Bump the github-actions group across 1 directory with 5 updates

[dependabot]

Bumps the github-actions group with 5 updates in the / directory:

Package	From	To
docker/setup-buildx-action	4.3.0	4.4.1
docker/build-push-action	7.3.0	7.4.0
hendrikmuhs/ccache-action	1.2.23	1.2.24
vmactions/freebsd-vm	1.5.5	1.5.7
vmactions/netbsd-vm	1.4.7	1.5.0

Updates docker/setup-buildx-action from 4.3.0 to 4.4.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.4.1

• Skip BuildKit image pre-pulls for explicit endpoints by @​crazy-max in docker/setup-buildx-action#624

Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1

v4.4.0

• Use official Buildx releases for cloud driver by @​crazy-max in docker/setup-buildx-action#606
• Pull BuildKit image before builder creation by @​crazy-max in docker/setup-buildx-action#609
• Use shared error helpers for Buildx and Docker commands by @​crazy-max in docker/setup-buildx-action#620
• Bump @​docker/actions-toolkit from 0.95.0 to 0.100.0 in docker/setup-buildx-action#610 docker/setup-buildx-action#618 docker/setup-buildx-action#619
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/setup-buildx-action#614
• Bump js-yaml from 5.3.0 to 5.4.2 in docker/setup-buildx-action#608 docker/setup-buildx-action#617
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/setup-buildx-action#611

Full Changelog: docker/setup-buildx-action@v4.3.0...v4.4.0

Commits

• f87e599 Merge pull request #624 from crazy-max/skip-pull-with-endpoint
• e700274 chore: update generated content
• 3061c91 skip BuildKit image pre-pulls for explicit endpoints
• 594f3bf Merge pull request #609 from crazy-max/pull-buildkit-image-before-create
• bd6e702 chore: update generated content
• 6268c9d pull BuildKit image before builder creation
• e823525 Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...
• 533ed8e build(deps): bump the codeql-actions group with 2 updates
• bedaf13 Merge pull request #620 from crazy-max/shared-error-helpers
• d5079fb chore: update generated content
• Additional commits viewable in compare view

Updates docker/build-push-action from 7.3.0 to 7.4.0

Release notes

Sourced from docker/build-push-action's releases.

v7.4.0

• Use the shared error helper for Buildx commands by @​crazy-max in docker/build-push-action#1620
• Prevent workflow command injection in metadata logs by @​crazy-max in docker/build-push-action#1617
• Bump @​docker/actions-toolkit from 0.92.0 to 0.100.0 in docker/build-push-action#1614 docker/build-push-action#1618 docker/build-push-action#1621
• Bump @​humanfs/node from 0.16.7 to 0.16.8 in docker/build-push-action#1609
• Bump brace-expansion from 1.1.13 to 1.1.18 in docker/build-push-action#1592
• Bump csv-parse from 7.0.0 to 7.0.2 in docker/build-push-action#1613
• Bump js-yaml from 4.3.0 to 4.3.2 in docker/build-push-action#1605 docker/build-push-action#1615
• Bump nanoid from 3.3.16 to 3.3.18 in docker/build-push-action#1611
• Bump postcss from 8.5.10 to 8.5.25 in docker/build-push-action#1590
• Bump postcss-selector-parser from 7.1.1 to 7.1.5 in docker/build-push-action#1606
• Bump sigstore from 4.1.0 to 4.1.1 in docker/build-push-action#1577
• Bump undici from 6.27.0 to 6.28.0 in docker/build-push-action#1594

Full Changelog: docker/build-push-action@v7.3.0...v7.4.0

Commits

• c3c9e26 Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 459b674 [dependabot skip] chore: update generated content
• 4dedcb2 chore(deps): Bump @​docker/actions-toolkit from 0.99.0 to 0.100.0
• 379bf63 Merge pull request #1620 from crazy-max/buildx-error-message
• 9877975 chore: update generated content
• 7ed0556 use the shared Buildx error summary helper
• 91670ba Merge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 80dbc86 [dependabot skip] chore: update generated content
• 50cac3a chore(deps): Bump @​docker/actions-toolkit from 0.98.0 to 0.99.0
• 03b4d6c Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands
• Additional commits viewable in compare view

Updates hendrikmuhs/ccache-action from 1.2.23 to 1.2.24

Release notes

Sourced from hendrikmuhs/ccache-action's releases.

