Skip to content

chore: bump the github-actions group across 2 directories with 3 updates - #1

Closed
dependabot[bot] wants to merge 35 commits into
mainfrom
dependabot/github_actions/github-actions-404dbd48b9
Closed

chore: bump the github-actions group across 2 directories with 3 updates#1
dependabot[bot] wants to merge 35 commits into
mainfrom
dependabot/github_actions/github-actions-404dbd48b9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown

Bumps the github-actions group with 2 updates in the / directory: actions/setup-node and actions/cache.
Bumps the github-actions group with 1 update in the /.github/actions/setup-rust directory: dtolnay/rust-toolchain.

Updates actions/setup-node from 6.5.0 to 7.0.0

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

Full Changelog: actions/setup-node@v6...v7.0.0

Commits
  • 8207627 Migrate to ESM and upgrade dependencies (#1574)
  • 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
  • 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
  • 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
  • 30eb73b Resolve high-severity audit issues
  • 4e1a87a Update dist
  • 360237f Strict equality
  • 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
  • f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
  • 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
  • Additional commits viewable in compare view

Updates actions/cache from 4.3.0 to 6.1.0

Release notes

Sourced from actions/cache's releases.

v6.1.0

What's Changed

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

What's Changed

Full Changelog: actions/cache@v5...v6.0.0

v5.1.0

What's Changed

Full Changelog: actions/cache@v5...v5.1.0

v5.0.5

What's Changed

Full Changelog: actions/cache@v5...v5.0.5

v5.0.4

What's Changed

New Contributors

Full Changelog: actions/cache@v5...v5.0.4

v5.0.3

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE] Relevant for maintainers with write access only.

  1. Switch to a new branch from main.
  2. Run npm test to ensure all tests are passing.
  3. Update the version in https://github.com/actions/cache/blob/main/package.json.
  4. Run npm run build to update the compiled files.
  5. Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.
  6. Run licensed cache to update the license report.
  7. Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.
  8. Commit your changes and push your branch upstream.
  9. Open a pull request against main and get it reviewed and merged.
  10. Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json
    1. Create a new tag with the version number.
    2. Auto generate release notes and update them to match the changes you made in RELEASES.md.
    3. Toggle the set as the latest release option.
    4. Publish the release.
  11. Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml
    1. There should be a workflow run queued with the same version number.
    2. Approve the run to publish the new version and update the major tags for this action.

Changelog

6.1.0

6.0.0

  • Updated @actions/cache to ^6.0.1, @actions/core to ^3.0.1, @actions/exec to ^3.0.0, @actions/io to ^3.0.2
  • Migrated to ESM module system
  • Upgraded Jest to v30 and test infrastructure to be ESM compatible

5.0.4

  • Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)
  • Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)
  • Bump fast-xml-parser to v5.5.6

5.0.3

5.0.2

... (truncated)

Commits
  • 55cc834 Merge pull request #1768 from jasongin/readonly-cache
  • d8cd72f Bump @​actions/cache to v6.1.0 - handle cache write error due to RO token
  • 2c8a9bd Merge pull request #1760 from actions/samirat/esm_migration_and_package_update
  • e9b91fd Prettier fixes
  • e4884b8 Rebuild dist
  • 10baf01 Fixed licenses
  • e39b386 Fix test mock return order
  • b692820 PR feedback
  • 6074912 Rebuild dist bundles as ESM to match type:module
  • 5a912e8 Fix lint and jest issues
  • Additional commits viewable in compare view

Updates dtolnay/rust-toolchain from 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

zsumz and others added 30 commits August 12, 2026 10:29
@zsumz @claude
feat: bootstrap benchmark workspace and repository conventions
72683b7 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(legacy): migrate diagnostic control plane and scenarios
7ed6945 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(adapters): migrate kafkars and librdkafka-c adapters with confor…
0602e8f 
…mance goldens

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
ci: add sibling provenance gate, pinned workflows, and dev compose cl…
7cb8b74 
…uster

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
docs: add versioned evidence schemas and migrated harness docs
743c0d0 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(schema): implement versioned experiment, evidence, and adapter t…
10aaaca 
…ypes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(benchctl): add shared control-plane base of errors, time, and at…
a5cf0d7 
…tempt layout

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
chore(benchctl): reserve engine module and test slots for parallel wo…
194f98f 
…rkstreams

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(benchctl): implement generic resolve, supervise, and always-seal…
1cff2dd 
… pipeline

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(adapters): adopt the versioned adapter protocol in the kafkars a…
3611464 
…dapter

Regenerates the adapter lockfile for the bench-schema path dependency:
94 -> 103 packages (toml closure arrives via bench-schema's source module).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
chore: make every check lane strict now that all lanes exist
d1fcc32 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
test(benchctl): cover the cli binary path and sigint sealing end-to-end
4c78eda 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(schema): add the shared log-linear histogram and producer-benchm…
6b72a51 
…ark v2 contract

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(schema): add suite, capacity, packet, and llm-summary documents …
4948193 
…with subject roles

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(scenarios): add runnable headline pack, cadence manifests, and r…
18cfebf 
…oadmap docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(benchctl): add suite repetitions, capacity search, and v2 classi…
52900b8 
…fication

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(report): add paired bootstrap statistics, request economics, ren…
a7c769b 
…derers, and the analysis packet

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(adapters): give the librdkafka adapter the v2 measured path and …
69dec27 
…byte-exact C histogram

