[dependabot]

Bumps taiki-e/install-action from 2.88.1 to 2.90.2.

Release notes

Sourced from taiki-e/install-action's releases.

2.90.2

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

2.90.1

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

2.90.0

• Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

• Update vacuum@latest to 0.36.2.

• Update release-plz@latest to 0.4.3.

• Update bpf-linker@latest to 0.13.0.

2.89.1

• Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

• Update parse-dockerfile@latest to 0.1.9.

• Update parse-changelog@latest to 0.6.18.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

[2.90.2] - 2026-11-06

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

[2.90.1] - 2026-11-04

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

[2.90.0] - 2026-11-03

• Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

• Update vacuum@latest to 0.36.2.

• Update release-plz@latest to 0.4.3.

• Update bpf-linker@latest to 0.13.0.

[2.89.1] - 2026-11-02

• Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

... (truncated)

Commits

• 3a3daaf Release 2.90.2
• 9002010 Update yq manifest
• b15e87a Update vacuum manifest
• 35247b9 Update trivy@latest to 0.76.2
• 851a180 Update tombi@latest to 1.10.0
• 6aa2ee9 Update syft manifest
• eeedd0c Update rclone manifest
• a96a6aa Update protoc-gen-connect-openapi manifest
• ca1644a Update prek@latest to 0.5.10
• 6ba2993 Update mise@latest to 2026.11.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Antigravity review (Gemini via Ultra)

Bumps taiki-e/install-action from v2.88.1 to v2.90.2 across all five workflow usages in ci.yml, feature-powerset.yml, and security.yml.

Blocking issues

None found. This is a trivial dependency bump covering every occurrence of taiki-e/install-action in .github/workflows/.

Suggestions

• ci.yml, ci.yml, feature-powerset.yml, security.yml, security.yml: Consider pinning third-party GitHub Actions to an immutable full-length commit SHA (with # v2.90.2 as a trailing comment for Dependabot) rather than a mutable release tag to harden the CI supply chain against tag retargeting.
• Note that taiki-e/install-action updates its internal tool manifests between releases, so bumping from 2.88.1 to 2.90.2 may pull newer prebuilt versions of cargo-fuzz, cargo-llvm-cov, cargo-hack, cargo-audit, and cargo-deny; ensure all five jobs pass in CI before merging.

Nitpicks

None.

_{Automated first-pass review by agy on a self-hosted runner -- not a human review.}