v1.2.24

What's Changed

• metadata: Add release of ccache on linux-riscv64 by @​luhenry in hendrikmuhs/ccache-action#442
• Update sccache to 0.15.0 by @​luhenry in hendrikmuhs/ccache-action#444

dependabot updates

• Bump fast-xml-builder from 1.1.4 to 1.2.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#445
• Bump jest from 30.3.0 to 30.4.2 by @​dependabot[bot] in hendrikmuhs/ccache-action#446
• Bump @​types/node from 25.6.0 to 25.9.1 by @​dependabot[bot] in hendrikmuhs/ccache-action#449
• Bump fast-xml-parser from 5.5.7 to 5.8.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#443
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in hendrikmuhs/ccache-action#454
• Bump @​vercel/ncc from 0.38.4 to 0.44.1 by @​dependabot[bot] in hendrikmuhs/ccache-action#458
• Bump to sccache v0.17.0 and ccache v4.13.6 by @​luhenry in hendrikmuhs/ccache-action#464
• Bump @​types/node from 25.9.1 to 26.2.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#461
• Bump @​actions/cache from 6.0.0 to 6.2.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#460
• Bump undici from 6.24.1 to 6.28.0 by @​dependabot[bot] in hendrikmuhs/ccache-action#462
• Bump brace-expansion by @​dependabot[bot] in hendrikmuhs/ccache-action#463

Full Changelog: hendrikmuhs/ccache-action@v1.2.23...v1.2.24

Commits

• f09c25b update code
• 19aa42b Bump brace-expansion (#463)
• de5fb03 Bump undici from 6.24.1 to 6.28.0 (#462)
• 480c732 Bump @​actions/cache from 6.0.0 to 6.2.0 (#460)
• 613119f Bump @​types/node from 25.9.1 to 26.2.0 (#461)
• 32bcd49 Bump to sccache v0.17.0 and ccache v4.13.6 (#464)
• 9e3d904 Bump @​vercel/ncc from 0.38.4 to 0.44.1 (#458)
• 9bb417d Bump actions/checkout from 6 to 7 (#454)
• 9e72c68 update code after package updates
• 5685f76 Bump fast-xml-parser from 5.5.7 to 5.8.0 (#443)
• Additional commits viewable in compare view

Updates vmactions/freebsd-vm from 1.5.5 to 1.5.7

Release notes

Sourced from vmactions/freebsd-vm's releases.

v1.5.7

FreeBSD 10.4 and 11.4, and a fix for "Unsupported OS: freebsd"

New releases

FreeBSD 10.4 and 11.4 on x86_64, from image builder 2.2.8. The action now offers 15 releases; the default is still 15.1.

• uses: vmactions/freebsd-vm@v1 with: release: "10.4"

The leading-part form works too: release: "10" and release: "11" pick the newest matching release, so the action now ships 10, 11, 12, 13, 14 and 15.

pkg.FreeBSD.org dropped its FreeBSD 10, 11 and 12 repositories long ago, so these images take their packages from the preserved SGGS mirror (https://mirror.sg.gs/freebsd-pkg/), which keeps FreeBSD's original repository signatures; pkg verifies them against the fingerprint shipped in the base system. Two things the VM runtime had to learn to run them: 10.x and 11.x boot via SeaBIOS, since their images have no EFI system partition, and 10.4 runs on QEMU's qemu64 CPU model, because FreeBSD 10's signal delivery panics when -cpu host exposes modern XSAVE features.

12.4 x86_64 gains rsync and sshfs

The same mirror reaches 12.4 x86_64: the image now ships rsync and fusefs-sshfs, so all five sync methods work there instead of nfs, scp and tar only. 12.4 aarch64 stays base-only; no aarch64 packages exist for FreeBSD 12.

Fixed: a lost network probe no longer fails as "Unsupported OS"

#163: a job with release: '14.0' failed after three minutes with

Error: Unsupported OS: freebsd. Builder repository anyvm-org/freebsd-builder not found.

although the image exists. A single failed probe of the release download URL sent the run down the GitHub REST API. The action never passed a token, so that request was unauthenticated and shared the 60/hour per-IP limit with every other job on the runner IP; the 403 was retried for three minutes and then reported as an unsupported OS. Two changes close this:

... (truncated)

