BuildKit image before builder creation by @​crazy-max in docker/setup-buildx-action#609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in docker/setup-buildx-action#620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614
• Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

v4.3.0

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in docker/setup-buildx-action#595
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/setup-buildx-action#600
• Bump js-yaml from 5.2.0 to 5.3.0 in docker/setup-buildx-action#585
• Bump postcss from 8.5.10 to 8.5.25 in docker/setup-buildx-action#598
• Bump undici from 6.27.0 to 6.28.0 in docker/setup-buildx-action#601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

Commits

• 594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
• bd6e702 chore: update generated content
• 6268c9d pull BuildKit image before builder creation
• e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
• 533ed8e build(deps): bump the codeql-actions group with 2 updates
• bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
• d5079fb chore: update generated content
• 226a616 use shared error helpers for Buildx and Docker commands
• 77ce7f4 Merge pull request #619 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 0dc1dc9 [dependabot skip] chore: update generated content
• Additional commits viewable in compare view

Updates docker/build-push-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

• Use the shared error helper for Buildx commands by @​crazy-max in docker/build-push-action#1620
• Prevent workflow command injection in metadata logs by @​crazy-max in docker/build-push-action#1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592
• Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613
• Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615
• Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611
• Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606
• Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577
• Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

Commits

• c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 459b674 [dependabot skip] chore: update generated content
• 4dedcb2 chore(deps): Bump @​docker/actions-toolkit from 0.99.0 to 0.100.0
• 379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
• 9877975 chore: update generated content
• 7ed0556 use the shared Buildx error summary helper
• 91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 80dbc86 [dependabot skip] chore: update generated content
• 50cac3a chore(deps): Bump @​docker/actions-toolkit from 0.98.0 to 0.99.0
• 03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
• Additional commits viewable in compare view

Updates actions/attest-build-provenance from 4.1.1 to 4.2.2

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @​dependabot[bot] in actions/attest-build-provenance#862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

Commits

• 4d10147 Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)
• e3fe62e Bump the actions-minor group with 2 updates (#860)
• See full diff in compare view

Updates DeterminateSystems/determinate-nix-action from 3.21.9 to 3.22.3

Release notes

Sourced from DeterminateSystems/determinate-nix-action's releases.

v3.22.3

What's Changed

• Release v3.22.3 by @​github-actions[bot] in DeterminateSystems/determinate-nix-action#80

Full Changelog: DeterminateSystems/determinate-nix-action@v3.22.2...v3.22.3

v3.22.2

What's Changed

• Release v3.22.2 by @​github-actions[bot] in DeterminateSystems/determinate-nix-action#78

Full Changelog: DeterminateSystems/determinate-nix-action@v3.22.1...v3.22.2

v3.22.1

What's Changed

• Release v3.22.1 by @​github-actions[bot] in DeterminateSystems/determinate-nix-action#77

Full Changelog: DeterminateSystems/determinate-nix-action@v3.21.9...v3.22.1

Commits

• 021c8a1 Release v3.22.3 (#80)
• 527f17d Release v3.22.2 (#78)
• 668647a Release v3.22.1 (#77)
• See full diff in compare view

Updates jdx/mise-action from 4.2.3 to 4.3.0

Release notes

Sourced from jdx/mise-action's releases.

v4.3.0: Install age-filtered mise releases

A small release that adds an opt-in way to hold back from installing brand-new mise releases.

Added

minimum_release_age input (#604 by @​jdx)

When version is omitted, you can now set minimum_release_age to install the newest stable, non-draft mise release that is older than a given cutoff — a simple way to avoid picking up a mise release the moment it ships (closes #603).

- uses: jdx/mise-action@v4
  with:
    minimum_release_age: 7d

It accepts relative durations (24h, 7d, 6mo, 1y) as well as absolute ISO dates and timestamps. Age-filtered versions are resolved from the GitHub Releases API (the CDN only serves the latest binary) and downloaded by their exact version. If mise is already present on disk, an age-filtered run updates it to the resolved version rather than keeping the existing binary. An explicit version always takes precedence over minimum_release_age, and invalid dates fail fast.