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(adapters): give the kafkars adapter the v2 measured path with po…
1356172 
…oled payloads and bounded slabs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
refactor: unify the declared payload-construction vocabulary and carr…
9d8db82 
…y economics into suite reports

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
fix(adapters): stop masking measurement failures behind session close…
b5929f4 
… and defer client-blocked large-record scenarios

The kafkars adapter's v2 path reported a failed phase as the close error it
caused; the measurement's own diagnosis now leads. The two large-record
headline scenarios move to scenarios/producer/deferred with the sealed
findings recorded: the client's batch_bytes is a hard cap on the encoded
wire batch, and one failure terminal fences producer admission.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(ci): add the pack runner, nightly benchmarks, and guarded openai…
2871d0c 
… narration

The narration follows the zolt house pattern (Responses API, gpt-5.5 default,
request sealed before the call, dry-run offline test) plus this repository's
guardrail: a summary renders only after benchctl packet accepts it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
fix(surface): correct schema mirrors, unbreak the sibling-free quicks…
509e550 
…tart, and guard the librdkafka pin

Schema mirrors now accept every document benchctl writes (validated against
real offline bundles); provenance degrades missing siblings to advisory
outside CI; one lane asserts all eight librdkafka pin copies agree; the
legacy environment-capture edits gain a documented tripwire.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
fix(adapters): align the call_start bracket across adapters and repai…
ee699b4 
…r the review findings

The C adapter stamped call_start before its outstanding-budget wait, the
kafkars adapter after it — swapping the decomposition histograms between
subjects and inverting the admission comparison (the live probe's C
admission p99 fell from 24.9 ms to 225 us once aligned). The bracket rule
is now normative in docs/EVIDENCE.md. Also: a validated measurement
survives a session-close failure, unknown is snapshotted after the flush,
the shim reports death-by-signal, the fatal-path handshake escape no
longer corrupts slots, and offered counts attempts rather than copying
accepted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
fix(engine): preserve sealed evidence, bound histogram indexes, and h…
14d8e7f 
…onor the review verdicts

seal_failure now completes a bundle instead of overwriting rich status;
histogram validation bounds bucket indexes and totals; a group-wide SIGINT
seals interrupted rather than crashed; a truncated suite exits its error's
code; the dispersion gate reads paired-ratio CVs; capacity requires the
probe's own classification; provenance digests every file-shaped argument
and cross-checks declared adapter versions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
docs(evidence): state the full validity gate set and the sealing edge…
e8e30b0 
… cases

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
refactor(report): decompose suite, render, packet, and economics into…
d5cb4db 
… domain modules

Pure moves under the size guardrails; render goldens byte-identical and the
banner constant stays in render.rs where the summary test reads it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(guardrails): enforce file budgets, facade purity, and contract-f…
0ad662b 
…irst source shape

A bench-guardrails crate reads guardrails.toml and gates category line caps
(facade 120, implementation 300, test 500, auxiliary 500) with a justified
exact-line baseline, facade purity, //! contracts, test-sibling naming, and
the async-runtime ban — wired into scripts/check and CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
refactor(benchctl): decompose every oversized module into domain subf…
7ea7ef1 
…olders

Pure moves under the size guardrails; the public item set is byte-identical
and all tests pass unmodified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
refactor(schema,adapters): decompose experiment, source, histogram, p…
6f690f0 
…rotocol, and the v2 engine

Pure moves under the size guardrails; struct shapes verified field-for-field
identical, goldens and conformance vectors byte-stable, hot-path seams follow
the admit/settle/slot boundaries.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
zsumz and others added 5 commits August 12, 2026 17:48
@zsumz @claude
chore(guardrails): accept tests inside their subject's directory and …
8f5d410 
…baseline the schema facade

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz @claude
feat(report): enforce matched execution surfaces and complete stage a…
062ba87 
…ttribution

The declared execution block is now read, not just sealed: a suite gate
fails unmatched payload construction or serialization and notes unlike
ownership; scheduler lateness and the client-internal portion join the
scorecard as non-claimable attribution; attempt comparisons divide by the
declared base under rotation; packet verdicts below the repetition minimum
are inconclusive with the direction preserved as a finding; the README
documents the offline fake-adapter first run; and every verb now says
where its evidence went.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zsumz
feat: adopt public kafkars evidence and zrail guardrails
73a13c9
@zsumz
docs: add benchmarks branding and streamline readme
b50a387
@dependabot
chore: bump the github-actions group across 2 directories with 3 updates
cb02883 
Bumps the github-actions group with 2 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node) and [actions/cache](https://github.com/actions/cache).
Bumps the github-actions group with 1 update in the /.github/actions/setup-rust directory: [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain).


Updates `actions/setup-node` from 6.5.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@2499707...8207627)

Updates `actions/cache` from 4.3.0 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@0057852...55cc834)

Updates `dtolnay/rust-toolchain` from 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](dtolnay/rust-toolchain@2c7215f...6c977a6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dtolnay/rust-toolchain
  dependency-version: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
  dependency-type: direct:production
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 23, 2026
@dependabot
dependabot Bot requested a review from zsumz as a code owner August 23, 2026 16:27
@dependabot dependabot Bot added github_actions Pull requests that update GitHub Actions code dependencies Pull requests that update a dependency file labels Aug 23, 2026
@zsumz zsumz closed this Aug 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-404dbd48b9 branch August 23, 2026 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zsumz zsumz Awaiting requested review from zsumz zsumz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zsumz