build(deps): bump the actions group across 1 directory with 4 updates by dependabot[bot] · Pull Request #50 · Bing-su/rcf3

dependabot · 2026-11-03T20:12:59Z

Bumps the actions group with 4 updates in the / directory: bencherdev/bencher, astral-sh/setup-uv, j178/prek-action and rust-lang/crates-io-auth-action.

Updates bencherdev/bencher from 0.6.13 to 0.6.16

Release notes

Sourced from bencherdev/bencher's releases.

v0.6.16

Link a GitHub repository to a Project in its Settings, and a detached Bare Metal run on GitHub Actions no longer needs --ci-callback-token

v0.6.15

Add Bencher to the ChatGPT and Codex plugins directory

List exact matches first, then the most recently used, in the Console search menus for Branches, Testbeds, Benchmarks, Measures, Parameters, and Metrics (Thank you thomaseizinger)

A project key can now create and update plots with POST /v0/projects/{project}/plots and PATCH /v0/projects/{project}/plots/{plot}, and Bencher MCP adds the create_plot and update_plot tools

BREAKING CHANGE Remove the perf image endpoint (GET /v0/projects/{project}/perf/img) and the MCP perf_image tool; embed the perf plot from a public project's perf page instead

With --github-actions, the jobs of a Project on a pull request now share one comment with a numbered Report row per job, and --ci-id labels the job's Report

v0.6.14

Add --start-point-idempotency-key (or BENCHER_START_POINT_IDEMPOTENCY_KEY) to bencher run, bencher report create, and bencher branch update, so parallel jobs that reset a Branch with the same key share one Head; in GitHub Actions, bencher run defaults the key to the workflow run attempt

Fix concurrent runs on a Branch failing when they create the same Thresholds, such as parallel runs that clone Thresholds from a start point; the first run creates them and the rest use them

Add GET /v0/server/health, which checks that the API server runs and reaches its database

BREAKING CHANGE Remove GET /v0/projects. List an organization's projects with GET /v0/organizations/{organization}/projects, which bencher project list now calls with a required organization argument, and the MCP list_projects tool now takes an organization and asks an anonymous caller to sign in

Add --image-cache-size to runner up (or BENCHER_IMAGE_CACHE_SIZE), the bytes of Image config and layer blobs a Bare Metal Runner keeps across Jobs in blobs under its --state-dir, so a Job downloads only the blobs the Runner does not already hold, while its manifest still comes from the registry. Between Jobs the least recently used blobs are removed until the rest fit, a Runner given a size exits at startup if it cannot make the store its own, and without one the Runner keeps none

A Bare Metal Job whose image cannot be pulled or prepared now fails, even with --allow-failure, instead of completing with no results

A Bare Metal build time now covers the image's command alone, timed where the command runs, and no longer includes the image pull, unpack, and boot; only an iteration whose command succeeds reports one

Support Hyperfine 2 JSON output in the shell_hyperfine adapter (Thank you mrazauskas)

Fix a very large page query parameter returning the wrong page

BREAKING CHANGE Cap perf queries at 8 branches, testbeds, benchmarks, and measures each, and at 64 permutations and 64 lines; extra entries are ignored rather than refused

Add a plus_limit server config option for the daily metrics limit of organizations with a Bencher Plus plan

BREAKING CHANGE Cap a plot at 8 branches, testbeds, benchmarks, and measures each

Cap active Thresholds at 64 per Branch, Testbed, and Measure, and skip the Thresholds a report cannot create (over a cap or over the daily creation limit) instead of failing the report

BREAKING CHANGE The plus.litestream server config key is removed; use plus.disaster_recovery. A config that still uses plus.litestream is ignored and disaster recovery does not run at all: no restore at startup and no replication

BREAKING CHANGE The sftp disaster recovery replica scheme is removed; file and s3 remain

BREAKING CHANGE The on demand database backup is removed: POST /v0/server/backup, bencher server backup, and the database.data_store server config section

BREAKING CHANGE The container registry storage config moves from plus.registry.data_store (service: aws_s3, an S3 access point ARN) to plus.registry.storage (scheme: file | s3, a bucket plus optional endpoint, region, and path), and any S3-compatible object store now works. Stored keys and the local directory layout are unchanged for a plain prefix, so existing data is picked up as is; a path that began or ended with a slash is now normalized, and one containing a character the store percent-encodes is now encoded, so see the config reference before upgrading. A config that still carries data_store is ignored and the registry falls back to local files

