[dependabot]

Bumps the actions group with 2 updates: taiki-e/install-action and astral-sh/setup-uv.

Updates taiki-e/install-action from 2.87.31 to 2.89.0

Release notes

Sourced from taiki-e/install-action's releases.

2.89.0

• Support yq. (#2036, thanks @​FirelightFlagboy)

• Support mold. (#2044, thanks @​FirelightFlagboy)

• Fix an error when old cargo-binstall had already been installed at non-standard location. (#2048)

• Update wasm-tools@latest to 1.263.0.

• Update wasm-pack@latest to 0.15.1.

• Update wasm-bindgen@latest to 0.2.130.

• Update vacuum@latest to 0.36.1.

• Update prek@latest to 0.5.9.

• Update mise@latest to 2026.10.25.

• Update kingfisher@latest to 2.16.0.

• Update cargo-binstall@latest to 1.26.2.

2.88.1

• Update wasmtime@latest to 50.0.1.

• Update vacuum@latest to 0.36.0.

• Update tombi@latest to 1.9.8.

• Update mise@latest to 2026.10.23.

• Update kingfisher@latest to 2.15.0.

• Update espup@latest to 0.19.0.

• Update deepsource@latest to 0.10.2.

• Update biome@latest to 2.6.4.

2.88.0

• Support similarity-rs. (#2017, thanks @​HardMax71)

2.87.33

• Update vacuum@latest to 0.35.4.

• Update uv@latest to 0.13.6.

• Update trunk@latest to 0.22.1.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.0] - 2026-11-03

• Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

• Update vacuum@latest to 0.36.2.

• Update release-plz@latest to 0.4.3.

• Update bpf-linker@latest to 0.13.0.

[2.89.1] - 2026-11-02

• Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

• Update parse-dockerfile@latest to 0.1.9.

• Update parse-changelog@latest to 0.6.18.

• Update cargo-minimal-versions@latest to 0.1.38.

• Update cargo-hack@latest to 0.6.46.

[2.89.0] - 2026-11-01

• Support yq. (#2036, thanks @​FirelightFlagboy)

• Support mold. (#2044, thanks @​FirelightFlagboy)

• Fix an error when old cargo-binstall had already been installed at non-standard location. (#2048)

• Update wasm-tools@latest to 1.263.0.

• Update wasm-pack@latest to 0.15.1.

• Update wasm-bindgen@latest to 0.2.130.

• Update vacuum@latest to 0.36.1.

... (truncated)

Commits

• 1919c4a Release 2.89.0
• 010423f Update changelog
• cb869a6 Support yq (#2036)
• eacbab5 Do not assume that existing cargo-binstall is installed at ${cargo_bin}
• e49373f ci: Add test for issue 2047
• f4fa742 Support mold (#2044)
• dfff5d3 tools: Update tidy.sh
• 4d0d809 ci: Test alpine:3.24
• c6d3cd4 ci: Update taiki-e/github-actions workflows
• 032e621 ci: Mark wasm-bindgen as glibc_pre_2_39_incompat
• Additional commits viewable in compare view

Updates astral-sh/setup-uv from 10.3.2 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#1113)
• docs: update version references to v10.3.2 @github-actions[bot] (#1104)

Commits

• 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
• 0192b69 chore: update known checksums for 0.13.6 (#1117)
• 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
• 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
• 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
• 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
• 56618ca docs: update version references to v10.3.2 (#1104)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d71fc810-3318-4600-b61d-8f210b54eed1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[github-actions]

Tests: passed

Where	Result	Passed	Failed	Time
Linux arm64	passed	838	0	17 s
Linux x86_64	passed	5769	0	79 s
macOS Intel	passed	5214	0	554 s
macOS Apple Silicon: build only (cannot run here)	passed
Windows arm64: build only (cannot run here)	passed
Windows x64	passed	5068	0	433 s

_{Commit 8fbb8e2 · the run}

[github-actions]

Lint: failed

Check	Result
rustfmt	passed
clippy (warnings fail)	passed
cargo deny (advisories, licences, sources)	failed

cargo deny (advisories, licences, sources)

    │
978 │ wasmtime 48.0.7 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0424
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0424
    ├ This is an entry in the RustSec database for the Wasmtime security advisory
      located at
      https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6fr9-xmw9-5352
      For more information see the GitHub-hosted security advisory.
    ├ Announcement: https://github.com/bytecodealliance/wasmtime/pull/15075
    ├ Solution: Upgrade to >=36.0.20, <37.0.0 OR >=48.0.8, <49.0.0 OR >=49.0.5, <50.0.0 OR >=50.0.1 (try `cargo update -p wasmtime`)
    ├ wasmtime v48.0.7
      ├── apid v0.1.0
      └── wasmtime-c-api-impl v48.0.7
          └── tree-sitter v0.27.1
              └── weft v0.1.0
                  ├── agentplaza-cli v0.1.0
                  ├── apid v0.1.0 (*)
                  └── apz-link v0.1.0
                      ├── apid v0.1.0 (*)
                      ├── noded v0.1.0
                      └── vsockd v0.1.0
                          └── noded v0.1.0 (*)

warning[yanked]: detected yanked crate (try `cargo update -p clipboard-win`)
    ┌─ /opt/actions-runner/_work/agentplaza/agentplaza/Cargo.lock:184:1
    │
184 │ clipboard-win 5.4.1 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ yanked version
    │
    ├ clipboard-win v5.4.1
      └── window_clipboard v0.5.1
          └── iced_winit v0.14.1
              └── iced v0.14.0
                  ├── agentplaza-desktop v0.1.0
                  └── iced_wry v0.1.0
                      └── agentplaza-desktop v0.1.0 (*)

advisories FAILED, bans ok, licenses ok, sources ok

_{Commit 8fbb8e2 · the run}

[github-actions]

Web console: passed

Check	Result
type-check	passed
build (with the wasm engine)	passed
tests	passed

_{Commit 8fbb8e2 · the run}

[github-actions]

Coverage: 69.2% of lines

Measured on this commit: the Rust tests (unit, integration, and both together), the hub API's Bruno collection against an instrumented hub, and the web console's tests. A line counts once in All, when any test type covers it.

By test type

Test type	Lines	Functions	Files
Rust unit tests	60.8% (285,280 of 468,872)	58.2% (30,626 of 52,648)	1,190
Rust integration tests	13.5% (63,383 of 468,872)	13.9% (7,332 of 52,648)	1,190
Rust unit and integration together	64.1% (300,680 of 468,872)	61.7% (32,480 of 52,648)	1,190
Hub API (Bruno), code	32.2% (56,937 of 176,895)	35.3% (8,014 of 22,706)	607
Hub API spec operations	638 of 691 operations (92.3%)	–	–
Web console	98.9% (33,353 of 33,708)	77.6% (902 of 1,162)	129 of 242 sources
All test types	69.2% (347,942 of 502,580)	66.2% (35,637 of 53,810)	1,319

By service and app

Service or app	Rust unit	Rust integration	Hub API	Web console	All
apid Hub (apid)	67.0%	9.7%	37.3%	–	78.6% of 161,065
noded Node daemon (noded)	74.6%	8.9%	–	–	75.2% of 17,062
vsockd Orchestration (vsockd)	90.2%	0.0%	–	–	90.2% of 6,989
apz-link Node link (apz-link)	69.3%	0.0%	0.0%	–	69.3% of 1,527
dispatchd Fleet dispatcher (dispatchd)	93.8%	0.0%	–	–	93.8% of 2,735
vmm VM monitor (vmm)	75.8%	2.5%	–	–	76.4% of 24,238
agent-harness Guest agent harness (agent-harness)	84.8%	2.8%	–	–	85.3% of 24,672
apz-workstation Workstation daemon (apz-workstation)	63.7%	18.0%	–	–	77.4% of 5,030
weft Version control (weft)	46.0%	62.1%	5.0%	–	72.0% of 12,444
agentplaza-desktop Desktop app	17.2%	0.0%	–	–	17.2% of 84,557
agentplaza-cli Command line	48.3%	0.0%	–	–	48.3% of 32,025
@agentplaza/web Web console	–	–	–	98.9%	98.9% of 33,708