Full Changelog: jdx/mise-action@v4.2.5...v4.3.0

v4.2.5: Resilient mise downloads with automatic retries

A small patch release that makes setup more resilient to transient network failures when downloading mise.

Fixed

Retry mise downloads after transient failures (#597 by @​jdx)

The download helpers previously made a single curl or wget attempt, so a transient GitHub release-asset HTTP or TLS failure would abort setup before mise or any user command could run (see #596).

Downloads now run through a retry wrapper that makes up to five attempts with a 2s pause between failures, logging a warning on each retry. This applies consistently to binary, checksum, signature, and version fetches. Checksum and minisign verification still run only after a successful download — never inside the retry loop — so integrity guarantees are unchanged.

Full Changelog: jdx/mise-action@v4.2.4...v4.2.5

v4.2.4: Reliable locking detection under forced color

A small patch release that fixes locking-support detection when workflows force colored output.

Fixed

Detect mise install --locked reliably under forced color (#580 by @​scop)

When colored output was forced globally (for example via CLICOLOR_FORCE=1), ANSI escape codes in mise install --help prevented the action from matching --locked in the help text, so locking support was reported as unavailable even on versions of mise that supported it.

The help probe now runs with NO_COLOR=1 in its environment, which overrides CLICOLOR_FORCE and guarantees plain-text output for the feature detection — regardless of the surrounding workflow's color settings.

Full Changelog: jdx/mise-action@v4.2.3...v4.2.4

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

4.3.0 - 2026-08-24

🚀 Features

• add minimum release age for mise (#604) by @​jdx in #604

---

4.2.5 - 2026-08-13

🐛 Bug Fixes

• retry mise downloads after transient failures (#597) by @​jdx in #597

---

4.2.4 - 2026-08-01

🐛 Bug Fixes

• locking support detection with force-colored output (#580) by @​scop in #580

---

4.2.3 - 2026-07-24

🐛 Bug Fixes

• export mise path entries to subsequent steps (#575) by @​jdx in #575

---

4.2.2 - 2026-07-24

🐛 Bug Fixes

• (release-plz) exit when git-cliff produces no version bump (#566) by @​jdx in #566
• ensure tar supports Zstd (#569) by @​JackMyers001 in #569

📚 Documentation

• update default value of cache_key_prefix (#570) by @​muzimuzhi in #570

New Contributors

• @​muzimuzhi made their first contribution in #570
• @​JackMyers001 made their first contribution in #569

---

4.2.1 - 2026-07-16

... (truncated)

Commits

• c2a8761 chore: release v4.3.0 (#605)
• bfedd87 feat: add minimum release age for mise (#604)
• d62ef60 chore(deps): update jdx/renovate-config digest to 75abd12 (#601)
• 42937ce chore(deps): lock file maintenance (#599)
• 3c2e0cf chore: release v4.2.5 (#598)
• 9dda395 fix: retry mise downloads after transient failures (#597)
• 9d2b311 chore(deps): update github/codeql-action action to v4.37.6 (#593)
• 4213fbb chore(deps): update jdx/mise-action action to v4.2.4 (#594)
• 672dbd2 chore(deps): update zizmorcore/zizmor-action action to v0.6.2 (#595)
• 5159765 chore(deps): lock file maintenance (#592)
• Additional commits viewable in compare view

Updates Swatinem/rust-cache from 2.9.1 to 2.9.2

Release notes

Sourced from Swatinem/rust-cache's releases.