BREAKING CHANGE A Bare Metal Runner that executes sandboxed Jobs must now run as root, where before it did not. Confining the Firecracker VMM requires privileges that enabling KVM does not grant: mknod to create the sandbox's /dev/kvm, chown to hand the guest images to the sandbox user, pivot_root, and setns to join an empty network namespace. A world-readable /dev/kvm is enough to use KVM unprivileged but not to build the sandbox around it. Start runner up as root, or as a service that starts it as root. If you cannot run as root, start the Runner with --danger-allow-no-sandbox and assign it only Specs with no Sandbox; be aware that this gives up the microVM itself and not just its confinement, so those Jobs execute directly on the host

Confine the Firecracker VMM on Bare Metal Runners with the Firecracker jailer: the VMM behind each sandboxed Job now runs in a chroot as a dedicated unprivileged user, in an empty network namespace, and is placed in its cgroup before it starts, so a VMM escape no longer lands as root on the Runner host holding the Runner key and every prior Job's work. The user defaults to 61016 and is settable with --jail-uid/--jail-gid, neither of which may be 0

Add --state-dir to the Runner (default /var/lib/bencher-runner), a persistent directory holding the chroot each sandboxed Job's VMM runs in. Before every sandboxed Job it is swept of anything a previous Runner left behind, since a Runner killed mid-Job cannot clean up after itself. A host runs one Runner at a time, whatever its state directory: a Runner started as root holds /run/bencher/runner.lock for as long as it runs, and a second one started as root exits at once with an error naming that lock; a Runner that is not root cannot open the lock and runs without it. When a Runner started as root comes up, and again before each sandboxed Job, it kills any process still running in a cgroup under /sys/fs/cgroup/bencher, such as the sandbox of a Runner killed mid-Job, whatever that Runner's state directory

BREAKING CHANGE Sandboxed Jobs on Bare Metal Runners now need Linux 5.14 or later and a writable cgroup v2 hierarchy on every host, a one-core host included: each sandboxed Job runs in its own cgroup under /sys/fs/cgroup/bencher, with the cpuset, memory, and pids controllers enabled, and the Runner kills a Job's processes, and anything a Runner left there, through that cgroup's cgroup.kill. On an older kernel a Runner exits at startup or, started with --danger-allow-no-sandbox, fails each sandboxed Job

Write Runner logs to stderr as JSON, and stop relaying a Job's output into runner up's log

BREAKING CHANGE Remove --grace-period from runner up and runner run, so a Runner started with it now fails to parse its arguments. A sandboxed Job's results now leave the guest on a drive the Runner reads only once the VM has powered off, so there is no grace period left to wait out: each sandboxed Job ends about a second sooner, a guest that powers off without its results fails the Job at once rather than at its timeout, and a guest still running at its timeout has a few more seconds to write its results and power off before it is killed

BREAKING CHANGE POST /v0/runners/{runner}/specs and bencher runner spec add now return the Runner, with its updated specs, instead of the Spec. Older CLI versions still add the Spec but cannot parse the new response, so update the CLI before using bencher runner spec add

Show a Runner's last heartbeat and its latest status (taking Jobs or paused, why it is paused, and its disk health) on the admin Runner endpoints and in bencher system runner view

Email server admins when a Runner's disk health changes or shows a new problem, when a Runner stays paused for more than 12 hours, and when it takes Jobs again

Pause a Bare Metal Runner between Jobs while an md RAID array on its host resyncs, recovers, checks, repairs, or reshapes: it takes no new Job until the sync is done and never stops a running one. Start runner up with --no-raid-pause to keep taking Jobs

Have a Bare Metal Runner take turns with host maintenance: it holds /run/bencher/job.lock through each Job, and pauses while another process holds the lock or a marker named /run/bencher/maintenance or /run/bencher/maintenance.<name> exists, so touch /run/bencher/maintenance drains it. runner run waits for the lock too. /run/bencher is now root's alone

Report a Bare Metal Runner's disk health with each ready and paused: its md arrays at every poll, and its NVMe drives' SMART / health logs at most hourly, which needs root