Commits

• 4469451 Update vmactions/freebsd-vm from base-vm
• a1432a5 Generated from base-vm
• 95e5c02 Update vmactions/freebsd-vm from base-vm
• 7c33c64 Generated from base-vm
• 92f7fa4 Bump versions from upstream releases
• c0e53c3 Update vmactions/freebsd-vm from base-vm
• 11feb8f Generated from base-vm
• 224f1ac Update version to v1.5.6
• e978178 Update vmactions/freebsd-vm from base-vm
• 2e17369 Generated from base-vm
• Additional commits viewable in compare view

Updates vmactions/netbsd-vm from 1.4.7 to 1.5.0

Release notes

Sourced from vmactions/netbsd-vm's releases.

v1.5.0

add 9.5

Full Changelog: vmactions/netbsd-vm@v1.4.9...v1.5.0

v1.4.9

support "11.0-microvm", which boots in 7 seconds. fix pkgsrc.

Full Changelog: vmactions/netbsd-vm@v1.4.8...v1.4.9

v1.4.8

Package mirrors: probe first, then trust

On 2026-08-30 the NetBSD.org package hosts went down together -- cdn.NetBSD.org and ftp.NetBSD.org are the same infrastructure behind a CDN, not independent mirrors -- and every pkg_add in every job spent minutes per package in TLS timeouts before dying.

The VM now probes the package mirrors at startup and points pkg_add at the ones that actually answer: cdn.NetBSD.org, ftp.NetBSD.org, the official French mirror ftp.fr.NetBSD.org, ftp.jaist.ac.jp and ftp.allbsd.org, in that order, keeping only the live ones. Dead hosts are dropped entirely rather than kept as fallbacks, because pkg_add walks the whole list for every package it installs, and each dead https entry costs minutes per package. If nothing answers, the configuration is left untouched.

This also retires a long-standing trap in the image's default configuration: its PKG_PATH ended with a NetBSD 9.0 fallback, so a package missing from the preferred hosts was silently installed from the 9.0 set, linked against libraries the running release does not ship. All entries are now same-release only.

The probe runs on every VM start, including boots from a cache-after-prepare image, so the mirror list is always from the current run, never frozen into a cache. Verified during the outage itself: with both NetBSD.org hosts dead, prepare installed its packages from the French mirror on the first try.

Under the hood

The runtime moves to anyvm v0.6.6. Changes under hooks/ now retrigger the project generation, so a hook fix is picked up by the test matrix without waiting for the daily rebuild.

Full Changelog: vmactions/netbsd-vm@v1.4.7...v1.4.8

Commits

• 20ee93a Update vmactions/netbsd-vm from base-vm
• 74dcc69 Generated from base-vm
• 2a8c76a Update vmactions/netbsd-vm from base-vm
• 7ebe4d4 Generated from base-vm
• a031b05 minor
• 2e1d6ef Update version to v1.4.9
• 0794073 Bump versions from upstream releases
• dae01dc Update vmactions/netbsd-vm from base-vm
• 2b17136 Generated from base-vm
• fa16db4 Update vmactions/netbsd-vm from base-vm
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage report (cross-platform merged)

Lines covered (src/snmalloc/**): 2834 / 3193 (88.76%)

Merged line coverage is the per-line union across all platforms. Region coverage is reported per-platform only; no cross-platform region total is computed.

Per-directory breakdown

Directory	Lines covered	Lines executable	%
src/snmalloc/stl	2	4	50.00%
src/snmalloc/override	94	156	60.26%
src/snmalloc/pal	343	449	76.39%
src/snmalloc/mitigations	14	18	77.78%
src/snmalloc/aal	52	60	86.67%
src/snmalloc/ds_core	349	399	87.47%
src/snmalloc/global	266	303	87.79%
src/snmalloc/ds	328	357	91.88%
src/snmalloc/backend_helpers	336	356	94.38%
src/snmalloc/mem	852	886	96.16%
src/snmalloc/ds_aal	108	112	96.43%
src/snmalloc/backend	90	93	96.77%

Per-platform contributions (advisory)

Platform	Lines covered	Lines executable	Lines %	Regions covered	Regions executable	Regions %
freebsd-14	4412	4871	90.58%	4112	6280	65.48%
linux-self-host-shim-checks	4570	5031	90.84%	4341	6746	64.35%
linux-self-host-shim-checks-selfhost	1643	2337	70.30%	1494	2931	50.97%
macos-26	4384	4834	90.69%	4139	6301	65.69%
windows-2022	4312	4854	88.83%	4089	6263	65.29%