Bump vmactions/netbsd-vm from 1.4.7 to 1.4.9

[dependabot]

Bumps vmactions/netbsd-vm from 1.4.7 to 1.4.9.

Release notes

Sourced from vmactions/netbsd-vm's releases.

v1.4.9

support "11.0-microvm", which boots in 7 seconds. fix pkgsrc.

Full Changelog: vmactions/netbsd-vm@v1.4.8...v1.4.9

v1.4.8

Package mirrors: probe first, then trust

On 2026-08-30 the NetBSD.org package hosts went down together -- cdn.NetBSD.org and ftp.NetBSD.org are the same infrastructure behind a CDN, not independent mirrors -- and every pkg_add in every job spent minutes per package in TLS timeouts before dying.

The VM now probes the package mirrors at startup and points pkg_add at the ones that actually answer: cdn.NetBSD.org, ftp.NetBSD.org, the official French mirror ftp.fr.NetBSD.org, ftp.jaist.ac.jp and ftp.allbsd.org, in that order, keeping only the live ones. Dead hosts are dropped entirely rather than kept as fallbacks, because pkg_add walks the whole list for every package it installs, and each dead https entry costs minutes per package. If nothing answers, the configuration is left untouched.

This also retires a long-standing trap in the image's default configuration: its PKG_PATH ended with a NetBSD 9.0 fallback, so a package missing from the preferred hosts was silently installed from the 9.0 set, linked against libraries the running release does not ship. All entries are now same-release only.

The probe runs on every VM start, including boots from a cache-after-prepare image, so the mirror list is always from the current run, never frozen into a cache. Verified during the outage itself: with both NetBSD.org hosts dead, prepare installed its packages from the French mirror on the first try.

Under the hood

The runtime moves to anyvm v0.6.6. Changes under hooks/ now retrigger the project generation, so a hook fix is picked up by the test matrix without waiting for the daily rebuild.

Full Changelog: vmactions/netbsd-vm@v1.4.7...v1.4.8

Commits

• 7f23a49 Update vmactions/netbsd-vm from base-vm
• 9739cfd Generated from base-vm
• dab02a1 fix pkgsrc
• ddaf0eb Update vmactions/netbsd-vm from base-vm
• 2875417 Generated from base-vm
• 191d005 Sync from base-builder
• 5499895 Update vmactions/netbsd-vm from base-vm
• fd079b8 Generated from base-vm
• f79ac1d Update version to v1.4.8
• b017ed6 Update vmactions/netbsd-vm from base-vm
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #187.