Record the project key that creates a Report, which the Report now names in project_key

Deleting a Project now requires the Maintainer role, which Organization Leaders and server admins hold

Add --threshold-metric and --threshold-parameters to bencher run and bencher report create to declare the metric and the parameters a Threshold checks

Add optional metrics, hidden, focus, and layout fields to plots, so a pinned plot keeps the metrics it draws, the lines it hides, the line it focuses, and how it lays out its measures; set them with POST /v0/projects/{project}/plots, and change them, or clear them with null, with PATCH /v0/projects/{project}/plots/{plot}

Filter the Reports list by adapter and alerts=active, and count each Report iteration's lines

Cap a project at 64 plots: POST /v0/projects/{project}/plots refuses another with a 400 until one is deleted

Add --bmf-version to bencher project update, so a server admin can move a Project to BMF version 1

BREAKING CHANGE Security fix for URL validation: a project URL must now use http or https, an existing project URL that does not is shown as plain text, and the Console no longer links to a URL with any other scheme

... (truncated)

Commits

7de3c69 Release v0.6.16
19b5a17 Document the linked repository for detached runs (#1340)
0093d8f Link a GitHub repository from the console (#1339)
5451622 Mint the dispatch token for a linked repository (#1321)
a8c617a Link a GitHub repository to a project (#1314)
4ef63a4 Add the GitHub App config and client (#1301)
8798959 Name the Pro plan instead of the retired Team plan in the docs (#1416)
24c333d Release v0.6.15
3a0ee19 Document one pull request comment per Project (#1342)
139c30f Write one pull request comment per Project (#1341)
Additional commits viewable in compare view

Updates astral-sh/setup-uv from 10.2.0 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @soujasK for a set of bugfixes 👏

🐛 Bug fixes

Use Astral mirror for version manifests with GitHub fallback @eifinger (#1119)

fix: allow whitespace in uv requirement specifiers @soujasK (#1112)

fix: resolve ~= specifiers with PEP 440 semantics @soujasK (#1111)

fix: only report a saved cache when saving succeeded @soujasK (#1110)

🧰 Maintenance

chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

docs: use JSDoc for compatible release specifier comment @eifinger (#1113)

docs: update version references to v10.3.2 @github-actions[bot] (#1104)

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

chore: update known checksums for 0.13.5 @github-actions[bot] (#1103)

📚 Documentation

docs: update version references to v10.3.1 @github-actions[bot] (#1102)

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

fix: preserve cache error class names in save-cache bundle @dannyward630 (#1093)

🧰 Maintenance

... (truncated)

Commits

68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
0192b69 chore: update known checksums for 0.13.6 (#1117)
2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
36b7b57 fix: only report a saved cache when saving succeeded (#1110)
56618ca docs: update version references to v10.3.2 (#1104)
07a047e chore: update known checksums for 0.13.5 (#1103)
e1b8536 docs: update version references to v10.3.1 (#1102)
18d369b chore(deps): roll up Dependabot updates (#1101)
Additional commits viewable in compare view

Updates j178/prek-action from 3.0.0 to 3.1.0

Release notes

Sourced from j178/prek-action's releases.

