[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v3.39.0 → v3.39.1
vmactions/openbsd-vm	action	patch	v1.4.8 → v1.4.9
vmactions/solaris-vm	action	patch	v1.4.1 → v1.4.2
zizmorcore/zizmor-action	action	minor	v0.7.1 → v0.8.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

github/codeql-action

v3.39.1

Compare Source

• Update default CodeQL bundle version to 2.27.3. #​4256

vmactions/openbsd-vm

v1.4.9

Compare Source

OpenBSD 8.0

OpenBSD 8.0, released on 2026-10-20, is supported and is now the
default release, on x86_64, aarch64, riscv64 and sparc64. 7.9 stays
available with release: "7.9".

The test matrix runs on ubuntu-26.04 and ubuntu-26.04-arm and covers
7.7, 7.8, 7.9 and 8.0: 74 of 75 jobs pass, and the 9p job is skipped
as before.

New images

openbsd-builder 2.1.1 adds the 8.0 images and rebuilds 7.7, 7.8 and
7.9: https://github.com/anyvm-org/openbsd-builder/releases/tag/v2.1.1

Fixed: non-root users could not write the nfs share

With sync: nfs, a build run as an ordinary user created in the guest
could write the workspace only if that user's uid happened to equal the
runner's; any other uid got "Permission denied"
(vmactions/solaris-vm#70). The nfs export mapped only guest root to the
runner user. anyvm 0.7.4 maps every guest uid to the runner user, so
files any guest user creates are owned by the runner user on the host,
as files from guest root already were. Nothing to change in your
workflow. The test matrix now writes the share as a uid-4321 guest
user on every release.

New input: cache-after-prepare-key-suffix

Optional, empty by default. A non-empty value is appended to the
cache-after-prepare key, so changing it rebuilds the prepared image.
Use it when prepare runs a script from your repository, which the key
does not cover (vmactions/freebsd-vm#167), for example:

cache-after-prepare-key-suffix: deps-${{ hashFiles('ci/deps.sh') }}

Existing prepared-image caches stay valid when the input is not set.

Pins

BUILDER_VERSION 2.1.0 -> 2.1.1 for 7.7, 7.8 and 7.9; 2.1.1 for 8.0;
0.9.9, 1.1.2 and 1.1.4 for older releases (unchanged)
ANYVM_VERSION 0.7.2 -> 0.7.4

vmactions/solaris-vm

v1.4.2

Compare Source

Solaris: non-root users can write the nfs-synced folder

The runtime moves to anyvm 0.7.4, whose nfs fix is the reason for this
release: https://github.com/anyvm-org/anyvm/releases/tag/v0.7.4
On ubuntu-26.04 runners 23 of 25 test jobs pass; the 9p and sshfs jobs
are skipped as before.

Fixed: non-root users could not write the nfs share

#​70: with sync: nfs, a build run as an ordinary
user created in the guest failed with "Permission denied", while the
same workflow worked on FreeBSD. The nfs export mapped only guest root
to the runner user; any other guest account kept its own uid and met
the runner-owned workspace as "other". FreeBSD worked by coincidence:
its first pw useradd hands out uid 1001, the GitHub runner's own uid.
Solaris useradd hands out 1000.

anyvm 0.7.4 now maps every guest uid to the runner user: the kernel nfs
export of a Linux runner gets all_squash, and on other hosts the
user-space nfsd 0.1.1 runs with -all_squash. Files any guest user
creates are owned by the runner user on the host, as files from guest
root already were. Nothing to change in your workflow.

The test matrix now checks this on every release: a guest user with
uid 4321 creates, appends to and renames a file in the share, and the
runner checks its content and that the runner user owns it.

New input: cache-after-prepare-key-suffix

Optional, empty by default. A non-empty value is appended to the
cache-after-prepare key, so changing it rebuilds the prepared image.
Use it when prepare runs a script from your repository, which the key
does not cover (vmactions/freebsd-vm#167), for example:

cache-after-prepare-key-suffix: deps-${{ hashFiles('ci/deps.sh') }}

Existing prepared-image caches stay valid when the input is not set.

Pins

BUILDER_VERSION 2.0.8 (unchanged)
ANYVM_VERSION 0.7.2 -> 0.7.4

zizmorcore/zizmor-action

v0.8.0

Compare Source

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version
of zizmor or version: prerelease to get whatever latest
prerelease the action knows about.

What's Changed

• Support prereleases by @​woodruffw in #​182
• Sync zizmor versions by @​github-actions[bot] in #​184

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 2am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

CT Test Results

  1 files   11 suites   2m 51s ⏱️
 96 tests  92 ✅ 4 💤 0 ❌
112 runs  108 ✅ 4 💤 0 ❌

Results for commit a424d2d.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

• Complete CT logs (Download Logs)
• HTML Documentation (Download HTML Docs)
• Windows Installer

// Erlang/OTP Github Action Bot