By crate (62), least covered first

Crate	Rust unit	Rust integration	Hub API	Web console	All
vmctl	28.0%	0.0%	–	–	28.0% of 868
apz-pack	38.3%	0.0%	–	–	38.3% of 321
apz-evals	42.6%	0.0%	–	–	42.6% of 911
apz-desktop-atspi	46.4%	0.0%	–	–	46.4% of 842
apz-desktop-wayland	65.5%	0.0%	–	–	65.5% of 675
apz-gui-agent	65.6%	0.0%	–	–	65.6% of 442
apz-link	69.3%	0.0%	0.0%	–	69.3% of 1,527
apz-sandbox	70.5%	7.9%	0.0%	–	70.5% of 430
weft	46.0%	62.1%	5.0%	–	72.0% of 12,444
apz-engine	69.1%	46.5%	–	–	72.5% of 14,446
noded	74.6%	8.9%	–	–	75.2% of 17,062
vmm	75.8%	2.5%	–	–	76.4% of 24,238
jhrl	66.1%	52.9%	13.3%	–	76.7% of 8,572
apz-desktop-x11	46.7%	40.5%	–	–	77.2% of 1,862
apz-workstation	63.7%	18.0%	–	–	77.4% of 5,030
apid	67.0%	9.7%	37.3%	–	78.6% of 161,065
apz-vt	81.3%	0.0%	0.0%	–	81.3% of 834
apz-topology	66.7%	40.1%	0.9%	–	83.8% of 11,235
agent-harness	84.8%	2.8%	–	–	85.3% of 24,672
apz-view	37.9%	56.1%	46.4%	–	86.0% of 1,557
apz-setup	86.8%	0.0%	–	–	86.8% of 1,013
apz-store	76.2%	77.5%	61.5%	–	88.0% of 1,881
apz-theme-web	88.5%	0.0%	–	–	88.5% of 270
apz-acp	79.6%	30.3%	0.0%	–	88.8% of 1,593
apz-lsp	81.6%	54.1%	0.0%	–	89.7% of 1,443
apz-theme	61.2%	65.4%	38.0%	–	89.7% of 1,863
apz-rich	80.6%	71.1%	47.2%	–	89.8% of 707
vsockd	90.2%	0.0%	–	–	90.2% of 6,989
apz-desktop-windows	90.5%	0.0%	–	–	90.5% of 693
apz-blobs	89.8%	54.8%	48.7%	–	90.6% of 768
apz-store-derive	90.7%	0.0%	–	–	90.7% of 560
apz-os	91.7%	40.3%	48.4%	–	91.7% of 303
apz-ide-web	92.0%	0.0%	–	–	92.0% of 113
apz-ops	92.6%	37.9%	–	–	92.7% of 2,581
apz-transfer	91.0%	77.6%	0.0%	–	92.9% of 491
acpi_tables	93.7%	0.0%	–	–	93.7% of 588
dispatchd	93.8%	0.0%	–	–	93.8% of 2,735
apz-graph-web	94.7%	0.0%	–	–	94.7% of 151
apz-gateway	94.3%	8.4%	26.4%	–	94.7% of 6,345
apz-artifact	82.9%	84.2%	0.0%	–	94.7% of 152
apz-http	94.5%	40.8%	44.0%	–	94.8% of 3,647
apz-metrics	93.9%	39.3%	53.9%	–	95.8% of 2,389
apz-trust	95.9%	23.3%	21.8%	–	95.9% of 416
apz-android	96.3%	0.0%	0.0%	–	96.3% of 707
apz-metrics-view	94.8%	85.6%	48.4%	–	96.6% of 8,464
apz-kit	96.6%	0.0%	–	–	96.6% of 1,678
apz-ux	96.7%	0.0%	0.0%	–	96.7% of 1,165
apz-desktop	82.5%	38.8%	0.0%	–	96.8% of 876
apz-cache	96.8%	36.0%	63.7%	–	96.8% of 347
apz-prompt	96.7%	33.8%	78.1%	–	96.9% of 1,119
apz-ide	96.9%	3.7%	10.2%	–	96.9% of 1,766
apz-proto	97.0%	7.8%	8.8%	–	97.0% of 984
apz-plaza	96.0%	14.3%	65.7%	–	97.0% of 2,954
apz-desktop-macos	97.1%	0.0%	0.0%	–	97.1% of 1,493
apz-skill	97.4%	16.8%	53.8%	–	97.4% of 1,359
apz-uds	97.5%	0.0%	–	–	97.5% of 121
apz-station	97.8%	1.5%	15.5%	–	97.8% of 923
apz-testsel	90.5%	55.6%	0.0%	–	98.7% of 744
apz-graph	99.3%	0.0%	–	–	99.3% of 595
apz-egress-rules	100.0%	2.6%	0.0%	–	100.0% of 229
apz-secrets	100.0%	28.6%	46.2%	–	100.0% of 42
apz-engine-web	–	–	–	–	–

Hub API spec operations by tag

Tag	Tested	Operations
projects	64	70
internal	36	42
e2b	39	39
stations	34	38
foundry	32	33
agents	27	27
metrics	27	27
skills	23	23
nodes	22	22
platforms	17	17
vault	17	17
ide	15	15
prompts	15	15
tasks	15	15
releases	10	14
mcp	13	13
test-lab	11	13
preview	0	12
chats	7	11
evals	7	11
providers	10	10
artifact	9	9
connectors	8	9
laws	9	9
artifacts	8	8
library	8	8
recipes	8	8
board	7	7
engines	7	7
hub-mcp	6	6
files	5	5
intake	2	5
previews	5	5
recipe-runs	4	5
runs	5	5
sessions	5	5
shares	5	5
appearance	4	4
egress	4	4
usage-providers	4	4
weft	3	4
acp	3	3
agent-proposals	3	3
auth	3	3
cards	3	3
console	3	3
decisions	3	3
hub	3	3
loops	3	3
node-link	3	3
plaza	3	3
preview-links	3	3
prices	3	3
roles	3	3
tool-library	3	3
toolbox	3	3
usage	3	3
volumes	3	3
approvals	2	2
ephemeral	2	2
login-bridges	2	2
reviews	2	2
rules	0	2
settings	2	2
storage	0	2
templates	2	2
threads	2	2
unfurl	2	2
allowances	1	1
fleet	1	1
hooks	1	1
ingest	1	1
machine	1	1
machines	1	1
models	1	1
overview	1	1
project-modes	1	1
provider-catalog	1	1
provider-kinds	1	1
release-channels	1	1
transfers	1	1
ws	1	1

_{Commit 8fbb8e2 · the run}

[github-actions]

Hub API (Bruno): passed

2771/2771 API requests pass · 638/691 operations tested · 0 fuzzing findings (reported, they do not fail the pull request)

The report

_{Commit 8fbb8e2 · the run}