v2.9.2

What's Changed

• Typofix by @​23Skidoo in Swatinem/rust-cache#316
• fix: include target names in build/ and .fingerprint/ cleanup by @​eitsupi in Swatinem/rust-cache#317
• fix: include cdylib/rlib/dylib/staticlib targets in build and fingerprint cleanup by @​eitsupi in Swatinem/rust-cache#320
• Scan content of $CARGO_HOME/bin on restore instead of relying on cargo install metadata by @​clechasseur in Swatinem/rust-cache#325
• docs: Update checkout action version to latest by @​sondrelg in Swatinem/rust-cache#345
• Fix Windows cache path validation after Rollup migration by @​eitsupi in Swatinem/rust-cache#355
• fix: support Cargo V2 build dir layout by @​claytonwramsey in Swatinem/rust-cache#371

New Contributors

• @​23Skidoo made their first contribution in Swatinem/rust-cache#316
• @​eitsupi made their first contribution in Swatinem/rust-cache#317
• @​clechasseur made their first contribution in Swatinem/rust-cache#325
• @​sondrelg made their first contribution in Swatinem/rust-cache#345
• @​claytonwramsey made their first contribution in Swatinem/rust-cache#371

Full Changelog: Swatinem/rust-cache@v2.9.1...v2.9.2

Changelog

Sourced from Swatinem/rust-cache's changelog.

Changelog

2.9.2

• Fix credentials.toml cleanup
• Improvements to cleanup, preserving more valid targets
• Improvements to cargo install handling
• Correctly sort/dedupe Rust versions

2.9.1

• Fix regression in hash calculation

2.9.0

• Update to node24
• Support running from within a nix shell
• Consider all installed toolchains for cache key
• Use case-insensitive comparison to determine exact cache hit

2.8.2

• Don't overwrite env for cargo-metadata call

2.8.1

• Set empty CARGO_ENCODED_RUSTFLAGS when retrieving metadata
• Various dependency updates

2.8.0

• Add support for warpbuild cache provider
• Add new cache-workspace-crates feature

2.7.8

• Include CPU arch in the cache key

2.7.7

• Also cache cargo install metadata

2.7.6

• Allow opting out of caching $CARGO_HOME/bin
• Add runner OS in cache key
• Adds an option to do lookup-only of the cache

2.7.5

... (truncated)

Commits

• 6323deb 2.9.2
• b16e8d7 bump rollup and rebuild
• 3bf42ac invert target/profile check in cleanup
• 6e5b278 correctly sort and dedupe Rust versions
• 5adc05f Bump the actions group across 1 directory with 3 updates (#368)
• 66b1e95 fix: support Cargo V2 build dir layout (#371)
• 72d126e Merge pull request #367 from Swatinem/dependabot/npm_and_yarn/dev-patch-2b495...
• 48968d2 Bump the dev-patch group with 2 updates
• 9f151ac update dependencies, rebuild
• 0e24e5d Bump the actions group across 1 directory with 6 updates (#364)
• Additional commits viewable in compare view

Updates gradle/actions/setup-gradle from 6.2.0 to 6.3.0

Release notes

Sourced from gradle/actions/setup-gradle's releases.

v6.3.0

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

• Cache entries failed to store at all on Windows.. Every entry failed with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of @actions/glob combined with a silently swallowed require() in the bundle, which left Windows path separators unnormalized.

• Cache cleanup deleted instrumented jars that were in use. A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created caches/jars-9 entries as unused and remove them, so the instrumented-jars entry was never saved and every job re-instrumented its classpaths.

  Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT] Existing cache entries are invalidated by this release. The cache protocol version was bumped to v2, so the first run after upgrading will be a cache miss and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports (Entry not saved: save failed) in the Job Summary when a cache save fails, rather than reporting success (#1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it (#1025). Thanks to @​reinsch82 for the contribution.

Updated defaults

• Injected Develocity Gradle plugin: 4.4.2 → 4.5.0
• 36 new known-good wrapper checksums added for wrapper-validation

What's Changed

• Render configuration-cache status in the caching Job Summary by

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
blockwire	Ready	Preview	Sep 22, 2026 7:41pm UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.