chore(deps): bump Swatinem/rust-cache from e18b497796c12c097a38f9edb9d0641fb99eee32 to f0d9c3887740aee45f6153b24b3a6b815192ec16

[dependabot]

Bumps Swatinem/rust-cache from e18b497796c12c097a38f9edb9d0641fb99eee32 to f0d9c3887740aee45f6153b24b3a6b815192ec16.

Changelog

Sourced from Swatinem/rust-cache's changelog.

Changelog

2.9.2

• Fix credentials.toml cleanup
• Improvements to cleanup, preserving more valid targets
• Improvements to cargo install handling
• Correctly sort/dedupe Rust versions

2.9.1

• Fix regression in hash calculation

2.9.0

• Update to node24
• Support running from within a nix shell
• Consider all installed toolchains for cache key
• Use case-insensitive comparison to determine exact cache hit

2.8.2

• Don't overwrite env for cargo-metadata call

2.8.1

• Set empty CARGO_ENCODED_RUSTFLAGS when retrieving metadata
• Various dependency updates

2.8.0

• Add support for warpbuild cache provider
• Add new cache-workspace-crates feature

2.7.8

• Include CPU arch in the cache key

2.7.7

• Also cache cargo install metadata

2.7.6

• Allow opting out of caching $CARGO_HOME/bin
• Add runner OS in cache key
• Adds an option to do lookup-only of the cache

2.7.5

... (truncated)

Commits

• f0d9c38 Merge pull request #380 from Swatinem/dependabot/github_actions/actions-8ff58...
• ccd9742 Bump the actions group with 2 updates
• 258712b fix: stop cleanup timestamp pruning after the first entry (#377)
• a45951f Merge pull request #373 from Swatinem/dependabot/github_actions/actions-420be...
• b882611 Bump the actions group with 2 updates
• 6323deb 2.9.2
• b16e8d7 bump rollup and rebuild
• 3bf42ac invert target/profile check in cleanup
• 6e5b278 correctly sort and dedupe Rust versions
• 5adc05f Bump the actions group across 1 directory with 3 updates (#368)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8094957

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[freshtonic]

Requesting changes: the new pin is not a release of rust-cache — it is the master branch head.

I verified against upstream: f0d9c3887740aee45f6153b24b3a6b815192ec16 is Swatinem/rust-cache's current master tip (an internal dependabot-merge commit from 17 Aug), while the v2 tag this pin's comment claims to track dereferences to 6323deb102c322ba6fcbdcafc7e3dddab59af2b6 (= v2.9.2, the latest release, 6 Aug). So this diff pins our EQL CI (bench-eql, macro-expand-eql, test-eql — the jobs that compile the Rust workspace) to unreleased, unreviewed-by-release action code, and leaves the # v2 comment describing a ref the pin no longer matches.

The SHA is genuinely upstream (I checked), so this is hygiene rather than an active compromise — but the whole point of full-SHA pinning under this repo's supply-chain posture is that CI runs released action code and the comment tells the truth about which release. Suggested fix, all three files:

- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

(The previous pin had the same shape — a non-tag master commit under a # v2 comment — so Dependabot is faithfully continuing an existing convention; re-pinning to the release commit with an exact-version comment is what stops it doing this on every future bump.)

[auxesis]

Closing this PR, because its new pin is not a release of Swatinem/rust-cache.

The new pin is the master branch head

f0d9c3887740aee45f6153b24b3a6b815192ec16 is a commit on rust-cache's master branch, not a tagged release. freshtonic found this in review. Every pin in this repository names a release, so that each update is a version someone can read about. main pins e18b4977 in 24 places. The latest rust-cache release is v2.9.2, from 6 August 2026.

No open PR replaces this one yet

Dependabot does not propose a version again after its PR is closed. It opens a new PR when rust-cache tags its next release. Or someone can pin v2.9.2 by hand, in its own PR.

Its failing checks were not caused by this update

The PG17 shards of Test EQL fail on this PR, and on #1023 and #1055, in the same way: "op-selector drifted from the pinned constant". Dependabot runs read their secrets from a separate store, which still holds keys from before the 11 July 2026 rotation. So the EQL fixtures come from a different keyset. This PR changes only the rust-cache pin, and it fails in exactly the same way, which shows that the dependency update is not the cause. This PR is also about 1,000 commits behind main.

🤖 Generated with Claude Code

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.