[dependabot]

Bumps taiki-e/install-action from 2.88.0 to 2.90.1.

Release notes

Sourced from taiki-e/install-action's releases.

2.90.1

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

2.90.0

• Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

• Update vacuum@latest to 0.36.2.

• Update release-plz@latest to 0.4.3.

• Update bpf-linker@latest to 0.13.0.

2.89.1

• Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

• Update parse-dockerfile@latest to 0.1.9.

• Update parse-changelog@latest to 0.6.18.

• Update cargo-minimal-versions@latest to 0.1.38.

• Update cargo-hack@latest to 0.6.46.

2.89.0

• Support yq. (#2036, thanks @​FirelightFlagboy)

• Support mold. (#2044, thanks @​FirelightFlagboy)

• Fix an error when old cargo-binstall had already been installed at non-standard location. (#2048)

• Update wasm-tools@latest to 1.263.0.

• Update wasm-pack@latest to 0.15.1.

• Update wasm-bindgen@latest to 0.2.130.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.90.2] - 2026-11-06

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

[2.90.1] - 2026-11-04

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

[2.90.0] - 2026-11-03

... (truncated)

Commits

• c509219 Release 2.90.1
• 4809658 codegen: kache 2.0.0 split binaries
• 2f5a77a Update zizmor@latest to 1.32.0
• 44e3ac1 Update uv@latest to 0.13.7
• 91480af Update typos@latest to 1.52.0
• 1886998 Update tombi@latest to 1.9.9
• d66493d Update syft@latest to 1.56.0
• ae0b89b Update prek manifest
• 773fb6f Update mise@latest to 2026.11.0
• 0a95b08 Update kache@latest to 2.0.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[catalina-oz]

🤖 Dependabot review · ✅ Safe to merge

TL;DR: Minor bump of taiki-e/install-action to v2.90.1; pin verified, no advisories, no input changes. The one red check (stable / clippy) is a reviewdog reporting error unrelated to this action.

Action	Change	Bump	Pin check
taiki-e/install-action	2.88.0 → 2.90.1	minor	✅ tag-match

🔐 Vulnerability check

No advisories fixed, introduced or remaining for taiki-e/install-action; 2 unversioned action refs in the repo were not audited

• GitHub Advisory Database and OSV.dev report no advisories for taiki-e/install-action 2.88.0 or 2.90.1.
• Coverage gap: 2 action references in the workflows carry no version (for example dtolnay/rust-toolchain pinned with # master), so they could not be audited. Dependabot alerts were not accessible to this token (HTTP 403).
• Organisation scanners on the PR (boost-sca, osv-scanner, trivy-fs, boostsecurity scanner) passed.
• Coverage: 2 action reference(s) carry no version to audit.

💥 Breaking-change impact

Composite action, no removed or required inputs; cargo-hack and cargo-llvm-cov installs passed; stable/clippy failure is a reviewdog 404 unrelated to the bump

• Pin c509219c resolves to tag v2.90.1; the single commit is a signed Dependabot commit touching only .github/workflows/check.yml and .github/workflows/test.yml.
• Runtime stays composite; no inputs were removed, added as required or deprecated. 2.90.0 adds an optional fallback: skip input, which these workflows do not use.
• Both call sites, .github/workflows/check.yml:151 (tool: cargo-hack) and .github/workflows/test.yml:173 (tool: cargo-llvm-cov), ran green: ubuntu / stable / features and ubuntu / stable / coverage passed.
• stable / clippy failed with reviewdog: failed to post result: PATCH .../check-runs/128413424677: 404 Not Found, then reviewdog exited with status code: 1 (job). That job uses giraffate/clippy-action, not install-action; it is a failure to report results, not a clippy finding. beta / clippy and the clippy check passed.
• No required checks are configured on this branch.

🧪 Checks

• CI on dd93790: 24 passed · 1 failed · 0 pending · 2 skipped
  • ❌ stable / clippy

➡️ Next steps

1. Re-run the failed stable / clippy job to clear the reviewdog reporting error.
2. Merge once a code owner approves.

_{Automated Dependabot review · GitHub Advisory Database ✅ · OSV.dev ✅ · Dependabot alerts ⚠️ unavailable. This review never approves: merging still requires a maintainer review.}