Bump the minor-and-patch group with 2 updates

[dependabot]

Bumps the minor-and-patch group with 2 updates: softprops/action-gh-release and vmactions/freebsd-vm.

Updates softprops/action-gh-release from 3.0.2 to 3.0.3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

• fix: safely classify GitHub API errors by @​chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

• dependency updates

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

• fix: safely classify GitHub API errors by @​chenrui333 in softprops/action-gh-release#822

Other Changes 🔄

• dependency updates

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in softprops/action-gh-release#813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in softprops/action-gh-release#801
• fix: upload small checksum assets reliably by @​chenrui333 in softprops/action-gh-release#815
• fix: replace existing release assets on Gitea by @​chenrui333 in softprops/action-gh-release#816
• fix: clarify release creation 404 errors by @​chenrui333 in softprops/action-gh-release#817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in softprops/action-gh-release#812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in softprops/action-gh-release#814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

3.0.1

• maintenance release with updated dependencies

... (truncated)

Commits

• efb3536 release 3.0.3 (#840)
• 6441963 chore(deps): bump the npm group with 2 updates (#839)
• e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
• d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)
• 6403751 chore(deps): bump the npm group with 2 updates (#835)
• 7c7184b chore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)
• 0f3f0d2 chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)
• 77fb938 chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)
• 5a6f517 chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)
• a3c91c9 chore(deps): bump the github-actions group with 2 updates (#825)
• Additional commits viewable in compare view

Updates vmactions/freebsd-vm from 1.5.3 to 1.5.5

Release notes

Sourced from vmactions/freebsd-vm's releases.

v1.5.5

The runtime moves to anyvm v0.6.5 (from v0.6.4), keeping the whole fleet on one version. This action's surface is unchanged -- same images, same sync methods, same defaults. The bump carries one runtime change of note: on hosts whose nested AMD virtualization corrupts AVX512 XSAVE state, the CPU-feature mask now drops the whole AVX512 family instead of only avx512f.

Full Changelog: vmactions/freebsd-vm@v1.5.4...v1.5.5

v1.5.4

sync: tar

A fourth way to share the workspace, available on every architecture including riscv64 and powerpc64, where rsync and sshfs do not exist:

The workspace is streamed in as a ustar archive over the ssh connection the action already opens, and streamed back the same way when the run finishes. Nothing is installed in the guest and no filesystem support is needed on either side, unlike sshfs and nfs. Verified before shipping: 300 files plus a 1 MB binary blob pushed into a 15.1 guest, a file written inside it, the whole tree pulled back and compared by content hash.

rsync remains the default. Reach for tar when the guest lacks rsync, or when a mount-based method is more machinery than the job needs.

Under the hood

The image builder moves to freebsd-builder v2.2.6 and the runtime to anyvm v0.6.4, nine releases on from what v1.5.3 shipped. Most of that is other guests, but two fixes reach every action:

A failed folder sync used to be a warning. The run continued with the guest missing the files it was about to use, which surfaced much later as a confusing error or a job that sat until its timeout. It is now fatal, and says so.

The workspace push no longer carries the runner's own harness directories into the guest.

Also

The shell note no longer mentions usesh, which has not been needed for some time.

Full Changelog: vmactions/freebsd-vm@v1.5.3...v1.5.4

Commits

• f0552d3 Update vmactions/freebsd-vm from base-vm
• 5595fc6 Generated from base-vm
• 0206b2a Sync from base-builder
• 2ed1747 Update vmactions/freebsd-vm from base-vm
• be1c6e8 Generated from base-vm
• bddcfce Update vmactions/freebsd-vm from base-vm
• 139a2cb Generated from base-vm
• 0a1a391 Update version to v1.5.4
• 759dd0c Update vmactions/freebsd-vm from base-vm
• b5370dd Generated from base-vm
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions