← Watch feed
Merge rust-bitcoin/rust-bitcoin#6803: build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7
Public commit record
96/100 · Strong
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6803: build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7
11e5f5fe97bcc36406a7ab4a7c96997ab7c4522f build(deps): bump taiki-e/install-action from 2.82.5 to 2.82.7 (dependabot[bot])
Pull request description:
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.82.5 to 2.82.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p>
<blockquote>
<h2>2.82.7</h2>
<ul>
<li>
<p>Update <code>tombi@latest</code> to 1.1.6.</p>
</li>
<li>
<p>Update <code>kingfisher@latest</code> to 1.105.0.</p>
</li>
<li>
<p>Update <code>gungraun-runner@latest</code> to 0.19.3.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.8.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.55.1.</p>
</li>
<li>
<p>Update <code>cargo-tarpaulin@latest</code> to 0.36.0.</p>
</li>
</ul>
<h2>2.82.6</h2>
<ul>
<li>
<p>Update <code>vacuum@latest</code> to 0.29.7.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.11.25.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.46.0.</p>
</li>
<li>
<p>Update <code>dprint@latest</code> to 0.55.0.</p>
</li>
<li>
<p>Update <code>cargo-auditable@latest</code> to 0.7.5.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.</p>
<p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<h2>[Unreleased]</h2>
<h2>[2.87.2] - 2026-08-30</h2>
<ul>
<li>
<p>Update <code>typos@latest</code> to 1.50.0.</p>
</li>
<li>
<p>Update <code>tombi@latest</code> to 1.5.0.</p>
</li>
<li>
<p>Update <code>shfmt@latest</code> to 3.14.0.</p>
</li>
</ul>
<h2>[2.87.1] - 2026-08-29</h2>
<ul>
<li>
<p>Update <code>uv@latest</code> to 0.12.7.</p>
</li>
<li>
<p>Update <code>typos@latest</code> to 1.49.1.</p>
</li>
<li>
<p>Update <code>syft@latest</code> to 1.51.1.</p>
</li>
<li>
<p>Update <code>prek@latest</code> to 0.5.0.</p>
</li>
<li>
<p>Update <code>d2@latest</code> to 0.8.2.</p>
</li>
<li>
<p>Update <code>cargo-zigbuild@latest</code> to 0.23.3.</p>
</li>
<li>
<p>Update <code>cargo-rdme@latest</code> to 2.2.2.</p>
</li>
<li>
<p>Update <code>biome@latest</code> to 2.5.11.</p>
</li>
</ul>
<h2>[2.87.0] - 2026-08-27</h2>
<ul>
<li>
<p>Support <code>kache</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1980">#1980</a>, thanks <a href="https://github.com/ChrisJr404"><code>@ChrisJr404</code></a>)</p>
</li>
<li>
<p>Update <code>vacuum@latest</code> to 0.30.1.</p>
</li>
<li>
<p>Update <code>uv@latest</code> to 0.12.6.</p>
</li>
<li>
<p>Update <code>mise@latest</code> to 2026.8.14.</p>
</li>
<li>
<p>Update <code>editorconfig-checker@latest</code> to 3.11.2.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/taiki-e/install-action/commit/16b05812d776ae1dfaabc8277e421fb6d2506419"><code>16b0581</code></a> Release 2.82.7</li>
<li><a href="https://github.com/taiki-e/install-action/commit/68c845308d9b56d38e797c62e48eddfe1b4ba94f"><code>68c8453</code></a> Update uv manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/8532697fda4ee37ccd65901e90d87a785c45d7bd"><code>8532697</code></a> Update trivy manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/2959f9e73b89d18f2d72d0aa55ed797e70062732"><code>2959f9e</code></a> Update <code>tombi@latest</code> to 1.1.6</li>
<li><a href="https://github.com/taiki-e/install-action/commit/9bfa119f6c347b458726d629758b16dd861727a4"><code>9bfa119</code></a> Update <code>kingfisher@latest</code> to 1.105.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f198b91ffb69aa6008cb3b0ea9cf6eb6b0af01f4"><code>f198b91</code></a> Update just manifest</li>
<li><a href="https://github.com/taiki-e/install-action/commit/20feedd5827d6d189bca20753dbd5582948e7478"><code>20feedd</code></a> Update <code>gungraun-runner@latest</code> to 0.19.3</li>
<li><a href="https://github.com/taiki-e/install-action/commit/314197aa953241335b4a4c41c2d6e8066d6150da"><code>314197a</code></a> Update <code>editorconfig-checker@latest</code> to 3.8.0</li>
<li><a href="https://github.com/taiki-e/install-action/commit/f8632ebbd28b43dce012ff3db91c959c7751db33"><code>f8632eb</code></a> Update <code>dprint@latest</code> to 0.55.1</li>
<li><a href="https://github.com/taiki-e/install-action/commit/4234dc0f7acb7e7774a1716b103fcaf2d9ed9b4d"><code>4234dc0</code></a> Update <code>cargo-tarpaulin@latest</code> to 0.36.0</li>
<li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/bffeee26d4db9be238a4ea78d8826604ebcb594d...16b05812d776ae1dfaabc8277e421fb6d2506419">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit:
apoelstra:
ACK 11e5f5fe97bcc36406a7ab4a7c96997ab7c4522f; successfully ran local tests
Tree-SHA512: dd0168fc4bca1701a29f8310bb92c1b613c34f3845a896a031061f4dfa4d6fd4c1995bcc07415fc9802baa487136b5103d02af9b90ad41100440f07823050887
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
What changed, and why it matters
This is a routine Dependabot update that bumps a GitHub Actions helper (taiki-e/install-action) used in automated testing workflows from version 2.82.5 to 2.82.7. It only changes which version of a third-party action is invoked when installing testing tools. There is no indication this fixes or introduces a security problem in the rust-bitcoin library itself.
Recommended action
No security action required. Treat as normal dependency hygiene for CI infrastructure.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates two workflow files to pin taiki-e/install-action at commit 16b05812d776ae1dfaabc8277e421fb6d2506419 (v2.82.7) instead of bffeee26d4db9be238a4ea78d8826604ebcb594d (v2.82.5). The action is used solely to install cargo-mutants in CI mutation-testing jobs. The upstream release notes list only version bumps of unrelated tools (tombi, kingfisher, dprint, cargo-tarpaulin, etc.) and do not mention any security fix. No source code in the rust-bitcoin crate is modified.
Changed components
.github/workflows/cron-weekly-cargo-mutants.yml.github/workflows/rust.ymlInspect captured patch +2 / −2
### .github/workflows/cron-weekly-cargo-mutants.yml
@@ -14,7 +14,7 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5
+ - uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2.82.7
with:
tool: cargo-mutants
- run: cargo mutants --in-place --no-shuffle
### .github/workflows/rust.yml
@@ -311,7 +311,7 @@ jobs:
run: git fetch origin master
- name: "Retrieve relative diff"
run: git diff origin/master.. -- '*.rs' | tee git.diff
- - uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5
+ - uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2.82.7
with:
tool: cargo-mutants
- run: cargo mutants --no-shuffle --in-diff git.diffRisk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.