[dependabot]

Bumps the actions group with 2 updates: taiki-e/install-action and docker/login-action.

Updates taiki-e/install-action from 2.90.0 to 2.90.3

Release notes

Sourced from taiki-e/install-action's releases.

2.90.3

• Update yq@latest to 4.54.2.

• Update vacuum@latest to 0.39.3.

• Update syft@latest to 1.57.0.

• Update rclone@latest to 1.76.0.

• Update protoc-gen-connect-openapi@latest to 0.30.0.

• Update mise@latest to 2026.11.3.

• Update kingfisher@latest to 2.17.0.

• Update biome@latest to 2.6.6.

2.90.2

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

2.90.1

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.3] - 2026-11-08

• Update yq@latest to 4.54.2.

• Update vacuum@latest to 0.39.3.

• Update syft@latest to 1.57.0.

• Update rclone@latest to 1.76.0.

• Update protoc-gen-connect-openapi@latest to 0.30.0.

• Update mise@latest to 2026.11.3.

• Update kingfisher@latest to 2.17.0.

• Update biome@latest to 2.6.6.

[2.90.2] - 2026-11-06

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

[2.90.1] - 2026-11-04

... (truncated)

Commits

• cfdb7ed Release 2.90.3
• 0a71219 Update yq@latest to 4.54.2
• 4072c98 Update vacuum@latest to 0.39.3
• d429e9b Update syft@latest to 1.57.0
• 24c2628 Update rclone@latest to 1.76.0
• ab9bbc8 Update protoc-gen-connect-openapi@latest to 0.30.0
• 4bff33f Update mise@latest to 2026.11.3
• cdf8dc3 Update kingfisher@latest to 2.17.0
• b8b14a4 Update biome@latest to 2.6.6
• 3a3daaf Release 2.90.2
• Additional commits viewable in compare view

Updates docker/login-action from 4.7.0 to 4.8.0

Release notes

Sourced from docker/login-action's releases.

v4.8.0

• Set Docker Hub OIDC token lifetime default to 1 hour by @​crazy-max in docker/login-action#1070
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1161.0 in docker/login-action#1103
• Bump @​docker/actions-toolkit from 0.107.0 to 0.109.0 in docker/login-action#1105
• Bump vite from 7.3.6 to 7.3.7 in docker/login-action#1101

Full Changelog: docker/login-action@v4.7.0...v4.8.0

Commits

• 8aa5831 Merge pull request #1105 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 043f81d [dependabot skip] chore: update generated content
• 3ff6998 build(deps): bump @​docker/actions-toolkit from 0.107.0 to 0.109.0
• 694ef6a Merge pull request #1103 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• 7c6e412 [dependabot skip] chore: update generated content
• aa2441f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• d6c10b0 Merge pull request #1106 from docker/dependabot/github_actions/codeql-actions...
• 319f1ee Merge pull request #1104 from docker/dependabot/github_actions/actions/setup-...
• b483b7f Merge pull request #1101 from docker/dependabot/npm_and_yarn/vite-7.3.7
• dc7d67c Merge pull request #1070 from crazy-max/increase-oidc-default-expiry
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Speed against 8e088cd1

Measured on AMD EPYC 9V45 96-Core Processor.
Both sides built with rustc 1.99.1 (58cf8f9c3 2026-10-13).

Both sides built and run on this runner in this job, the way
scripts/speed.sh measures a perf commit. Each round runs
both sides on a layout of its own, the same compiled code with
its code and data shuffled and moved, so the 95% interval carries
where the code landed as well as the run. The verdict holds the
interval against a 1% threshold. The default layout, the one a
release ships, is measured after as a diagnostic. The node
counts are the search's: they move when the search does, and a
speed change leaves them alone.

round     base nps  candidate nps  change
    1      7657067        7253698   -5.3%
    2      7210415        6716958   -6.8%
    3      6871747        7119973   +3.6%
    4      6718522        6540987   -2.6%
    5      7174217        7386667   +3.0%
    6      7772961        7608954   -2.1%
    7      7600364        6373244  -16.1%
    8      7725379        6316472  -18.2%
    9      7681854        6962474   -9.4%
   10      6170441        6865018  +11.3%
   11      6118846        6219912   +1.7%
   12      6740254        6550241   -2.8%
   13      6888120        7700125  +11.8%
   14      6927343        7858972  +13.4%
   15      6406575        6364299   -0.7%
   16      6329539        6161938   -2.6%
   17      7381099        6166568  -16.5%
   18      7159562        6596798   -7.9%
   19      7475597        6870507   -8.1%
   20      7847674        7089371   -9.7%
   21      7551552        7422877   -1.7%
   22      6873563        6616555   -3.7%
   23      7110873        6183465  -13.0%
   24      6816639        6616485   -2.9%
   25      6684105        7864288  +17.7%
   26      8265941        8083185   -2.2%
   27      8204096        7780284   -5.2%
   28      7236976        7418206   +2.5%
   29      7647283        7699822   +0.7%
   30      7382059        7828178   +6.0%
   31      8062786        7724567   -4.2%
   32      7603934        7280922   -4.2%
   33      6924256        7811921  +12.8%
   34      6481621        7777055  +20.0%
   35      8059525        7919972   -1.7%
   36      7677682        7152953   -6.8%
   37      7226637        7395441   +2.3%
   38      8140611        7981904   -1.9%
   39      7629531        7896984   +3.5%
   40      7903699        8280289   +4.8%

              nodes    time  median nps  faster half
base       11916992  1.63 s     7309038      7763535
candidate  11916992  1.64 s     7267310      7736031
change                            -0.6%        -0.4%

paired change -1.8%, 95% interval -4.0% to +1.0%
diagnostic, on the default layout alone -3.0%, 95% interval -5.2% to -0.2%, 13 rounds

not resolved: the interval reaches past ±1.0% without clearing it, so
more rounds are needed to say either way

Speed: -1.8% (bench nps, 95% interval -4.0% to +1.0%, 40 interleaved rounds over shuffled layouts vs 8e088cd1)

The instructions each side's bench executed, counted under
cachegrind. The count repeats to within a few hundred
instructions, so a small change here is a real one, but it
prices instructions only: cache misses, mispredicted branches
and where the code lands are the speed's to show.

instructions against 8e088cd1, one cachegrind run a side, bench

             instructions     nodes  per node
base       15,968,705,908  11916992    1340.0
candidate  15,968,705,907  11916992    1340.0
change             -0.00%              -0.00%

within ±0.7%, as far as edits not made for speed have moved the count