v3.1.0

What's Changed

Add sha256 input for prek downloads by @j178 in j178/prek-action#184

Support latest-known for prek versions by @j178 in j178/prek-action#193

Full Changelog: j178/prek-action@v3.0.2...v3.1.0

v3.0.2

What's Changed

Preserve class names in bundled dist by @TheKevJames in j178/prek-action#181

Update known versions for prek 0.5.6 by @j178 in j178/prek-action#182

New Contributors

@TheKevJames made their first contribution in j178/prek-action#181

Full Changelog: j178/prek-action@v3.0.1...v3.0.2

v3.0.1

What's Changed

Update known versions for prek 0.4.12 by @j178 in j178/prek-action#171

Update known versions for prek 0.4.13 by @j178 in j178/prek-action#172

Update known versions for prek 0.4.14 by @j178 in j178/prek-action#173

Update known versions for prek 0.5.0 by @j178 in j178/prek-action#174

Update known versions for prek 0.5.1 by @j178 in j178/prek-action#175

Update known versions for prek 0.5.2 by @j178 in j178/prek-action#176

Update known versions for prek 0.5.3 by @j178 in j178/prek-action#177

Update known versions for prek 0.5.4 by @j178 in j178/prek-action#178

Update known versions for prek 0.5.5 by @j178 in j178/prek-action#179

Full Changelog: j178/prek-action@v3.0.0...v3.0.1

Commits

44924fe Update dependency string-argv to ^0.4.0 (#194)
02957df Support latest-known for prek versions (#193)
a8c7a75 Update dependency @actions/cache to v6.3.0 (#188)
906445e Update npm dev dependencies (#189)
d04c8ff Update actions/setup-node action to v7 (#190)
2239efc Update npm dev dependencies (major) (#192)
54d6013 Update pre-commit hook biomejs/pre-commit to v2.5.15 (#187)
e6767ad Update GitHub Actions (#186)
681cfae Update dependency j178/prek-action to v3 (#191)
53f334a Improve README inputs and example headings (#185)
Additional commits viewable in compare view

Updates rust-lang/crates-io-auth-action from 1.0.5 to 1.0.6

Release notes

Sourced from rust-lang/crates-io-auth-action's releases.

v1.0.6

What's Changed

update dependencies

Full Changelog: rust-lang/crates-io-auth-action@v1.0.5...v1.0.6

Commits

3268eb4 Merge pull request #278 from marcoienibot/chore/update-dependencies-2026-10
e901356 chore(deps): update dependencies and GitHub Actions
9c067fc Merge pull request #277 from rust-lang/renovate/msw-3.x
9b55005 chore(deps): update dependency msw to v3
4920f09 Merge pull request #276 from rust-lang/renovate/major-github-actions
04dcccb chore(deps): update github actions
82864bf Merge pull request #274 from rust-lang/renovate/major-vitest-monorepo
2bd8e07 chore(deps): update dependency vitest to v5
f14f407 Merge pull request #271 from rust-lang/renovate/github-actions
0205d6c chore(deps): update github actions
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 4 updates in the / directory: [bencherdev/bencher](https://github.com/bencherdev/bencher), [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [j178/prek-action](https://github.com/j178/prek-action) and [rust-lang/crates-io-auth-action](https://github.com/rust-lang/crates-io-auth-action). Updates `bencherdev/bencher` from 0.6.13 to 0.6.16 - [Release notes](https://github.com/bencherdev/bencher/releases) - [Commits](bencherdev/bencher@v0.6.13...v0.6.16) Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.3 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@v10.2.0...v10.3.3) Updates `j178/prek-action` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/j178/prek-action/releases) - [Commits](j178/prek-action@v3.0.0...v3.1.0) Updates `rust-lang/crates-io-auth-action` from 1.0.5 to 1.0.6 - [Release notes](https://github.com/rust-lang/crates-io-auth-action/releases) - [Commits](rust-lang/crates-io-auth-action@v1.0.5...v1.0.6) --- updated-dependencies: - dependency-name: bencherdev/bencher dependency-version: 0.6.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 10.3.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: j178/prek-action dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: rust-lang/crates-io-auth-action dependency-version: 1.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-11-03T20:13:54Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 8658d233-6a22-44e8-8a67-44cdb0c2d42a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

Run CodeRabbit Verify to test the changes in this pull request.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 3, 2026

Navigation Menu

Repository navigation

build(deps): bump the actions group across 1 directory with 4 updates - #50

build(deps): bump the actions group across 1 directory with 4 updates#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-8f607369cf

dependabot Bot commented on behalf of github Nov 3, 2026

Uh oh!

coderabbitai Bot commented Nov 3, 2026

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 3, 2026

v0.6.16

v0.6.15

v0.6.14

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.3.2 🌈 update known checksums for 0.13.5

Changes

🧰 Maintenance

📚 Documentation

v10.3.1 🌈 preserve cache error class names in save-cache bundle

Changes

🐛 Bug fixes

🧰 Maintenance

v3.1.0

What's Changed

v3.0.2

What's Changed

New Contributors

v3.0.1

What's Changed

v1.0.6

What's Changed

Uh oh!

coderabbitai Bot commented Nov 3, 2026

Review skipped

CodeRabbit Verify

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants